[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [ 61.893905][ T26] audit: type=1800 audit(1566836795.449:25): pid=8739 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="cron" dev="sda1" ino=2414 res=0 [ 61.937226][ T26] audit: type=1800 audit(1566836795.449:26): pid=8739 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="mcstrans" dev="sda1" ino=2457 res=0 [ 61.972762][ T26] audit: type=1800 audit(1566836795.449:27): pid=8739 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="restorecond" dev="sda1" ino=2436 res=0 [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.183' (ECDSA) to the list of known hosts. 2019/08/26 16:26:45 fuzzer started 2019/08/26 16:26:48 dialing manager at 10.128.0.26:45029 2019/08/26 16:26:49 syscalls: 2487 2019/08/26 16:26:49 code coverage: enabled 2019/08/26 16:26:49 comparison tracing: enabled 2019/08/26 16:26:49 extra coverage: extra coverage is not supported by the kernel 2019/08/26 16:26:49 setuid sandbox: enabled 2019/08/26 16:26:49 namespace sandbox: enabled 2019/08/26 16:26:49 Android sandbox: /sys/fs/selinux/policy does not exist 2019/08/26 16:26:49 fault injection: enabled 2019/08/26 16:26:49 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled 2019/08/26 16:26:49 net packet injection: enabled 2019/08/26 16:26:49 net device setup: enabled 16:28:56 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r0, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000100)={0x0, 0x10, &(0x7f0000000040)=[@in={0x2, 0x0, @dev}]}, &(0x7f00000001c0)=0x10) getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(r0, 0x84, 0x6d, &(0x7f0000000480)={r1, @in={{0x2, 0x0, @multicast1}}}, &(0x7f0000000140)=0x100) lsetxattr$security_smack_entry(&(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='security.SMACK64MMAP\x00', &(0x7f00000000c0)='vmnet0selfem0#cpuset\x00', 0x15, 0x1) syz_open_dev$mouse(&(0x7f0000000180)='/dev/input/mouse#\x00', 0x8, 0xa0201) 16:28:56 executing program 1: recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/ip6_flowlabel\x00') preadv(r0, &(0x7f00000017c0), 0x2c4, 0x0) syzkaller login: [ 203.297629][ T8907] IPVS: ftp: loaded support on port[0] = 21 [ 203.426330][ T8907] chnl_net:caif_netlink_parms(): no params data found [ 203.482390][ T8907] bridge0: port 1(bridge_slave_0) entered blocking state [ 203.499603][ T8907] bridge0: port 1(bridge_slave_0) entered disabled state [ 203.520002][ T8907] device bridge_slave_0 entered promiscuous mode [ 203.534107][ T8907] bridge0: port 2(bridge_slave_1) entered blocking state [ 203.543047][ T8907] bridge0: port 2(bridge_slave_1) entered disabled state [ 203.551846][ T8907] device bridge_slave_1 entered promiscuous mode [ 203.577719][ T8907] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 203.590751][ T8907] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 203.612211][ T8910] IPVS: ftp: loaded support on port[0] = 21 16:28:57 executing program 2: clone(0x41bc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = getpid() rt_tgsigqueueinfo(r0, r0, 0x16, &(0x7f00000001c0)) ptrace(0x4206, r0) ptrace$setsig(0x4208, r0, 0x0, 0x0) ptrace$setsig(0x4203, r0, 0x0, 0x0) [ 203.625604][ T8907] team0: Port device team_slave_0 added [ 203.637757][ T8907] team0: Port device team_slave_1 added [ 203.761325][ T8907] device hsr_slave_0 entered promiscuous mode 16:28:57 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) prlimit64(0x0, 0x7, &(0x7f0000000040), 0x0) sendmmsg$unix(r1, &(0x7f0000008680)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="14000000000000000100000001000000", @ANYRES32=r1], 0x14}], 0x1, 0x0) sendmmsg$unix(r1, &(0x7f00000019c0)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)=[@rights={{0x14, 0x1, 0x1, [r0]}}], 0x18}], 0x1, 0x0) [ 203.809929][ T8907] device hsr_slave_1 entered promiscuous mode [ 203.894087][ T8912] IPVS: ftp: loaded support on port[0] = 21 [ 203.928765][ T8907] bridge0: port 2(bridge_slave_1) entered blocking state [ 203.936452][ T8907] bridge0: port 2(bridge_slave_1) entered forwarding state [ 203.945334][ T8907] bridge0: port 1(bridge_slave_0) entered blocking state [ 203.952788][ T8907] bridge0: port 1(bridge_slave_0) entered forwarding state 16:28:57 executing program 4: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) prctl$PR_MCE_KILL(0x35, 0x1, 0x4) [ 204.152692][ T8915] IPVS: ftp: loaded support on port[0] = 21 [ 204.203224][ T8910] chnl_net:caif_netlink_parms(): no params data found [ 204.276326][ T8912] chnl_net:caif_netlink_parms(): no params data found [ 204.315325][ T8907] 8021q: adding VLAN 0 to HW filter on device bond0 [ 204.387172][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 204.400266][ T5] bridge0: port 1(bridge_slave_0) entered disabled state [ 204.419849][ T5] bridge0: port 2(bridge_slave_1) entered disabled state [ 204.430231][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 204.465377][ T8919] IPVS: ftp: loaded support on port[0] = 21 [ 204.481292][ T8907] 8021q: adding VLAN 0 to HW filter on device team0 [ 204.491368][ T8910] bridge0: port 1(bridge_slave_0) entered blocking state [ 204.500734][ T8910] bridge0: port 1(bridge_slave_0) entered disabled state 16:28:58 executing program 5: r0 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000440)={'vcan0\x00', 0x0}) r2 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r2, 0x11b, 0x3, &(0x7f00000000c0)=0x4, 0x4) setsockopt$XDP_UMEM_REG(r2, 0x11b, 0x4, &(0x7f0000000100)={&(0x7f0000000000)=""/17, 0x10000, 0x1000}, 0x0) setsockopt$XDP_UMEM_FILL_RING(r2, 0x11b, 0x5, &(0x7f0000000800)=0x8, 0x4) setsockopt$XDP_UMEM_COMPLETION_RING(r2, 0x11b, 0x6, &(0x7f0000000080)=0x80, 0x4) bind$xdp(r2, &(0x7f0000000300)={0x2c, 0x0, r1}, 0x10) sendmmsg(r2, &(0x7f0000000040)=[{{0x0, 0x0, 0x0}, 0xffffffff00000000}], 0x142, 0x44040) [ 204.513605][ T8910] device bridge_slave_0 entered promiscuous mode [ 204.525785][ T8910] bridge0: port 2(bridge_slave_1) entered blocking state [ 204.534388][ T8910] bridge0: port 2(bridge_slave_1) entered disabled state [ 204.543517][ T8910] device bridge_slave_1 entered promiscuous mode [ 204.581303][ T8912] bridge0: port 1(bridge_slave_0) entered blocking state [ 204.589032][ T8912] bridge0: port 1(bridge_slave_0) entered disabled state [ 204.597303][ T8912] device bridge_slave_0 entered promiscuous mode [ 204.612550][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 204.623165][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 204.634028][ T5] bridge0: port 1(bridge_slave_0) entered blocking state [ 204.641475][ T5] bridge0: port 1(bridge_slave_0) entered forwarding state [ 204.667676][ T8912] bridge0: port 2(bridge_slave_1) entered blocking state [ 204.677073][ T8912] bridge0: port 2(bridge_slave_1) entered disabled state [ 204.685698][ T8912] device bridge_slave_1 entered promiscuous mode [ 204.700826][ T2999] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 204.713173][ T2999] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 204.722848][ T2999] bridge0: port 2(bridge_slave_1) entered blocking state [ 204.730336][ T2999] bridge0: port 2(bridge_slave_1) entered forwarding state [ 204.739464][ T2999] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 204.750609][ T8910] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 204.787285][ T2999] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 204.796836][ T2999] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 204.807247][ T2999] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 204.816446][ T2999] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 204.825792][ T2999] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 204.836450][ T8910] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 204.867974][ T8914] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 204.887076][ T8912] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 204.900569][ T8912] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 204.925483][ T8910] team0: Port device team_slave_0 added [ 204.933136][ T8910] team0: Port device team_slave_1 added [ 204.946295][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 204.958178][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 204.968121][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 204.976980][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 204.993042][ T8922] IPVS: ftp: loaded support on port[0] = 21 [ 205.032356][ T8912] team0: Port device team_slave_0 added [ 205.040117][ T8907] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 205.061618][ T8915] chnl_net:caif_netlink_parms(): no params data found [ 205.080568][ T8912] team0: Port device team_slave_1 added [ 205.210433][ T8910] device hsr_slave_0 entered promiscuous mode [ 205.259044][ T8910] device hsr_slave_1 entered promiscuous mode [ 205.318770][ T8910] debugfs: Directory 'hsr0' with parent '/' already present! [ 205.401113][ T8912] device hsr_slave_0 entered promiscuous mode [ 205.449016][ T8912] device hsr_slave_1 entered promiscuous mode [ 205.488779][ T8912] debugfs: Directory 'hsr0' with parent '/' already present! [ 205.496802][ T8915] bridge0: port 1(bridge_slave_0) entered blocking state [ 205.504649][ T8915] bridge0: port 1(bridge_slave_0) entered disabled state [ 205.514809][ T8915] device bridge_slave_0 entered promiscuous mode [ 205.525148][ T8915] bridge0: port 2(bridge_slave_1) entered blocking state [ 205.532368][ T8915] bridge0: port 2(bridge_slave_1) entered disabled state [ 205.540820][ T8915] device bridge_slave_1 entered promiscuous mode [ 205.559972][ T8919] chnl_net:caif_netlink_parms(): no params data found [ 205.594393][ T8915] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 205.608946][ T8907] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 205.646301][ T8915] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 205.716833][ T8915] team0: Port device team_slave_0 added [ 205.725256][ T8915] team0: Port device team_slave_1 added [ 205.736784][ T8919] bridge0: port 1(bridge_slave_0) entered blocking state [ 205.745752][ T8919] bridge0: port 1(bridge_slave_0) entered disabled state [ 205.754225][ T8919] device bridge_slave_0 entered promiscuous mode [ 205.762645][ T8919] bridge0: port 2(bridge_slave_1) entered blocking state [ 205.769819][ T8919] bridge0: port 2(bridge_slave_1) entered disabled state [ 205.777954][ T8919] device bridge_slave_1 entered promiscuous mode [ 205.876224][ T8915] device hsr_slave_0 entered promiscuous mode [ 205.919063][ T8915] device hsr_slave_1 entered promiscuous mode [ 205.988631][ T8915] debugfs: Directory 'hsr0' with parent '/' already present! [ 206.034636][ T8922] chnl_net:caif_netlink_parms(): no params data found [ 206.057547][ T8919] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 206.088331][ T8910] 8021q: adding VLAN 0 to HW filter on device bond0 [ 206.114310][ T8919] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 206.146235][ T8912] 8021q: adding VLAN 0 to HW filter on device bond0 [ 206.188455][ C0] hrtimer: interrupt took 58459 ns [ 206.204092][ T3179] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 206.216791][ T3179] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 206.244914][ T8910] 8021q: adding VLAN 0 to HW filter on device team0 [ 206.256068][ T8919] team0: Port device team_slave_0 added [ 206.274945][ T8919] team0: Port device team_slave_1 added [ 206.285830][ T8922] bridge0: port 1(bridge_slave_0) entered blocking state 16:28:59 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r0, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000100)={0x0, 0x10, &(0x7f0000000040)=[@in={0x2, 0x0, @dev}]}, &(0x7f00000001c0)=0x10) getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(r0, 0x84, 0x6d, &(0x7f0000000480)={r1, @in={{0x2, 0x0, @multicast1}}}, &(0x7f0000000140)=0x100) lsetxattr$security_smack_entry(&(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='security.SMACK64MMAP\x00', &(0x7f00000000c0)='vmnet0selfem0#cpuset\x00', 0x15, 0x1) syz_open_dev$mouse(&(0x7f0000000180)='/dev/input/mouse#\x00', 0x8, 0xa0201) [ 206.294772][ T8922] bridge0: port 1(bridge_slave_0) entered disabled state [ 206.303502][ T8922] device bridge_slave_0 entered promiscuous mode [ 206.347140][ T8912] 8021q: adding VLAN 0 to HW filter on device team0 [ 206.374329][ T8922] bridge0: port 2(bridge_slave_1) entered blocking state 16:28:59 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r0, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000100)={0x0, 0x10, &(0x7f0000000040)=[@in={0x2, 0x0, @dev}]}, &(0x7f00000001c0)=0x10) getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(r0, 0x84, 0x6d, &(0x7f0000000480)={r1, @in={{0x2, 0x0, @multicast1}}}, &(0x7f0000000140)=0x100) lsetxattr$security_smack_entry(&(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='security.SMACK64MMAP\x00', &(0x7f00000000c0)='vmnet0selfem0#cpuset\x00', 0x15, 0x1) syz_open_dev$mouse(&(0x7f0000000180)='/dev/input/mouse#\x00', 0x8, 0xa0201) [ 206.395816][ T8922] bridge0: port 2(bridge_slave_1) entered disabled state [ 206.410933][ T8922] device bridge_slave_1 entered promiscuous mode [ 206.425395][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 206.439222][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 206.461003][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 206.477185][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 206.488038][ T5] bridge0: port 1(bridge_slave_0) entered blocking state [ 206.496634][ T5] bridge0: port 1(bridge_slave_0) entered forwarding state [ 206.512597][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 206.524791][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 206.537544][ T5] bridge0: port 2(bridge_slave_1) entered blocking state [ 206.545757][ T5] bridge0: port 2(bridge_slave_1) entered forwarding state 16:29:00 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r0, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000100)={0x0, 0x10, &(0x7f0000000040)=[@in={0x2, 0x0, @dev}]}, &(0x7f00000001c0)=0x10) getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(r0, 0x84, 0x6d, &(0x7f0000000480)={r1, @in={{0x2, 0x0, @multicast1}}}, &(0x7f0000000140)=0x100) lsetxattr$security_smack_entry(&(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='security.SMACK64MMAP\x00', &(0x7f00000000c0)='vmnet0selfem0#cpuset\x00', 0x15, 0x1) syz_open_dev$mouse(&(0x7f0000000180)='/dev/input/mouse#\x00', 0x8, 0xa0201) [ 206.560705][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 206.574759][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 206.585641][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 206.600313][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready 16:29:00 executing program 0: [ 206.682570][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 206.692290][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 206.701469][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 206.711044][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 206.721343][ T5] bridge0: port 1(bridge_slave_0) entered blocking state [ 206.728957][ T5] bridge0: port 1(bridge_slave_0) entered forwarding state [ 206.735204][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 206.746089][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 206.755702][ T5] bridge0: port 2(bridge_slave_1) entered blocking state [ 206.763051][ T5] bridge0: port 2(bridge_slave_1) entered forwarding state [ 206.772004][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready 16:29:00 executing program 0: [ 206.781321][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 206.790603][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 206.805846][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready 16:29:00 executing program 0: [ 206.844816][ T8922] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link 16:29:00 executing program 0: [ 206.902161][ T8919] device hsr_slave_0 entered promiscuous mode [ 206.965274][ T8919] device hsr_slave_1 entered promiscuous mode [ 207.008810][ T8919] debugfs: Directory 'hsr0' with parent '/' already present! [ 207.026500][ T8915] 8021q: adding VLAN 0 to HW filter on device bond0 [ 207.034545][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 207.046493][ T8922] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 207.067612][ T8910] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 207.080685][ T8910] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 207.100153][ T3179] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 207.108960][ T3179] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 207.117863][ T3179] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 207.127138][ T3179] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 207.136033][ T3179] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 207.145791][ T3179] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 207.155283][ T3179] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 207.163521][ T3179] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 207.178285][ T8922] team0: Port device team_slave_0 added [ 207.205411][ T2999] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 207.215309][ T2999] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 207.233684][ T8922] team0: Port device team_slave_1 added [ 207.280887][ T8922] device hsr_slave_0 entered promiscuous mode [ 207.329102][ T8922] device hsr_slave_1 entered promiscuous mode [ 207.368704][ T8922] debugfs: Directory 'hsr0' with parent '/' already present! [ 207.378833][ T8910] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 207.388793][ T3179] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 207.397421][ T3179] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 207.406929][ T3179] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 207.415578][ T3179] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 207.429110][ T8914] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 207.438150][ T8914] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 207.453974][ T8915] 8021q: adding VLAN 0 to HW filter on device team0 [ 207.473548][ T8912] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 207.503600][ T8914] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 207.517927][ T8914] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 207.527959][ T8914] bridge0: port 1(bridge_slave_0) entered blocking state [ 207.535661][ T8914] bridge0: port 1(bridge_slave_0) entered forwarding state [ 207.562328][ T8915] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 207.573150][ T8915] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 207.593380][ T2999] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 207.603086][ T2999] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 207.612797][ T2999] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 207.622832][ T2999] bridge0: port 2(bridge_slave_1) entered blocking state [ 207.630752][ T2999] bridge0: port 2(bridge_slave_1) entered forwarding state [ 207.640468][ T2999] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 207.651144][ T2999] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 207.660481][ T2999] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 207.670107][ T2999] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 207.687870][ T2999] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 207.697984][ T2999] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 207.708283][ T2999] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 207.718156][ T2999] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 207.727608][ T2999] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 207.737169][ T2999] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 207.747492][ T2999] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 207.756886][ T2999] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 207.774975][ T8912] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 207.886179][ T8915] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 207.937364][ T8919] 8021q: adding VLAN 0 to HW filter on device bond0 16:29:01 executing program 1: [ 208.002655][ T2999] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 208.023003][ T2999] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 208.041258][ T8922] 8021q: adding VLAN 0 to HW filter on device bond0 [ 208.053866][ T8919] 8021q: adding VLAN 0 to HW filter on device team0 [ 208.095376][ T8922] 8021q: adding VLAN 0 to HW filter on device team0 [ 208.128916][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 208.137254][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 208.159657][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 208.182016][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 208.191625][ T5] bridge0: port 1(bridge_slave_0) entered blocking state [ 208.199032][ T5] bridge0: port 1(bridge_slave_0) entered forwarding state [ 208.207130][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 208.217180][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 208.226488][ T5] bridge0: port 2(bridge_slave_1) entered blocking state [ 208.234254][ T5] bridge0: port 2(bridge_slave_1) entered forwarding state [ 208.243028][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 208.271809][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 208.280711][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 208.289990][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 208.299285][ T5] bridge0: port 1(bridge_slave_0) entered blocking state [ 208.307205][ T5] bridge0: port 1(bridge_slave_0) entered forwarding state [ 208.315664][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 208.325150][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 208.334043][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 208.343688][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 208.352805][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 208.362114][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 208.371275][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 208.380427][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 208.389744][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 208.398987][ T5] bridge0: port 2(bridge_slave_1) entered blocking state [ 208.406689][ T5] bridge0: port 2(bridge_slave_1) entered forwarding state [ 208.416052][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 208.425395][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 208.446088][ T2999] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 208.455845][ T2999] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 208.489521][ T8919] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 208.503414][ T8922] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 208.531469][ T8922] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 208.558681][ T8920] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 208.567775][ T8920] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 208.585211][ T8920] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 208.596155][ T8920] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 208.605081][ T8920] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 208.616028][ T8920] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 208.625680][ T8920] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 208.634998][ T8920] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 208.643905][ T8920] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 208.652782][ T8920] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 208.671225][ T8920] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 208.682680][ T8920] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 208.696491][ T8919] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 208.728018][ T8922] 8021q: adding VLAN 0 to HW filter on device batadv0 16:29:02 executing program 2: clone(0x41bc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = getpid() rt_tgsigqueueinfo(r0, r0, 0x16, &(0x7f00000001c0)) ptrace(0x4206, r0) ptrace$setsig(0x4208, r0, 0x0, 0x0) ptrace$setsig(0x4203, r0, 0x0, 0x0) 16:29:02 executing program 0: 16:29:02 executing program 1: 16:29:02 executing program 5: 16:29:02 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) prlimit64(0x0, 0x7, &(0x7f0000000040), 0x0) sendmmsg$unix(r1, &(0x7f0000008680)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="14000000000000000100000001000000", @ANYRES32=r1], 0x14}], 0x1, 0x0) sendmmsg$unix(r1, &(0x7f00000019c0)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)=[@rights={{0x14, 0x1, 0x1, [r0]}}], 0x18}], 0x1, 0x0) 16:29:02 executing program 4: 16:29:02 executing program 1: 16:29:02 executing program 0: 16:29:02 executing program 4: 16:29:02 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) prlimit64(0x0, 0x7, &(0x7f0000000040), 0x0) sendmmsg$unix(r1, &(0x7f0000008680)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="14000000000000000100000001000000", @ANYRES32=r1], 0x14}], 0x1, 0x0) sendmmsg$unix(r1, &(0x7f00000019c0)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)=[@rights={{0x14, 0x1, 0x1, [r0]}}], 0x18}], 0x1, 0x0) 16:29:02 executing program 1: 16:29:02 executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket(0x15, 0x80005, 0x0) getsockopt(r1, 0x114, 0x2716, 0x0, &(0x7f0000000040)) 16:29:03 executing program 2: clone(0x41bc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = getpid() rt_tgsigqueueinfo(r0, r0, 0x16, &(0x7f00000001c0)) ptrace(0x4206, r0) ptrace$setsig(0x4208, r0, 0x0, 0x0) ptrace$setsig(0x4203, r0, 0x0, 0x0) 16:29:03 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f00000000c0)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/sockstat6\x00') preadv(r1, &(0x7f00000017c0), 0x333, 0x0) 16:29:03 executing program 1: 16:29:03 executing program 4: 16:29:03 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) prlimit64(0x0, 0x7, &(0x7f0000000040), 0x0) sendmmsg$unix(r1, &(0x7f0000008680)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="14000000000000000100000001000000", @ANYRES32=r1], 0x14}], 0x1, 0x0) sendmmsg$unix(r1, &(0x7f00000019c0)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)=[@rights={{0x14, 0x1, 0x1, [r0]}}], 0x18}], 0x1, 0x0) 16:29:03 executing program 0: 16:29:03 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) prlimit64(0x0, 0x7, &(0x7f0000000040), 0x0) sendmmsg$unix(r1, &(0x7f00000019c0)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)=[@rights={{0x14, 0x1, 0x1, [r0]}}], 0x18}], 0x1, 0x0) 16:29:03 executing program 4: 16:29:03 executing program 1: 16:29:03 executing program 0: unshare(0x400) r0 = openat$capi20(0xffffffffffffff9c, &(0x7f0000000000)='/dev/capi20\x00', 0x0, 0x0) ioctl$FS_IOC_GETFSLABEL(r0, 0x80044326, 0x0) 16:29:03 executing program 5: unshare(0x20600) r0 = syz_open_dev$sg(&(0x7f0000001580)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_SET_FORCE_PACK_ID(r0, 0x227b, &(0x7f0000000000)) 16:29:03 executing program 4: r0 = syz_open_dev$sndseq(&(0x7f00000002c0)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r0, 0xc0505350, &(0x7f0000000240)={{0x5}}) 16:29:04 executing program 2: clone(0x41bc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = getpid() rt_tgsigqueueinfo(r0, r0, 0x16, &(0x7f00000001c0)) ptrace(0x4206, r0) ptrace$setsig(0x4208, r0, 0x0, 0x0) ptrace$setsig(0x4203, r0, 0x0, 0x0) 16:29:04 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r1, &(0x7f00000019c0)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)=[@rights={{0x14, 0x1, 0x1, [r0]}}], 0x18}], 0x1, 0x0) 16:29:04 executing program 1: r0 = openat$capi20(0xffffffffffffff9c, &(0x7f0000000000)='/dev/capi20\x00', 0x0, 0x0) ioctl$CAPI_GET_MANUFACTURER(r0, 0xc0044306, &(0x7f00000001c0)=0x8) 16:29:04 executing program 0: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_END_FF_ERASE(r0, 0x405c5503, &(0x7f0000000080)) 16:29:04 executing program 5: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket(0x10, 0x2, 0x0) sendto(r1, &(0x7f0000000140)="120000001200e7ef007b1a3fcd00000000a1", 0x3a, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0x23, &(0x7f0000000380)=[{&(0x7f0000000040)=""/95, 0x3d}, {&(0x7f00000000c0)=""/85, 0x4c8}, {&(0x7f00000024c0)=""/4096, 0x1038}, {&(0x7f0000000400)=""/120, 0x78}, {&(0x7f0000000480)=""/60, 0xc6}, {&(0x7f0000000280)=""/77, 0x4d}, {&(0x7f0000000540)=""/154, 0x9a}, {&(0x7f0000000340)=""/22, 0x1de}], 0x348, &(0x7f0000002400)=""/191, 0x1f9}, 0x60}], 0x4000000000001de, 0x6, &(0x7f0000003700)={0x77359400}) 16:29:04 executing program 4: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0xc06855c8, 0x0) 16:29:04 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r1, &(0x7f00000019c0)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)=[@rights={{0x14, 0x1, 0x1, [r0]}}], 0x18}], 0x1, 0x0) 16:29:04 executing program 4: r0 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/mixer\x00', 0x0, 0x0) ioctl$TUNSETNOCSUM(r0, 0x400454c8, 0xfffffffffffffffe) 16:29:04 executing program 0: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0xc00c55ca, 0x0) 16:29:04 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r0, 0xc008ae88, &(0x7f0000000100)={0x4fe00660d29e6246}) 16:29:04 executing program 5: r0 = getpid() socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r2, &(0x7f000095cfc8)={0x0, 0x0, 0x0}, 0x0) r3 = dup2(r1, r2) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000400), &(0x7f0000000440)=0xc) sendmsg$netlink(r3, &(0x7f0000000700)={0x0, 0x0, 0x0, 0x0, &(0x7f00000005c0)=[@rights={{0x14, 0x1, 0x1, [r3]}}, @cred={{0x1c, 0x1, 0x2, {r0}}}], 0x38}, 0x0) 16:29:04 executing program 0: r0 = syz_open_dev$vbi(&(0x7f00000000c0)='/dev/vbi#\x00', 0x0, 0x2) ioctl$VIDIOC_G_SLICED_VBI_CAP(r0, 0xc0745645, &(0x7f0000000100)={0x0, [], 0xe}) 16:29:05 executing program 2: clone(0x41bc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = getpid() rt_tgsigqueueinfo(r0, r0, 0x16, &(0x7f00000001c0)) ptrace(0x4206, r0) ptrace$setsig(0x4203, r0, 0x0, 0x0) 16:29:05 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r1, &(0x7f00000019c0)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)=[@rights={{0x14, 0x1, 0x1, [r0]}}], 0x18}], 0x1, 0x0) 16:29:05 executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000100)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r0, 0xc00c642d, &(0x7f00000000c0)) 16:29:05 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$gfs2(&(0x7f0000000040)='gfs2\x00', &(0x7f00000000c0)='./file0\x00', 0x27a, 0x0, 0x0, 0x0, 0x0) 16:29:05 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") r1 = socket(0x15, 0x80005, 0x0) getsockopt(r1, 0x114, 0x2711, 0x0, &(0x7f0000000040)) [ 211.703777][ T9113] attempt to access beyond end of device 16:29:05 executing program 3: prlimit64(0x0, 0x7, &(0x7f0000000040), 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000019c0)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}], 0x1, 0x0) 16:29:05 executing program 4: syz_open_dev$binder(&(0x7f0000000280)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) 16:29:05 executing program 0: r0 = socket(0x15, 0x80005, 0x0) getsockopt(r0, 0x114, 0x2711, 0x0, &(0x7f0000000040)) [ 211.750228][ T9113] loop1: rw=4096, want=136, limit=1 [ 211.758789][ T9113] gfs2: error 10 reading superblock [ 211.858127][ T9128] attempt to access beyond end of device [ 211.878735][ T9128] loop1: rw=4096, want=136, limit=1 [ 211.904061][ T9128] gfs2: error 10 reading superblock [ 211.914529][ T9137] debugfs: File '9127' in directory 'proc' already present! 16:29:05 executing program 5: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket(0x10, 0x2, 0x0) sendto(r1, &(0x7f0000000140)="120000001200e7ef007b1a3fcd00000000a1", 0x3a, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0x23, &(0x7f0000000380)=[{&(0x7f0000000040)=""/95, 0x3d}, {&(0x7f00000000c0)=""/85, 0x4c8}, {&(0x7f00000024c0)=""/4096, 0x1038}, {&(0x7f0000000400)=""/120, 0x78}, {&(0x7f0000000480)=""/60, 0xc6}, {&(0x7f0000000280)=""/77, 0x4d}, {&(0x7f0000000540)=""/154, 0x9a}, {&(0x7f0000000340)=""/22, 0x1de}], 0x348, &(0x7f0000002400)=""/191, 0x1f9}, 0xfbc}], 0x4000000000001de, 0x6, &(0x7f0000003700)={0x77359400}) 16:29:05 executing program 3: prlimit64(0x0, 0x7, &(0x7f0000000040), 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000019c0)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}], 0x1, 0x0) 16:29:05 executing program 0: bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000000380)=ANY=[@ANYBLOB="b702000003000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff5d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000000b000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) 16:29:05 executing program 4: bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000000380)=ANY=[@ANYBLOB="b702000003000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff5d640500000000006504040001ffffffb604000001007d60b7030000000000006a0a00fe000000008500000008000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) 16:29:06 executing program 2: clone(0x41bc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = getpid() rt_tgsigqueueinfo(r0, r0, 0x16, &(0x7f00000001c0)) ptrace(0x4206, r0) ptrace$setsig(0x4203, r0, 0x0, 0x0) 16:29:06 executing program 1: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x89f0, &(0x7f0000000080)={'bridge0\x00', &(0x7f0000000000)=@ethtool_ringparam={0x4, 0x0, 0xd}}) 16:29:06 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000100)='/dev/dri/card#\x00', 0x0, 0x0) ioctl(r0, 0x9, 0x0) 16:29:06 executing program 3: prlimit64(0x0, 0x7, &(0x7f0000000040), 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000019c0)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}], 0x1, 0x0) 16:29:06 executing program 0: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000280)=ANY=[@ANYBLOB="02105b092800000028bd7000ffdbdf25070019000000000002004e21ffffffff00000000000000000a004e2100000fff0000000000000000000000000000000002000000000000000200e36d030000001f00000000000000010014000100000005000600332000000a004e23000007affe8000000000000000000000000000aa070000000000000017000900500500002c8acff771a12934700543b417556893882c7528f9d3bb35ebd0d18420612f6ff51bfa184cb1525e1df8adfbd5fa0df94062c16f294f1c2c15a4945dae67fc87ab73165bc29a89b0e11571fd6f64fa38c02af4bda82745c47ab7766f75171971be5ede83799aa38634a5d5149ab73e3afc5e712f85670de4bfa3080bd81cc63dce6f5c6e92c5a165c081867ee240b44986079e2e5f58eb90739158aeee77bf7c61cd324dd09fdfc0b9a0000000000000"], 0x140}}, 0x0) 16:29:06 executing program 4: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x0, 0x0) ioctl$RTC_SET_TIME(r0, 0x4024700a, &(0x7f0000000040)={0x0, 0x0, 0x25, 0x11, 0x0, 0xff}) 16:29:06 executing program 3: socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) prlimit64(0x0, 0x7, &(0x7f0000000040), 0x0) sendmmsg$unix(r1, &(0x7f00000019c0)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)=[@rights={{0x14, 0x1, 0x1, [r0]}}], 0x18}], 0x1, 0x0) 16:29:06 executing program 1: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x89f0, &(0x7f0000000080)={'bridge0\x00', &(0x7f0000000000)=@ethtool_ringparam={0x4, 0x0, 0xd}}) 16:29:06 executing program 4: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vfio/vfio\x00', 0x1, 0x0) pwritev(r0, &(0x7f0000000440)=[{&(0x7f0000000080)='\n', 0x1}], 0x1, 0x0) 16:29:06 executing program 5: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x0, 0x0) ioctl$RTC_SET_TIME(r0, 0x40247007, &(0x7f0000000040)={0x0, 0x0, 0x25}) 16:29:06 executing program 0: bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000000380)=ANY=[@ANYBLOB="b702000003000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d640500000000001504040001ffffffb604000001007d60b7030000000000006a0a00fe000000008500000008000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) 16:29:06 executing program 1: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x89f0, &(0x7f0000000080)={'bridge0\x00', &(0x7f0000000000)=@ethtool_ringparam={0x4, 0x0, 0xd}}) 16:29:06 executing program 2: clone(0x41bc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = getpid() rt_tgsigqueueinfo(r0, r0, 0x16, &(0x7f00000001c0)) ptrace(0x4206, r0) ptrace$setsig(0x4203, r0, 0x0, 0x0) 16:29:06 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f0000000040)='net/arp\x00') lseek(r0, 0x0, 0x3) 16:29:06 executing program 4: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000001fd8)=ANY=[@ANYBLOB="850000006b00000016000000000009239500000000000000"], &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x48) 16:29:06 executing program 3: socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) prlimit64(0x0, 0x7, &(0x7f0000000040), 0x0) sendmmsg$unix(r1, &(0x7f00000019c0)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)=[@rights={{0x14, 0x1, 0x1, [r0]}}], 0x18}], 0x1, 0x0) 16:29:06 executing program 0: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000001fd8)=ANY=[@ANYBLOB="850000004200000016000000000009239500000000000000"], &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000)={0x4c5047}}, 0x48) 16:29:06 executing program 1: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x89f0, &(0x7f0000000080)={'bridge0\x00', &(0x7f0000000000)=@ethtool_ringparam={0x4, 0x0, 0xd}}) 16:29:07 executing program 4: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=ANY=[@ANYBLOB="850000000500000016000000000009239500000000000000"], &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000)={0x4c5047}}, 0x48) 16:29:07 executing program 3: socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) prlimit64(0x0, 0x7, &(0x7f0000000040), 0x0) sendmmsg$unix(r1, &(0x7f00000019c0)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)=[@rights={{0x14, 0x1, 0x1, [r0]}}], 0x18}], 0x1, 0x0) 16:29:07 executing program 0: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000001fd8)=ANY=[@ANYBLOB="850000004f00000016000000000009239500000000000000"], &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000)={0x4c5047}}, 0x48) 16:29:07 executing program 1: ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x89f0, &(0x7f0000000080)={'bridge0\x00', &(0x7f0000000000)=@ethtool_ringparam={0x4, 0x0, 0xd}}) 16:29:07 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f0000000040)='net/arp\x00') lseek(r0, 0x0, 0x3) 16:29:07 executing program 3: socketpair$unix(0x1, 0x5, 0x0, 0x0) prlimit64(0x0, 0x7, &(0x7f0000000040), 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000019c0)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}], 0x1, 0x0) 16:29:07 executing program 2: clone(0x41bc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = getpid() rt_tgsigqueueinfo(r0, r0, 0x16, &(0x7f00000001c0)) ptrace$setsig(0x4208, r0, 0x0, 0x0) ptrace$setsig(0x4203, r0, 0x0, 0x0) 16:29:07 executing program 1: ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x89f0, &(0x7f0000000080)={'bridge0\x00', &(0x7f0000000000)=@ethtool_ringparam={0x4, 0x0, 0xd}}) 16:29:07 executing program 4: r0 = socket$inet(0x10, 0x3, 0xc) sendmsg(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000000)="2400000002031f001cfffd946fa2830020200a000900010001e700000000a3a20404ff7e", 0x24}], 0x1}, 0x0) sendmsg(r0, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000180)="24000000030307031dfffd946ff20c0020200a0009000100021d85680c1baba20400ff7e", 0x24}], 0x1}, 0x0) 16:29:07 executing program 0: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0xf, 0x3, &(0x7f0000001fd8)=ANY=[@ANYBLOB="850000005700000016000000000009239500000000000000"], &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x48) 16:29:07 executing program 5: r0 = socket$isdn(0x22, 0x2, 0x2) close(r0) 16:29:07 executing program 3: socketpair$unix(0x1, 0x5, 0x0, 0x0) prlimit64(0x0, 0x7, &(0x7f0000000040), 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000019c0)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}], 0x1, 0x0) 16:29:07 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x40045568, 0x0) [ 214.269211][ T9237] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. 16:29:07 executing program 1: ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x89f0, &(0x7f0000000080)={'bridge0\x00', &(0x7f0000000000)=@ethtool_ringparam={0x4, 0x0, 0xd}}) 16:29:07 executing program 3: socketpair$unix(0x1, 0x5, 0x0, 0x0) prlimit64(0x0, 0x7, &(0x7f0000000040), 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000019c0)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}], 0x1, 0x0) 16:29:07 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") r1 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x1, 0xfeffff, &(0x7f0000000040)='t'}) ioctl$VHOST_SET_LOG_BASE(0xffffffffffffffff, 0x4008af04, &(0x7f00000001c0)=&(0x7f0000000180)) [ 214.371153][ T9237] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. 16:29:08 executing program 4: r0 = socket$inet(0x10, 0x3, 0xc) sendmsg(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000000)="2400000002031f001cfffd946fa2830020200a000900010001e700000000a3a20404ff7e", 0x24}], 0x1}, 0x0) sendmsg(r0, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000180)="24000000030307031dfffd946ff20c0020200a0009000100021d85680c1baba20400ff7e", 0x24}], 0x1}, 0x0) 16:29:08 executing program 5: unshare(0x20600) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff}, 0x0) fchown(r0, 0x0, 0x0) [ 214.487335][ T9263] binder: 9261:9263 unknown command 0 [ 214.497854][ T9263] binder: 9261:9263 ioctl c0306201 20000440 returned -22 [ 214.537974][ T9264] binder: 9261:9264 unknown command 0 [ 214.580157][ T9264] binder: 9261:9264 ioctl c0306201 20000440 returned -22 [ 214.620230][ T9270] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. 16:29:08 executing program 2: clone(0x41bc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = getpid() rt_tgsigqueueinfo(r0, r0, 0x16, &(0x7f00000001c0)) ptrace$setsig(0x4208, r0, 0x0, 0x0) ptrace$setsig(0x4203, r0, 0x0, 0x0) 16:29:08 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) prlimit64(0x0, 0x0, &(0x7f0000000040), 0x0) sendmmsg$unix(r1, &(0x7f00000019c0)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)=[@rights={{0x14, 0x1, 0x1, [r0]}}], 0x18}], 0x1, 0x0) 16:29:08 executing program 1: r0 = socket$inet6(0xa, 0x0, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x89f0, &(0x7f0000000080)={'bridge0\x00', &(0x7f0000000000)=@ethtool_ringparam={0x4, 0x0, 0xd}}) 16:29:08 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") r1 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x1, 0xfeffff, &(0x7f0000000040)='t'}) ioctl$VHOST_SET_LOG_BASE(0xffffffffffffffff, 0x4008af04, &(0x7f00000001c0)=&(0x7f0000000180)) 16:29:08 executing program 5: bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000000380)=ANY=[@ANYBLOB="b702000003000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff5d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe000000008500000014000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) 16:29:08 executing program 4: r0 = socket$inet(0x10, 0x3, 0xc) sendmsg(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000000)="2400000002031f001cfffd946fa2830020200a000900010001e700000000a3a20404ff7e", 0x24}], 0x1}, 0x0) sendmsg(r0, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000180)="24000000030307031dfffd946ff20c0020200a0009000100021d85680c1baba20400ff7e", 0x24}], 0x1}, 0x0) [ 215.162584][ T9286] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. 16:29:08 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) prlimit64(0x0, 0x0, &(0x7f0000000040), 0x0) sendmmsg$unix(r1, &(0x7f00000019c0)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)=[@rights={{0x14, 0x1, 0x1, [r0]}}], 0x18}], 0x1, 0x0) 16:29:08 executing program 5: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000001fd8)=ANY=[@ANYBLOB="850000000700000016000000000009239500000000000000"], &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000)={0x4c5047}}, 0x48) [ 215.204052][ T9283] binder: 9282:9283 unknown command 0 [ 215.225542][ T9283] binder: 9282:9283 ioctl c0306201 20000440 returned -22 16:29:08 executing program 4: r0 = socket$inet(0x10, 0x3, 0xc) sendmsg(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000000)="2400000002031f001cfffd946fa2830020200a000900010001e700000000a3a20404ff7e", 0x24}], 0x1}, 0x0) sendmsg(r0, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000180)="24000000030307031dfffd946ff20c0020200a0009000100021d85680c1baba20400ff7e", 0x24}], 0x1}, 0x0) 16:29:08 executing program 1: r0 = socket$inet6(0xa, 0x0, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x89f0, &(0x7f0000000080)={'bridge0\x00', &(0x7f0000000000)=@ethtool_ringparam={0x4, 0x0, 0xd}}) 16:29:08 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") r1 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x1, 0xfeffff, &(0x7f0000000040)='t'}) ioctl$VHOST_SET_LOG_BASE(0xffffffffffffffff, 0x4008af04, &(0x7f00000001c0)=&(0x7f0000000180)) 16:29:09 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) prlimit64(0x0, 0x0, &(0x7f0000000040), 0x0) sendmmsg$unix(r1, &(0x7f00000019c0)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)=[@rights={{0x14, 0x1, 0x1, [r0]}}], 0x18}], 0x1, 0x0) [ 215.413245][ T9305] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. [ 215.531774][ T9315] binder: 9311:9315 unknown command 0 [ 215.584335][ T9315] binder: 9311:9315 ioctl c0306201 20000440 returned -22 16:29:09 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) prlimit64(0x0, 0x7, 0x0, 0x0) sendmmsg$unix(r1, &(0x7f00000019c0)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)=[@rights={{0x14, 0x1, 0x1, [r0]}}], 0x18}], 0x1, 0x0) 16:29:09 executing program 4: r0 = socket$inet(0x10, 0x3, 0xc) sendmsg(r0, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000180)="24000000030307031dfffd946ff20c0020200a0009000100021d85680c1baba20400ff7e", 0x24}], 0x1}, 0x0) 16:29:09 executing program 2: clone(0x41bc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = getpid() rt_tgsigqueueinfo(r0, r0, 0x16, &(0x7f00000001c0)) ptrace$setsig(0x4208, r0, 0x0, 0x0) ptrace$setsig(0x4203, r0, 0x0, 0x0) 16:29:09 executing program 1: r0 = socket$inet6(0xa, 0x0, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x89f0, &(0x7f0000000080)={'bridge0\x00', &(0x7f0000000000)=@ethtool_ringparam={0x4, 0x0, 0xd}}) 16:29:09 executing program 5: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000001fd8)=ANY=[@ANYBLOB="850000000700000016000000000009239500000000000000"], &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000)={0x4c5047}}, 0x48) 16:29:09 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") r1 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x1, 0xfeffff, &(0x7f0000000040)='t'}) ioctl$VHOST_SET_LOG_BASE(0xffffffffffffffff, 0x4008af04, &(0x7f00000001c0)=&(0x7f0000000180)) 16:29:09 executing program 4: r0 = socket$inet(0x10, 0x3, 0xc) sendmsg(r0, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000180)="24000000030307031dfffd946ff20c0020200a0009000100021d85680c1baba20400ff7e", 0x24}], 0x1}, 0x0) [ 216.091794][ T9330] binder: 9327:9330 unknown command 0 16:29:09 executing program 5: r0 = socket(0x15, 0x80005, 0x0) getsockopt(r0, 0x114, 0x271c, 0x0, &(0x7f0000000040)) [ 216.134460][ T9330] binder: 9327:9330 ioctl c0306201 20000440 returned -22 16:29:09 executing program 1: socket$inet6(0xa, 0x1000000000002, 0x0) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x89f0, &(0x7f0000000080)={'bridge0\x00', &(0x7f0000000000)=@ethtool_ringparam={0x4, 0x0, 0xd}}) 16:29:09 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) prlimit64(0x0, 0x7, 0x0, 0x0) sendmmsg$unix(r1, &(0x7f00000019c0)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)=[@rights={{0x14, 0x1, 0x1, [r0]}}], 0x18}], 0x1, 0x0) 16:29:09 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") r1 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x1, 0xfeffff, &(0x7f0000000040)='t'}) 16:29:09 executing program 4: r0 = socket$inet(0x10, 0x3, 0xc) sendmsg(r0, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000180)="24000000030307031dfffd946ff20c0020200a0009000100021d85680c1baba20400ff7e", 0x24}], 0x1}, 0x0) 16:29:09 executing program 5: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000000380)=ANY=[@ANYBLOB="b702000003000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe000000008500000011000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) 16:29:09 executing program 1: socket$inet6(0xa, 0x1000000000002, 0x0) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x89f0, &(0x7f0000000080)={'bridge0\x00', &(0x7f0000000000)=@ethtool_ringparam={0x4, 0x0, 0xd}}) [ 216.350083][ T9355] binder: 9354:9355 unknown command 0 [ 216.374142][ T9355] binder: 9354:9355 ioctl c0306201 20000440 returned -22 16:29:10 executing program 2: clone(0x41bc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = getpid() ptrace(0x4206, r0) ptrace$setsig(0x4208, r0, 0x0, 0x0) ptrace$setsig(0x4203, r0, 0x0, 0x0) 16:29:10 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") r1 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x1, 0xfeffff, &(0x7f0000000040)='t'}) 16:29:10 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) prlimit64(0x0, 0x7, 0x0, 0x0) sendmmsg$unix(r1, &(0x7f00000019c0)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)=[@rights={{0x14, 0x1, 0x1, [r0]}}], 0x18}], 0x1, 0x0) 16:29:10 executing program 5: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket(0x15, 0x80005, 0x0) getsockopt(r1, 0x114, 0x2715, 0x0, &(0x7f0000000040)) 16:29:10 executing program 4: sendmsg(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000000)="2400000002031f001cfffd946fa2830020200a000900010001e700000000a3a20404ff7e", 0x24}], 0x1}, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000180)="24000000030307031dfffd946ff20c0020200a0009000100021d85680c1baba20400ff7e", 0x24}], 0x1}, 0x0) 16:29:10 executing program 1: socket$inet6(0xa, 0x1000000000002, 0x0) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x89f0, &(0x7f0000000080)={'bridge0\x00', &(0x7f0000000000)=@ethtool_ringparam={0x4, 0x0, 0xd}}) 16:29:10 executing program 2: clone(0x41bc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = getpid() ptrace(0x4206, r0) ptrace$setsig(0x4208, r0, 0x0, 0x0) ptrace$setsig(0x4203, r0, 0x0, 0x0) 16:29:10 executing program 4: sendmsg(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000000)="2400000002031f001cfffd946fa2830020200a000900010001e700000000a3a20404ff7e", 0x24}], 0x1}, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000180)="24000000030307031dfffd946ff20c0020200a0009000100021d85680c1baba20400ff7e", 0x24}], 0x1}, 0x0) 16:29:10 executing program 5: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket(0x15, 0x80005, 0x0) getsockopt(r1, 0x114, 0x2715, 0x0, &(0x7f0000000040)) 16:29:10 executing program 1: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x89f0, 0x0) 16:29:10 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) prlimit64(0x0, 0x7, &(0x7f0000000040), 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000019c0)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)=[@rights={{0x14, 0x1, 0x1, [r0]}}], 0x18}], 0x1, 0x0) 16:29:10 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") r1 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x1, 0xfeffff, &(0x7f0000000040)='t'}) 16:29:10 executing program 2: clone(0x41bc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = getpid() ptrace(0x4206, r0) ptrace$setsig(0x4208, r0, 0x0, 0x0) ptrace$setsig(0x4203, r0, 0x0, 0x0) 16:29:10 executing program 2: clone(0x41bc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) rt_tgsigqueueinfo(0x0, 0x0, 0x16, &(0x7f00000001c0)) ptrace(0x4206, 0x0) ptrace$setsig(0x4208, 0x0, 0x0, 0x0) ptrace$setsig(0x4203, 0x0, 0x0, 0x0) 16:29:10 executing program 4: sendmsg(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000000)="2400000002031f001cfffd946fa2830020200a000900010001e700000000a3a20404ff7e", 0x24}], 0x1}, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000180)="24000000030307031dfffd946ff20c0020200a0009000100021d85680c1baba20400ff7e", 0x24}], 0x1}, 0x0) 16:29:10 executing program 5: bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000000380)=ANY=[@ANYBLOB="b702000003000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff5d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe000000008500000019000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) 16:29:10 executing program 1: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x89f0, 0x0) 16:29:10 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") r1 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x1, 0xfeffff, &(0x7f0000000040)='t'}) 16:29:10 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) prlimit64(0x0, 0x7, &(0x7f0000000040), 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000019c0)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)=[@rights={{0x14, 0x1, 0x1, [r0]}}], 0x18}], 0x1, 0x0) 16:29:11 executing program 2: clone(0x41bc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) rt_tgsigqueueinfo(0x0, 0x0, 0x16, &(0x7f00000001c0)) ptrace(0x4206, 0x0) ptrace$setsig(0x4208, 0x0, 0x0, 0x0) ptrace$setsig(0x4203, 0x0, 0x0, 0x0) 16:29:11 executing program 4: r0 = socket$inet(0x10, 0x0, 0xc) sendmsg(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000000)="2400000002031f001cfffd946fa2830020200a000900010001e700000000a3a20404ff7e", 0x24}], 0x1}, 0x0) sendmsg(r0, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000180)="24000000030307031dfffd946ff20c0020200a0009000100021d85680c1baba20400ff7e", 0x24}], 0x1}, 0x0) 16:29:11 executing program 5: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=ANY=[@ANYBLOB="850000000e00000016000000000009239500000000000000"], &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000)={0x4c5047}}, 0x48) 16:29:11 executing program 1: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x89f0, 0x0) 16:29:11 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) prlimit64(0x0, 0x7, &(0x7f0000000040), 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000019c0)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)=[@rights={{0x14, 0x1, 0x1, [r0]}}], 0x18}], 0x1, 0x0) 16:29:11 executing program 2: clone(0x41bc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) rt_tgsigqueueinfo(0x0, 0x0, 0x16, &(0x7f00000001c0)) ptrace(0x4206, 0x0) ptrace$setsig(0x4208, 0x0, 0x0, 0x0) ptrace$setsig(0x4203, 0x0, 0x0, 0x0) 16:29:11 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000100)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x1, 0xfeffff, &(0x7f0000000040)='t'}) 16:29:11 executing program 5: unshare(0x20600) r0 = syz_open_dev$sg(&(0x7f0000001580)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2271, 0x0) 16:29:11 executing program 1: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x89f0, &(0x7f0000000080)={'bridge0\x00', 0x0}) 16:29:11 executing program 4: r0 = socket$inet(0x10, 0x0, 0xc) sendmsg(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000000)="2400000002031f001cfffd946fa2830020200a000900010001e700000000a3a20404ff7e", 0x24}], 0x1}, 0x0) sendmsg(r0, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000180)="24000000030307031dfffd946ff20c0020200a0009000100021d85680c1baba20400ff7e", 0x24}], 0x1}, 0x0) 16:29:11 executing program 2: r0 = getpid() rt_tgsigqueueinfo(r0, r0, 0x16, &(0x7f00000001c0)) ptrace(0x4206, r0) ptrace$setsig(0x4208, r0, 0x0, 0x0) ptrace$setsig(0x4203, r0, 0x0, 0x0) 16:29:11 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) prlimit64(0x0, 0x7, &(0x7f0000000040), 0x0) sendmmsg$unix(r0, 0x0, 0x0, 0x0) 16:29:11 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000100)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x1, 0xfeffff, &(0x7f0000000040)='t'}) 16:29:11 executing program 5: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000001fd8)=ANY=[@ANYBLOB="850000005600000016000000000009239500000000000000"], &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000)={0x4c5047}}, 0x48) 16:29:11 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) prlimit64(0x0, 0x7, &(0x7f0000000040), 0x0) sendmmsg$unix(r0, 0x0, 0x0, 0x0) 16:29:11 executing program 4: r0 = socket$inet(0x10, 0x0, 0xc) sendmsg(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000000)="2400000002031f001cfffd946fa2830020200a000900010001e700000000a3a20404ff7e", 0x24}], 0x1}, 0x0) sendmsg(r0, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000180)="24000000030307031dfffd946ff20c0020200a0009000100021d85680c1baba20400ff7e", 0x24}], 0x1}, 0x0) 16:29:11 executing program 1: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x89f0, &(0x7f0000000080)={'bridge0\x00', 0x0}) 16:29:11 executing program 2: r0 = getpid() rt_tgsigqueueinfo(r0, r0, 0x16, &(0x7f00000001c0)) ptrace(0x4206, r0) ptrace$setsig(0x4208, r0, 0x0, 0x0) ptrace$setsig(0x4203, r0, 0x0, 0x0) 16:29:11 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000100)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x1, 0xfeffff, &(0x7f0000000040)='t'}) 16:29:11 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) prlimit64(0x0, 0x7, &(0x7f0000000040), 0x0) sendmmsg$unix(r0, 0x0, 0x0, 0x0) 16:29:11 executing program 0: socket$inet_udplite(0x2, 0x2, 0x88) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x1, 0xfeffff, &(0x7f0000000040)='t'}) 16:29:11 executing program 1: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x89f0, &(0x7f0000000080)={'bridge0\x00', 0x0}) 16:29:11 executing program 2: r0 = getpid() rt_tgsigqueueinfo(r0, r0, 0x16, &(0x7f00000001c0)) ptrace(0x4206, r0) ptrace$setsig(0x4208, r0, 0x0, 0x0) ptrace$setsig(0x4203, r0, 0x0, 0x0) 16:29:11 executing program 5: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=ANY=[@ANYBLOB="850000004300000016000000000009239500000000000000"], &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000)={0x4c5047}}, 0x48) 16:29:11 executing program 4: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000000)="2400000002031f001cfffd946fa2830020200a000900010001e700000000a3a20404ff7e", 0x24}], 0x1}, 0x0) sendmsg(r0, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000180)="24000000030307031dfffd946ff20c0020200a0009000100021d85680c1baba20400ff7e", 0x24}], 0x1}, 0x0) [ 218.425433][ T9496] binder: 9492:9496 unknown command 0 16:29:12 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) prlimit64(0x0, 0x7, &(0x7f0000000040), 0x0) sendmmsg$unix(r0, &(0x7f00000019c0), 0x0, 0x0) 16:29:12 executing program 1: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x89f0, &(0x7f0000000080)={'bridge0\x00', &(0x7f0000000000)=@ethtool_ringparam={0x0, 0x0, 0xd}}) [ 218.479018][ T9496] binder: 9492:9496 ioctl c0306201 20000440 returned -22 16:29:12 executing program 2: clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = getpid() rt_tgsigqueueinfo(r0, r0, 0x16, &(0x7f00000001c0)) ptrace(0x4206, r0) ptrace$setsig(0x4208, r0, 0x0, 0x0) ptrace$setsig(0x4203, r0, 0x0, 0x0) 16:29:12 executing program 4: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000000)="2400000002031f001cfffd946fa2830020200a000900010001e700000000a3a20404ff7e", 0x24}], 0x1}, 0x0) sendmsg(r0, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000180)="24000000030307031dfffd946ff20c0020200a0009000100021d85680c1baba20400ff7e", 0x24}], 0x1}, 0x0) 16:29:12 executing program 5: syz_emit_ethernet(0x2a, &(0x7f0000000300)={@broadcast, @local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0xf401, 0x0, @remote={0xac, 0x1c}, @local}, @igmp={0x0, 0x0, 0x0, @broadcast}}}}}, 0x0) 16:29:12 executing program 0: socket$inet_udplite(0x2, 0x2, 0x88) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x1, 0xfeffff, &(0x7f0000000040)='t'}) [ 218.745922][ T9524] binder: 9522:9524 unknown command 0 16:29:12 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) prlimit64(0x0, 0x7, &(0x7f0000000040), 0x0) sendmmsg$unix(r0, &(0x7f00000019c0), 0x0, 0x0) 16:29:12 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x89f1, &(0x7f0000000040)={'ip_vti0\x00', &(0x7f0000000000)=@ethtool_ringparam}) 16:29:12 executing program 4: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000000)="2400000002031f001cfffd946fa2830020200a000900010001e700000000a3a20404ff7e", 0x24}], 0x1}, 0x0) sendmsg(r0, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000180)="24000000030307031dfffd946ff20c0020200a0009000100021d85680c1baba20400ff7e", 0x24}], 0x1}, 0x0) 16:29:12 executing program 1: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x89f0, &(0x7f0000000080)={'bridge0\x00', &(0x7f0000000000)=@ethtool_ringparam={0x0, 0x0, 0xd}}) [ 218.776716][ T9524] binder: 9522:9524 ioctl c0306201 20000440 returned -22 16:29:12 executing program 2: clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = getpid() rt_tgsigqueueinfo(r0, r0, 0x16, &(0x7f00000001c0)) ptrace(0x4206, r0) ptrace$setsig(0x4208, r0, 0x0, 0x0) ptrace$setsig(0x4203, r0, 0x0, 0x0) 16:29:12 executing program 0: socket$inet_udplite(0x2, 0x2, 0x88) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x1, 0xfeffff, &(0x7f0000000040)='t'}) 16:29:12 executing program 5: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=ANY=[@ANYBLOB="85000000050000001600ffff800009239500000000000000"], &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000)={0x4c5047}}, 0x48) 16:29:12 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) prlimit64(0x0, 0x7, &(0x7f0000000040), 0x0) sendmmsg$unix(r0, &(0x7f00000019c0), 0x0, 0x0) 16:29:12 executing program 4: r0 = socket$inet(0x10, 0x3, 0xc) sendmsg(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000000)="2400000002031f001cfffd946fa2830020200a000900010001e700000000a3a20404ff7e", 0x24}], 0x1}, 0x0) sendmsg(r0, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000180)="24000000030307031dfffd946ff20c0020200a0009000100021d85680c1baba20400ff7e", 0x24}], 0x1}, 0x0) 16:29:12 executing program 1: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x89f0, &(0x7f0000000080)={'bridge0\x00', &(0x7f0000000000)=@ethtool_ringparam={0x0, 0x0, 0xd}}) 16:29:12 executing program 5: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000001fd8)=ANY=[@ANYBLOB="850000005800000016000000000009239500000000000000"], &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000)={0x4c5047}}, 0x48) [ 219.130811][ T9550] binder: 9544:9550 unknown command 0 [ 219.160071][ T9550] binder: 9544:9550 ioctl c0306201 20000440 returned -22 16:29:12 executing program 2: clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = getpid() rt_tgsigqueueinfo(r0, r0, 0x16, &(0x7f00000001c0)) ptrace(0x4206, r0) ptrace$setsig(0x4208, r0, 0x0, 0x0) ptrace$setsig(0x4203, r0, 0x0, 0x0) 16:29:12 executing program 4: r0 = socket$inet(0x10, 0x3, 0xc) sendmsg(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000000)="2400000002031f001cfffd946fa2830020200a000900010001e700000000a3a20404ff7e", 0x24}], 0x1}, 0x0) sendmsg(r0, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000180)="24000000030307031dfffd946ff20c0020200a0009000100021d85680c1baba20400ff7e", 0x24}], 0x1}, 0x0) 16:29:12 executing program 5: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket(0x10, 0x2, 0x0) sendto(r1, &(0x7f0000000140)="120000001200e7ef007b1a3fcd00000000a1", 0x3a, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xc, &(0x7f0000000380)=[{&(0x7f0000000040)=""/95, 0x3d}, {&(0x7f00000000c0)=""/85, 0x4c8}, {&(0x7f00000024c0)=""/4096, 0x1038}, {&(0x7f0000000400)=""/120, 0x78}, {&(0x7f0000000480)=""/60, 0xc6}, {&(0x7f0000000280)=""/77, 0x4d}, {&(0x7f0000000540)=""/154, 0x9a}, {&(0x7f0000000340)=""/22, 0x1de}], 0x348, &(0x7f0000002400)=""/191, 0x1f9}, 0xfbc}], 0x4000000000001de, 0x6, &(0x7f0000003700)={0x77359400}) 16:29:12 executing program 0: ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x1, 0xfeffff, &(0x7f0000000040)='t'}) 16:29:12 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) prlimit64(0x0, 0x7, &(0x7f0000000040), 0x0) sendmmsg$unix(r0, &(0x7f00000019c0)=[{0x0, 0x0, 0x0}], 0x1, 0x0) 16:29:12 executing program 1: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x89f0, &(0x7f0000000080)={'bridge0\x00', &(0x7f0000000000)=@ethtool_ringparam={0x4}}) 16:29:13 executing program 4: r0 = socket$inet(0x10, 0x3, 0xc) sendmsg(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000000)="2400000002031f001cfffd946fa2830020200a000900010001e700000000a3a20404ff7e", 0x24}], 0x1}, 0x0) sendmsg(r0, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000180)="24000000030307031dfffd946ff20c0020200a0009000100021d85680c1baba20400ff7e", 0x24}], 0x1}, 0x0) [ 219.452268][ T9577] binder: 9575:9577 unknown command 0 16:29:13 executing program 2: clone(0x41bc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f00000001c0)) ptrace(0x4206, r0) ptrace$setsig(0x4208, r0, 0x0, 0x0) ptrace$setsig(0x4203, r0, 0x0, 0x0) 16:29:13 executing program 1: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x89f0, &(0x7f0000000080)={'bridge0\x00', &(0x7f0000000000)=@ethtool_ringparam={0x4}}) [ 219.564035][ T9577] binder: 9575:9577 ioctl c0306201 20000440 returned -22 16:29:13 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) prlimit64(0x0, 0x7, &(0x7f0000000040), 0x0) sendmmsg$unix(r0, &(0x7f00000019c0)=[{0x0, 0x0, 0x0}], 0x1, 0x0) 16:29:13 executing program 5: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1fb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) write$cgroup_subtree(0xffffffffffffffff, 0x0, 0x0) r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='/group.stat\x00<#\xfbW*\x1f\x02\x94\xe6\xf3x\xb4\x1a\xd5KM\x9d\x9a\x1fc\xf8xZ\xd1\x88\xa7\xe1\xc8\x88u\xe0[\x18\xa4\xcb:\x9c\xd1-\xce\xa4@\xd8\x99\xc2,e+:G\x1bJ\x7f\xa2\xf3\xfd\xf6\xe04\xd8\x04\xe5\xf0\xdfK\x1d\xeeH;\x15v$\xc5\x9c\x01\x00\xe8\x9ej5|\x00\x00\x00', 0x2761, 0x0) write$cgroup_int(r0, &(0x7f0000000080), 0x297ef) write$cgroup_int(0xffffffffffffffff, 0x0, 0x0) 16:29:13 executing program 2: clone(0x41bc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f00000001c0)) ptrace(0x4206, r0) ptrace$setsig(0x4208, r0, 0x0, 0x0) ptrace$setsig(0x4203, r0, 0x0, 0x0) 16:29:13 executing program 0: ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x1, 0xfeffff, &(0x7f0000000040)='t'}) 16:29:13 executing program 4: r0 = socket$inet(0x10, 0x3, 0xc) sendmsg(r0, 0x0, 0x0) sendmsg(r0, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000180)="24000000030307031dfffd946ff20c0020200a0009000100021d85680c1baba20400ff7e", 0x24}], 0x1}, 0x0) 16:29:13 executing program 1: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x89f0, &(0x7f0000000080)={'bridge0\x00', &(0x7f0000000000)=@ethtool_ringparam={0x4}}) 16:29:13 executing program 2: clone(0x41bc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x16, &(0x7f00000001c0)) ptrace(0x4206, r0) ptrace$setsig(0x4208, r0, 0x0, 0x0) ptrace$setsig(0x4203, r0, 0x0, 0x0) 16:29:13 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) prlimit64(0x0, 0x7, &(0x7f0000000040), 0x0) sendmmsg$unix(r0, &(0x7f00000019c0)=[{0x0, 0x0, 0x0}], 0x1, 0x0) [ 219.854038][ T9608] binder: 9607:9608 unknown command 0 [ 219.912914][ T9608] binder: 9607:9608 ioctl c0306201 20000440 returned -22 16:29:13 executing program 4: r0 = socket$inet(0x10, 0x3, 0xc) sendmsg(r0, 0x0, 0x0) sendmsg(r0, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000180)="24000000030307031dfffd946ff20c0020200a0009000100021d85680c1baba20400ff7e", 0x24}], 0x1}, 0x0) 16:29:13 executing program 2: clone(0x41bc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = getpid() rt_tgsigqueueinfo(r0, 0x0, 0x16, &(0x7f00000001c0)) ptrace(0x4206, r0) ptrace$setsig(0x4208, r0, 0x0, 0x0) ptrace$setsig(0x4203, r0, 0x0, 0x0) 16:29:13 executing program 0: ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x1, 0xfeffff, &(0x7f0000000040)='t'}) 16:29:13 executing program 5: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1fb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) write$cgroup_subtree(0xffffffffffffffff, 0x0, 0x0) r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='/group.stat\x00<#\xfbW*\x1f\x02\x94\xe6\xf3x\xb4\x1a\xd5KM\x9d\x9a\x1fc\xf8xZ\xd1\x88\xa7\xe1\xc8\x88u\xe0[\x18\xa4\xcb:\x9c\xd1-\xce\xa4@\xd8\x99\xc2,e+:G\x1bJ\x7f\xa2\xf3\xfd\xf6\xe04\xd8\x04\xe5\xf0\xdfK\x1d\xeeH;\x15v$\xc5\x9c\x01\x00\xe8\x9ej5|\x00\x00\x00', 0x2761, 0x0) write$cgroup_int(r0, &(0x7f0000000080), 0x297ef) write$cgroup_int(0xffffffffffffffff, 0x0, 0x0) 16:29:13 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) prlimit64(0x0, 0x7, &(0x7f0000000040), 0x0) sendmmsg$unix(r0, &(0x7f00000019c0)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)}], 0x1, 0x0) 16:29:13 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="11dca50d5e0bcfe47bf070") syz_open_dev$vbi(&(0x7f0000000040)='/dev/vbi#\x00', 0x1, 0x2) sendmsg$can_bcm(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000002c0)={0x4, 0x90acc3593092a16d, 0x0, {}, {}, {}, 0x1, @canfd={{}, 0x0, 0x0, 0x0, 0x0, "3147b44dec654bf18d54e59eb9777c0681f2547a109809fe7d899cb6620eb0746fcd2bb798163d4df02709c975c3d3b5808abcf4651dc8388ccbfe19021ad334"}}, 0x80}}, 0x0) poll(&(0x7f00000001c0)=[{}], 0x200000000000009c, 0x0) 16:29:13 executing program 2: clone(0x41bc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = getpid() rt_tgsigqueueinfo(r0, 0x0, 0x16, &(0x7f00000001c0)) ptrace(0x4206, r0) ptrace$setsig(0x4208, r0, 0x0, 0x0) ptrace$setsig(0x4203, r0, 0x0, 0x0) 16:29:13 executing program 4: r0 = socket$inet(0x10, 0x3, 0xc) sendmsg(r0, 0x0, 0x0) sendmsg(r0, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000180)="24000000030307031dfffd946ff20c0020200a0009000100021d85680c1baba20400ff7e", 0x24}], 0x1}, 0x0) [ 220.222247][ T9640] binder: 9634:9640 unknown command 0 [ 220.256705][ T9640] binder: 9634:9640 ioctl c0306201 20000440 returned -22 16:29:13 executing program 2: clone(0x41bc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = getpid() rt_tgsigqueueinfo(r0, 0x0, 0x16, &(0x7f00000001c0)) ptrace(0x4206, r0) ptrace$setsig(0x4208, r0, 0x0, 0x0) ptrace$setsig(0x4203, r0, 0x0, 0x0) 16:29:13 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) prlimit64(0x0, 0x7, &(0x7f0000000040), 0x0) sendmmsg$unix(r0, &(0x7f00000019c0)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)}], 0x1, 0x0) 16:29:13 executing program 5: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket(0x10, 0x2, 0x0) sendto(r1, &(0x7f0000000140)="120000001200e7ef007b1a3fcd00000000a1", 0x3a, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0x23, &(0x7f0000000380)=[{&(0x7f0000000040)=""/95, 0x3d}, {&(0x7f00000000c0)=""/85, 0x4c8}, {&(0x7f00000024c0)=""/4096, 0x1038}, {&(0x7f0000000400)=""/120, 0x78}, {&(0x7f0000000480)=""/60, 0xc6}, {&(0x7f0000000280)=""/77, 0x4d}, {&(0x7f0000000540)=""/154, 0x9a}, {&(0x7f0000000340)=""/22, 0x1de}], 0x348, &(0x7f0000002400)=""/191, 0x1f9}, 0xc00}], 0x4000000000001de, 0x6, &(0x7f0000003700)={0x77359400}) 16:29:14 executing program 0: socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x1, 0xfeffff, &(0x7f0000000040)='t'}) 16:29:14 executing program 4: r0 = socket$inet(0x10, 0x3, 0xc) sendmsg(r0, &(0x7f0000000240)={0x0, 0x0, 0x0}, 0x0) sendmsg(r0, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000180)="24000000030307031dfffd946ff20c0020200a0009000100021d85680c1baba20400ff7e", 0x24}], 0x1}, 0x0) 16:29:14 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x2010000006) 16:29:14 executing program 2: clone(0x41bc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = getpid() rt_tgsigqueueinfo(r0, r0, 0x0, &(0x7f00000001c0)) ptrace(0x4206, r0) ptrace$setsig(0x4208, r0, 0x0, 0x0) ptrace$setsig(0x4203, r0, 0x0, 0x0) 16:29:14 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) prlimit64(0x0, 0x7, &(0x7f0000000040), 0x0) sendmmsg$unix(r0, &(0x7f00000019c0)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)}], 0x1, 0x0) 16:29:14 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_END_FF_ERASE(r0, 0x400c55cb, &(0x7f0000000080)) 16:29:14 executing program 2: clone(0x41bc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = getpid() rt_tgsigqueueinfo(r0, r0, 0x0, &(0x7f00000001c0)) ptrace(0x4206, r0) ptrace$setsig(0x4208, r0, 0x0, 0x0) ptrace$setsig(0x4203, r0, 0x0, 0x0) 16:29:14 executing program 1: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1fb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='/group.stat\x00<#\xfbW*\x1f\x02\x94\xe6\xf3x\xb4\x1a\xd5KM\x9d\x9a\x1fc\xf8xZ\xd1\x88\xa7\xe1\xc8\x88u\xe0[\x18\xa4\xcb:\x9c\xd1-\xce\xa4@\xd8\x99\xc2,e+:G\x1bJ\x7f\xa2\xf3\xfd\xf6\xe04\xd8\x04\xe5\xf0\xdfK\x1d\xeeH;\x15v$\xc5\x9c\x01\x00\xe8\x9ej5|\x00\x00\x00', 0x2761, 0x0) write$cgroup_int(r0, &(0x7f0000000080), 0x297ef) openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) write$cgroup_int(0xffffffffffffffff, 0x0, 0x0) [ 220.635899][ T9673] binder: 9671:9673 unknown command 0 [ 220.664307][ T9673] binder: 9671:9673 ioctl c0306201 20000440 returned -22 16:29:14 executing program 4: r0 = socket$inet(0x10, 0x3, 0xc) sendmsg(r0, &(0x7f0000000240)={0x0, 0x0, 0x0}, 0x0) sendmsg(r0, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000180)="24000000030307031dfffd946ff20c0020200a0009000100021d85680c1baba20400ff7e", 0x24}], 0x1}, 0x0) 16:29:14 executing program 2: clone(0x41bc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = getpid() rt_tgsigqueueinfo(r0, r0, 0x0, &(0x7f00000001c0)) ptrace(0x4206, r0) ptrace$setsig(0x4208, r0, 0x0, 0x0) ptrace$setsig(0x4203, r0, 0x0, 0x0) 16:29:14 executing program 0: socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x1, 0xfeffff, &(0x7f0000000040)='t'}) 16:29:14 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) prlimit64(0x0, 0x7, &(0x7f0000000040), 0x0) sendmmsg$unix(r0, &(0x7f00000019c0)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)=[@rights={{0x10}}], 0x10}], 0x1, 0x0) 16:29:14 executing program 5: r0 = open(&(0x7f0000002000)='./bus\x00', 0x800000000141042, 0x0) pwritev(r0, &(0x7f0000001380)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) fallocate(r0, 0x20, 0x0, 0xfffffeff000) write$cgroup_type(0xffffffffffffffff, &(0x7f0000000180)='threaded\x00', 0x9) r1 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) fallocate(r1, 0x0, 0x40000000, 0x10000101) ioctl$FS_IOC_SETFLAGS(r1, 0x40086602, &(0x7f00000000c0)) 16:29:14 executing program 4: r0 = socket$inet(0x10, 0x3, 0xc) sendmsg(r0, &(0x7f0000000240)={0x0, 0x0, 0x0}, 0x0) sendmsg(r0, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000180)="24000000030307031dfffd946ff20c0020200a0009000100021d85680c1baba20400ff7e", 0x24}], 0x1}, 0x0) [ 220.974527][ T9700] binder: 9696:9700 unknown command 0 16:29:14 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) prlimit64(0x0, 0x7, &(0x7f0000000040), 0x0) sendmmsg$unix(r0, &(0x7f00000019c0)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)=[@rights={{0x10}}], 0x10}], 0x1, 0x0) [ 221.031037][ T9700] binder: 9696:9700 ioctl c0306201 20000440 returned -22 16:29:14 executing program 2: clone(0x41bc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = getpid() rt_tgsigqueueinfo(r0, r0, 0x16, 0x0) ptrace(0x4206, r0) ptrace$setsig(0x4208, r0, 0x0, 0x0) ptrace$setsig(0x4203, r0, 0x0, 0x0) 16:29:14 executing program 1: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000001fd8)=ANY=[@ANYBLOB="850000006100000016000000000009239500000000000000"], &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000)={0x4c5047}}, 0x48) 16:29:14 executing program 0: socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x1, 0xfeffff, &(0x7f0000000040)='t'}) 16:29:14 executing program 4: r0 = socket$inet(0x10, 0x3, 0xc) sendmsg(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)}, 0x0) sendmsg(r0, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000180)="24000000030307031dfffd946ff20c0020200a0009000100021d85680c1baba20400ff7e", 0x24}], 0x1}, 0x0) 16:29:14 executing program 2: clone(0x41bc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = getpid() rt_tgsigqueueinfo(r0, r0, 0x16, 0x0) ptrace(0x4206, r0) ptrace$setsig(0x4208, r0, 0x0, 0x0) ptrace$setsig(0x4203, r0, 0x0, 0x0) 16:29:14 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) prlimit64(0x0, 0x7, &(0x7f0000000040), 0x0) sendmmsg$unix(r0, &(0x7f00000019c0)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)=[@rights={{0x10}}], 0x10}], 0x1, 0x0) [ 221.308507][ T26] kauditd_printk_skb: 3 callbacks suppressed [ 221.308519][ T26] audit: type=1800 audit(1566836954.859:31): pid=9708 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.5" name="bus" dev="sda1" ino=16658 res=0 16:29:14 executing program 5: bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000000380)=ANY=[@ANYBLOB="b702000003000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d640500000000006504040001ffffffc604000001007d60b7030000000000006a0a00fe000000008500000008000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) [ 221.384524][ T9730] binder: 9724:9730 unknown command 0 [ 221.429328][ T9732] cgroup: fork rejected by pids controller in /syz2 [ 221.438666][ T9730] binder: 9724:9730 ioctl c0306201 20000440 returned -22 16:29:15 executing program 4: r0 = socket$inet(0x10, 0x3, 0xc) sendmsg(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)}, 0x0) sendmsg(r0, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000180)="24000000030307031dfffd946ff20c0020200a0009000100021d85680c1baba20400ff7e", 0x24}], 0x1}, 0x0) 16:29:15 executing program 1: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=ANY=[@ANYBLOB="850000005900000016000000000009239500000000000000"], &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000)={0x4c5047}}, 0x48) [ 221.461690][ T26] audit: type=1800 audit(1566836954.889:32): pid=9719 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.5" name="bus" dev="sda1" ino=16658 res=0 16:29:15 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x0, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") r1 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x1, 0xfeffff, &(0x7f0000000040)='t'}) 16:29:15 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) prlimit64(0x0, 0x7, &(0x7f0000000040), 0x0) sendmmsg$unix(r0, &(0x7f00000019c0)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}], 0x1, 0x0) 16:29:15 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280)='/dev/net/tun\x00', 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f00000000c0)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") flock(r0, 0x1) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='fdinfo/3\x00') preadv(r2, &(0x7f00000017c0), 0x333, 0x0) 16:29:15 executing program 4: r0 = socket$inet(0x10, 0x3, 0xc) sendmsg(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)}, 0x0) sendmsg(r0, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000180)="24000000030307031dfffd946ff20c0020200a0009000100021d85680c1baba20400ff7e", 0x24}], 0x1}, 0x0) 16:29:15 executing program 1: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendmsg$inet_sctp(r0, &(0x7f0000000200)={&(0x7f0000000000)=@in={0x2, 0x0, @dev}, 0x10, &(0x7f0000000140)=[{&(0x7f0000000040)="d7", 0x1}], 0x1, &(0x7f0000000280)=[@init={0x18, 0x84, 0x0, {0x0, 0x0, 0x5}}], 0x18}, 0x0) 16:29:15 executing program 2: clone(0x41bc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = getpid() rt_tgsigqueueinfo(r0, r0, 0x16, 0x0) ptrace(0x4206, r0) ptrace$setsig(0x4208, r0, 0x0, 0x0) ptrace$setsig(0x4203, r0, 0x0, 0x0) [ 221.749664][ T9852] binder: 9843:9852 unknown command 0 [ 221.783446][ T9852] binder: 9843:9852 ioctl c0306201 20000440 returned -22 16:29:15 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) prlimit64(0x0, 0x7, &(0x7f0000000040), 0x0) sendmmsg$unix(r0, &(0x7f00000019c0)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}], 0x1, 0x0) 16:29:15 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x0, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") r1 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x1, 0xfeffff, &(0x7f0000000040)='t'}) 16:29:15 executing program 4: r0 = socket$inet(0x10, 0x3, 0xc) sendmsg(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)=[{0x0}], 0x1}, 0x0) sendmsg(r0, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000180)="24000000030307031dfffd946ff20c0020200a0009000100021d85680c1baba20400ff7e", 0x24}], 0x1}, 0x0) 16:29:15 executing program 2: clone(0x41bc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = getpid() rt_tgsigqueueinfo(r0, r0, 0x16, &(0x7f00000001c0)) ptrace(0xffffffffffffffff, r0) ptrace$setsig(0x4208, r0, 0x0, 0x0) ptrace$setsig(0x4203, r0, 0x0, 0x0) 16:29:15 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) prlimit64(0x0, 0x7, &(0x7f0000000040), 0x0) sendmmsg$unix(r0, &(0x7f00000019c0)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}], 0x1, 0x0) 16:29:15 executing program 5: syz_open_dev$mice(&(0x7f0000000140)='/dev/input/mice\x00', 0x0, 0x80) r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vga_arbiter\x00', 0xb906b8ede7baf7e2, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000002a00)=[@in={0x2, 0x4e24, @loopback}, @in={0x2, 0x4e23, @remote}, @in={0x2, 0x4e22, @loopback}, @in={0x2, 0x4e20, @empty}, @in6={0xa, 0x4e23, 0x7, @rand_addr="1469538582cada4b421af83532620324", 0x7}], 0xffffffe8) r1 = syz_open_dev$vbi(&(0x7f0000000080)='/dev/vbi#\x00', 0x2, 0x2) ioctl$SNDRV_CTL_IOCTL_CARD_INFO(r1, 0x81785501, &(0x7f00000003c0)=""/84) r2 = getpid() socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$int_in(r3, 0x5452, &(0x7f00005ebff8)=0x3f) fcntl$setsig(r3, 0xa, 0x12) fcntl$setownex(r3, 0xf, &(0x7f0000000180)={0x2, r2}) recvmsg(r4, &(0x7f000095cfc8)={0x0, 0x0, 0x0}, 0x0) dup2(r3, r4) clone(0x0, 0x0, 0x0, 0x0, 0x0) tkill(r2, 0x15) ioctl$DRM_IOCTL_ADD_MAP(r1, 0xc0286415, &(0x7f0000000000)={0x0, 0x3, 0x7, 0x2, &(0x7f0000ff3000/0xd000)=nil, 0x3}) [ 222.027082][ T9876] binder: 9873:9876 unknown command 0 [ 222.034698][ T9876] binder: 9873:9876 ioctl c0306201 20000440 returned -22 16:29:15 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x0, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") r1 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x1, 0xfeffff, &(0x7f0000000040)='t'}) 16:29:15 executing program 4: r0 = socket$inet(0x10, 0x3, 0xc) sendmsg(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)=[{0x0}], 0x1}, 0x0) sendmsg(r0, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000180)="24000000030307031dfffd946ff20c0020200a0009000100021d85680c1baba20400ff7e", 0x24}], 0x1}, 0x0) 16:29:15 executing program 3: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000001fd8)=ANY=[@ANYBLOB="850000001800000016000000000009239500000000000000"], &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000)={0x4c5047}}, 0x48) 16:29:15 executing program 2: clone(0x41bc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = getpid() rt_tgsigqueueinfo(r0, r0, 0x16, &(0x7f00000001c0)) ptrace(0xffffffffffffffff, r0) ptrace$setsig(0x4208, r0, 0x0, 0x0) ptrace$setsig(0x4203, r0, 0x0, 0x0) [ 222.299720][ T9893] binder: 9892:9893 unknown command 0 [ 222.305344][ T9893] binder: 9892:9893 ioctl c0306201 20000440 returned -22 16:29:16 executing program 1: add_key(&(0x7f0000000580)='rxrpc\x00', &(0x7f00000005c0)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffe) 16:29:16 executing program 4: r0 = socket$inet(0x10, 0x3, 0xc) sendmsg(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)=[{0x0}], 0x1}, 0x0) sendmsg(r0, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000180)="24000000030307031dfffd946ff20c0020200a0009000100021d85680c1baba20400ff7e", 0x24}], 0x1}, 0x0) 16:29:16 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x1, 0xfeffff, &(0x7f0000000040)='t'}) 16:29:16 executing program 2: clone(0x41bc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = getpid() rt_tgsigqueueinfo(r0, r0, 0x16, &(0x7f00000001c0)) ptrace(0xffffffffffffffff, r0) ptrace$setsig(0x4208, r0, 0x0, 0x0) ptrace$setsig(0x4203, r0, 0x0, 0x0) 16:29:16 executing program 5: syz_open_dev$mice(&(0x7f0000000140)='/dev/input/mice\x00', 0x0, 0x80) r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vga_arbiter\x00', 0xb906b8ede7baf7e2, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000002a00)=[@in={0x2, 0x4e24, @loopback}, @in={0x2, 0x4e23, @remote}, @in={0x2, 0x4e22, @loopback}, @in={0x2, 0x4e20, @empty}, @in6={0xa, 0x4e23, 0x7, @rand_addr="1469538582cada4b421af83532620324", 0x7}], 0xffffffe8) r1 = syz_open_dev$vbi(&(0x7f0000000080)='/dev/vbi#\x00', 0x2, 0x2) ioctl$SNDRV_CTL_IOCTL_CARD_INFO(r1, 0x81785501, &(0x7f00000003c0)=""/84) r2 = getpid() socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$int_in(r3, 0x5452, &(0x7f00005ebff8)=0x3f) fcntl$setsig(r3, 0xa, 0x12) fcntl$setownex(r3, 0xf, &(0x7f0000000180)={0x2, r2}) recvmsg(r4, &(0x7f000095cfc8)={0x0, 0x0, 0x0}, 0x0) dup2(r3, r4) clone(0x0, 0x0, 0x0, 0x0, 0x0) tkill(r2, 0x15) ioctl$DRM_IOCTL_ADD_MAP(r1, 0xc0286415, &(0x7f0000000000)={0x0, 0x3, 0x7, 0x2, &(0x7f0000ff3000/0xd000)=nil, 0x3}) 16:29:16 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_SET_LEDBIT(r0, 0xc0189436, 0x800000000007) 16:29:16 executing program 4: r0 = socket$inet(0x10, 0x3, 0xc) sendmsg(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)=[{}], 0x1}, 0x0) sendmsg(r0, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000180)="24000000030307031dfffd946ff20c0020200a0009000100021d85680c1baba20400ff7e", 0x24}], 0x1}, 0x0) 16:29:16 executing program 2: clone(0x41bc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = getpid() rt_tgsigqueueinfo(r0, r0, 0x16, &(0x7f00000001c0)) ptrace(0x4206, 0x0) ptrace$setsig(0x4208, r0, 0x0, 0x0) ptrace$setsig(0x4203, r0, 0x0, 0x0) [ 222.719021][ T9921] binder: 9913:9921 unknown command 0 [ 222.751770][ T9921] binder: 9913:9921 ioctl c0306201 20000440 returned -22 16:29:16 executing program 3: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) ioctl$FS_IOC_GETFSLABEL(r0, 0x8982, 0x0) 16:29:16 executing program 1: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000001fd8)=ANY=[@ANYBLOB="850000001a00000016000000000009239500000000000000"], &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000)={0x4c5047}}, 0x48) 16:29:16 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x1, 0xfeffff, &(0x7f0000000040)='t'}) 16:29:16 executing program 4: r0 = socket$inet(0x10, 0x3, 0xc) sendmsg(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)=[{}], 0x1}, 0x0) sendmsg(r0, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000180)="24000000030307031dfffd946ff20c0020200a0009000100021d85680c1baba20400ff7e", 0x24}], 0x1}, 0x0) 16:29:16 executing program 3: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendmsg$inet_sctp(r0, &(0x7f0000000200)={&(0x7f0000000000)=@in={0x2, 0x0, @dev}, 0x10, &(0x7f0000000140)=[{&(0x7f0000000040)="d7", 0x1}], 0x1, &(0x7f0000000280)=[@init={0x18, 0x84, 0x8}], 0x18}, 0x0) 16:29:16 executing program 1: syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x0, 0x700000000000000, 0x0, 0x1, 0x0, &(0x7f0000000300)="1f"}) 16:29:16 executing program 2: clone(0x41bc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = getpid() rt_tgsigqueueinfo(r0, r0, 0x16, &(0x7f00000001c0)) ptrace(0x4206, 0x0) ptrace$setsig(0x4208, r0, 0x0, 0x0) ptrace$setsig(0x4203, r0, 0x0, 0x0) [ 223.043961][ T9943] binder: 9942:9943 unknown command 0 16:29:16 executing program 5: syz_open_dev$mice(&(0x7f0000000140)='/dev/input/mice\x00', 0x0, 0x80) r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vga_arbiter\x00', 0xb906b8ede7baf7e2, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000002a00)=[@in={0x2, 0x4e24, @loopback}, @in={0x2, 0x4e23, @remote}, @in={0x2, 0x4e22, @loopback}, @in={0x2, 0x4e20, @empty}, @in6={0xa, 0x4e23, 0x7, @rand_addr="1469538582cada4b421af83532620324", 0x7}], 0xffffffe8) r1 = syz_open_dev$vbi(&(0x7f0000000080)='/dev/vbi#\x00', 0x2, 0x2) ioctl$SNDRV_CTL_IOCTL_CARD_INFO(r1, 0x81785501, &(0x7f00000003c0)=""/84) r2 = getpid() socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$int_in(r3, 0x5452, &(0x7f00005ebff8)=0x3f) fcntl$setsig(r3, 0xa, 0x12) fcntl$setownex(r3, 0xf, &(0x7f0000000180)={0x2, r2}) recvmsg(r4, &(0x7f000095cfc8)={0x0, 0x0, 0x0}, 0x0) dup2(r3, r4) clone(0x0, 0x0, 0x0, 0x0, 0x0) tkill(r2, 0x15) ioctl$DRM_IOCTL_ADD_MAP(r1, 0xc0286415, &(0x7f0000000000)={0x0, 0x3, 0x7, 0x2, &(0x7f0000ff3000/0xd000)=nil, 0x3}) [ 223.099179][ T9943] binder: 9942:9943 ioctl c0306201 20000440 returned -22 16:29:16 executing program 4: r0 = socket$inet(0x10, 0x3, 0xc) sendmsg(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)=[{}], 0x1}, 0x0) sendmsg(r0, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000180)="24000000030307031dfffd946ff20c0020200a0009000100021d85680c1baba20400ff7e", 0x24}], 0x1}, 0x0) [ 223.183202][ T9954] debugfs: File '9952' in directory 'proc' already present! 16:29:16 executing program 3: r0 = socket(0x10, 0x2, 0x0) sendto(r0, &(0x7f0000000140)="120000001200e7ef007b1a3fcd00000000a1", 0x3a, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0x23, &(0x7f0000000380)=[{&(0x7f0000000040)=""/95, 0x3d}, {&(0x7f00000000c0)=""/85, 0x4c8}, {&(0x7f00000024c0)=""/4096, 0x5bb}, {&(0x7f0000000400)=""/120, 0x78}, {&(0x7f0000000480)=""/60, 0xc6}, {&(0x7f0000000280)=""/77, 0x4d}, {&(0x7f0000000540)=""/154, 0x9a}, {&(0x7f0000000340)=""/22, 0x1de}], 0x348, &(0x7f0000002400)=""/191, 0x1f9}, 0xc00}], 0x4000000000001de, 0x6, &(0x7f0000003700)={0x77359400}) 16:29:16 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x1, 0xfeffff, &(0x7f0000000040)='t'}) 16:29:16 executing program 2: clone(0x41bc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = getpid() rt_tgsigqueueinfo(r0, r0, 0x16, &(0x7f00000001c0)) ptrace(0x4206, 0x0) ptrace$setsig(0x4208, r0, 0x0, 0x0) ptrace$setsig(0x4203, r0, 0x0, 0x0) 16:29:16 executing program 1: r0 = socket(0x40000000015, 0x5, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e21, @local}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={0x2, 0x0, @rand_addr=0x100}, 0x10) setsockopt$RDS_CANCEL_SENT_TO(r0, 0x114, 0x1, &(0x7f0000000680)={0x2, 0x0, @loopback}, 0x10) [ 223.410420][ T9969] binder: 9966:9969 unknown command 0 16:29:17 executing program 4: r0 = socket$inet(0x10, 0x3, 0xc) sendmsg(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000000)="2400000002031f001cfffd946fa283002020", 0x12}], 0x1}, 0x0) sendmsg(r0, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000180)="24000000030307031dfffd946ff20c0020200a0009000100021d85680c1baba20400ff7e", 0x24}], 0x1}, 0x0) [ 223.453651][ T9969] binder: 9966:9969 ioctl c0306201 20000440 returned -22 16:29:17 executing program 3: r0 = bpf$MAP_CREATE(0x0, &(0x7f00000001c0)={0x200000001, 0x3, 0x2000000000000009, 0x2, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000200)={r0, &(0x7f0000000100)}, 0x20) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000400)={r0, &(0x7f00000003c0)="fd", &(0x7f0000000380)}, 0x20) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) 16:29:17 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)) r1 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x1, 0xfeffff, &(0x7f0000000040)='t'}) 16:29:17 executing program 2: clone(0x41bc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = getpid() rt_tgsigqueueinfo(r0, r0, 0x16, &(0x7f00000001c0)) ptrace(0x4206, r0) ptrace$setsig(0x4208, 0x0, 0x0, 0x0) ptrace$setsig(0x4203, r0, 0x0, 0x0) 16:29:17 executing program 5: syz_open_dev$mice(&(0x7f0000000140)='/dev/input/mice\x00', 0x0, 0x80) r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vga_arbiter\x00', 0xb906b8ede7baf7e2, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000002a00)=[@in={0x2, 0x4e24, @loopback}, @in={0x2, 0x4e23, @remote}, @in={0x2, 0x4e22, @loopback}, @in={0x2, 0x4e20, @empty}, @in6={0xa, 0x4e23, 0x7, @rand_addr="1469538582cada4b421af83532620324", 0x7}], 0xffffffe8) r1 = syz_open_dev$vbi(&(0x7f0000000080)='/dev/vbi#\x00', 0x2, 0x2) ioctl$SNDRV_CTL_IOCTL_CARD_INFO(r1, 0x81785501, &(0x7f00000003c0)=""/84) r2 = getpid() socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$int_in(r3, 0x5452, &(0x7f00005ebff8)=0x3f) fcntl$setsig(r3, 0xa, 0x12) fcntl$setownex(r3, 0xf, &(0x7f0000000180)={0x2, r2}) recvmsg(r4, &(0x7f000095cfc8)={0x0, 0x0, 0x0}, 0x0) dup2(r3, r4) clone(0x0, 0x0, 0x0, 0x0, 0x0) tkill(r2, 0x15) ioctl$DRM_IOCTL_ADD_MAP(r1, 0xc0286415, &(0x7f0000000000)={0x0, 0x3, 0x7, 0x2, &(0x7f0000ff3000/0xd000)=nil, 0x3}) 16:29:17 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)) r1 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x1, 0xfeffff, &(0x7f0000000040)='t'}) [ 223.654038][ T9988] binder: 9987:9988 unknown command 0 [ 223.677479][ T9988] binder: 9987:9988 ioctl c0306201 20000440 returned -22 16:29:17 executing program 4: r0 = socket$inet(0x10, 0x3, 0xc) sendmsg(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000000)="2400000002031f001cfffd946fa283002020", 0x12}], 0x1}, 0x0) sendmsg(r0, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000180)="24000000030307031dfffd946ff20c0020200a0009000100021d85680c1baba20400ff7e", 0x24}], 0x1}, 0x0) 16:29:17 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000740)={0xffffffffffffffff}) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) r1 = inotify_init1(0x0) read(r1, 0x0, 0x0) inotify_add_watch(r1, &(0x7f0000000080)='./file0\x00', 0xa400295c) dup3(r0, r1, 0x0) utime(&(0x7f0000000040)='./file0\x00', 0x0) 16:29:17 executing program 2: clone(0x41bc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = getpid() rt_tgsigqueueinfo(r0, r0, 0x16, &(0x7f00000001c0)) ptrace(0x4206, r0) ptrace$setsig(0x4208, 0x0, 0x0, 0x0) ptrace$setsig(0x4203, r0, 0x0, 0x0) 16:29:17 executing program 4: r0 = socket$inet(0x10, 0x3, 0xc) sendmsg(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000000)="2400000002031f001cfffd946fa283002020", 0x12}], 0x1}, 0x0) sendmsg(r0, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000180)="24000000030307031dfffd946ff20c0020200a0009000100021d85680c1baba20400ff7e", 0x24}], 0x1}, 0x0) [ 223.850397][T10005] binder: 10000:10005 unknown command 0 [ 223.856364][T10005] binder: 10000:10005 ioctl c0306201 20000440 returned -22 16:29:17 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)) r1 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x1, 0xfeffff, &(0x7f0000000040)='t'}) [ 223.992958][T10020] binder: 10017:10020 unknown command 0 [ 224.014773][T10020] binder: 10017:10020 ioctl c0306201 20000440 returned -22 16:29:17 executing program 1: r0 = socket(0x40000000015, 0x5, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e21, @local}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={0x2, 0x0, @rand_addr=0x100}, 0x10) setsockopt$RDS_CANCEL_SENT_TO(r0, 0x114, 0x1, &(0x7f0000000680)={0x2, 0x0, @loopback}, 0x10) 16:29:17 executing program 2: clone(0x41bc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = getpid() rt_tgsigqueueinfo(r0, r0, 0x16, &(0x7f00000001c0)) ptrace(0x4206, r0) ptrace$setsig(0x4208, 0x0, 0x0, 0x0) ptrace$setsig(0x4203, r0, 0x0, 0x0) 16:29:17 executing program 4: r0 = socket$inet(0x10, 0x3, 0xc) sendmsg(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000000)="2400000002031f001cfffd946fa2830020200a000900010001e700", 0x1b}], 0x1}, 0x0) sendmsg(r0, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000180)="24000000030307031dfffd946ff20c0020200a0009000100021d85680c1baba20400ff7e", 0x24}], 0x1}, 0x0) 16:29:17 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0b") r1 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x1, 0xfeffff, &(0x7f0000000040)='t'}) 16:29:17 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000740)={0xffffffffffffffff}) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) r1 = inotify_init1(0x0) read(r1, 0x0, 0x0) inotify_add_watch(r1, &(0x7f0000000080)='./file0\x00', 0xa400295c) dup3(r0, r1, 0x0) utime(&(0x7f0000000040)='./file0\x00', 0x0) 16:29:17 executing program 5: syz_open_dev$mice(&(0x7f0000000140)='/dev/input/mice\x00', 0x0, 0x80) r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vga_arbiter\x00', 0xb906b8ede7baf7e2, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000002a00)=[@in={0x2, 0x4e24, @loopback}, @in={0x2, 0x4e23, @remote}, @in={0x2, 0x4e22, @loopback}, @in={0x2, 0x4e20, @empty}, @in6={0xa, 0x4e23, 0x7, @rand_addr="1469538582cada4b421af83532620324", 0x7}], 0xffffffe8) r1 = syz_open_dev$vbi(&(0x7f0000000080)='/dev/vbi#\x00', 0x2, 0x2) ioctl$SNDRV_CTL_IOCTL_CARD_INFO(r1, 0x81785501, &(0x7f00000003c0)=""/84) r2 = getpid() socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$int_in(r3, 0x5452, &(0x7f00005ebff8)=0x3f) fcntl$setsig(r3, 0xa, 0x12) fcntl$setownex(r3, 0xf, &(0x7f0000000180)={0x2, r2}) recvmsg(r4, &(0x7f000095cfc8)={0x0, 0x0, 0x0}, 0x0) dup2(r3, r4) clone(0x0, 0x0, 0x0, 0x0, 0x0) tkill(r2, 0x15) 16:29:17 executing program 4: r0 = socket$inet(0x10, 0x3, 0xc) sendmsg(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000000)="2400000002031f001cfffd946fa2830020200a000900010001e700", 0x1b}], 0x1}, 0x0) sendmsg(r0, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000180)="24000000030307031dfffd946ff20c0020200a0009000100021d85680c1baba20400ff7e", 0x24}], 0x1}, 0x0) 16:29:17 executing program 2: clone(0x41bc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = getpid() rt_tgsigqueueinfo(r0, r0, 0x16, &(0x7f00000001c0)) ptrace(0x4206, r0) ptrace$setsig(0x4208, r0, 0x0, 0x0) ptrace$setsig(0x4203, 0x0, 0x0, 0x0) [ 224.354235][T10039] binder: 10031:10039 unknown command 0 16:29:18 executing program 1: r0 = socket(0x40000000015, 0x5, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e21, @local}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={0x2, 0x0, @rand_addr=0x100}, 0x10) setsockopt$RDS_CANCEL_SENT_TO(r0, 0x114, 0x1, &(0x7f0000000680)={0x2, 0x0, @loopback}, 0x10) 16:29:18 executing program 3: openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000340)={0x26, 'hash\x00', 0x0, 0x0, 'sha3-384\x00'}, 0x58) r1 = accept4(r0, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000001bc0), 0xfe, 0x0, &(0x7f0000001d00)={0x77359400}) [ 224.395135][T10039] binder: 10031:10039 ioctl c0306201 20000440 returned -22 16:29:18 executing program 5: syz_open_dev$mice(&(0x7f0000000140)='/dev/input/mice\x00', 0x0, 0x80) r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vga_arbiter\x00', 0xb906b8ede7baf7e2, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000002a00)=[@in={0x2, 0x4e24, @loopback}, @in={0x2, 0x4e23, @remote}, @in={0x2, 0x4e22, @loopback}, @in={0x2, 0x4e20, @empty}, @in6={0xa, 0x4e23, 0x7, @rand_addr="1469538582cada4b421af83532620324", 0x7}], 0xffffffe8) r1 = syz_open_dev$vbi(&(0x7f0000000080)='/dev/vbi#\x00', 0x2, 0x2) ioctl$SNDRV_CTL_IOCTL_CARD_INFO(r1, 0x81785501, &(0x7f00000003c0)=""/84) r2 = getpid() socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$int_in(r3, 0x5452, &(0x7f00005ebff8)=0x3f) fcntl$setsig(r3, 0xa, 0x12) fcntl$setownex(r3, 0xf, &(0x7f0000000180)={0x2, r2}) recvmsg(r4, &(0x7f000095cfc8)={0x0, 0x0, 0x0}, 0x0) dup2(r3, r4) clone(0x0, 0x0, 0x0, 0x0, 0x0) 16:29:18 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0b") r1 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x1, 0xfeffff, &(0x7f0000000040)='t'}) 16:29:18 executing program 2: clone(0x41bc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = getpid() rt_tgsigqueueinfo(r0, r0, 0x16, &(0x7f00000001c0)) ptrace(0x4206, r0) ptrace$setsig(0x4208, r0, 0x0, 0x0) ptrace$setsig(0x4203, 0x0, 0x0, 0x0) 16:29:18 executing program 4: r0 = socket$inet(0x10, 0x3, 0xc) sendmsg(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000000)="2400000002031f001cfffd946fa2830020200a000900010001e700", 0x1b}], 0x1}, 0x0) sendmsg(r0, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000180)="24000000030307031dfffd946ff20c0020200a0009000100021d85680c1baba20400ff7e", 0x24}], 0x1}, 0x0) 16:29:18 executing program 1: r0 = socket$inet6_tcp(0x1c, 0x1, 0x0) connect$inet6(r0, &(0x7f0000000000)={0x1c, 0x1c}, 0x1c) 16:29:18 executing program 2: clone(0x41bc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = getpid() rt_tgsigqueueinfo(r0, r0, 0x16, &(0x7f00000001c0)) ptrace(0x4206, r0) ptrace$setsig(0x4208, r0, 0x0, 0x0) ptrace$setsig(0x4203, 0x0, 0x0, 0x0) [ 224.735673][T10068] binder: 10062:10068 unknown command 0 16:29:18 executing program 4: r0 = socket$inet(0x10, 0x3, 0xc) sendmsg(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000000)="2400000002031f001cfffd946fa2830020200a000900010001e700000000a3a2", 0x20}], 0x1}, 0x0) sendmsg(r0, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000180)="24000000030307031dfffd946ff20c0020200a0009000100021d85680c1baba20400ff7e", 0x24}], 0x1}, 0x0) [ 224.789713][T10068] binder: 10062:10068 ioctl c0306201 20000440 returned -22 16:29:18 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x20986100, 0x0, 0x0, 0x0, &(0x7f0000000100)="d353ff072d48b2eed022aa5fa8b3d94c22") 16:29:18 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0b") r1 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x1, 0xfeffff, &(0x7f0000000040)='t'}) 16:29:18 executing program 3: openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000340)={0x26, 'hash\x00', 0x0, 0x0, 'sha3-384\x00'}, 0x58) r1 = accept4(r0, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000001bc0), 0xfe, 0x0, &(0x7f0000001d00)={0x77359400}) 16:29:18 executing program 4: r0 = socket$inet(0x10, 0x3, 0xc) sendmsg(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000000)="2400000002031f001cfffd946fa2830020200a000900010001e700000000a3a2", 0x20}], 0x1}, 0x0) sendmsg(r0, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000180)="24000000030307031dfffd946ff20c0020200a0009000100021d85680c1baba20400ff7e", 0x24}], 0x1}, 0x0) 16:29:18 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) listen(r0, 0x4000000043) r1 = socket$inet6_sctp(0xa, 0x4000000000000001, 0x84) sendto$inet6(r1, &(0x7f000087dffe)='F', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) shutdown(r1, 0x2) r2 = accept4(r0, 0x0, 0x0, 0x0) shutdown(r2, 0x1) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f00000000c0)={0x0, @in6, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x98) [ 225.150855][T10099] binder: 10095:10099 unknown command 0 [ 225.182370][T10099] binder: 10095:10099 ioctl c0306201 20000440 returned -22 16:29:19 executing program 5: syz_open_dev$mice(&(0x7f0000000140)='/dev/input/mice\x00', 0x0, 0x80) r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vga_arbiter\x00', 0xb906b8ede7baf7e2, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000002a00)=[@in={0x2, 0x4e24, @loopback}, @in={0x2, 0x4e23, @remote}, @in={0x2, 0x4e22, @loopback}, @in={0x2, 0x4e20, @empty}, @in6={0xa, 0x4e23, 0x7, @rand_addr="1469538582cada4b421af83532620324", 0x7}], 0xffffffe8) r1 = syz_open_dev$vbi(&(0x7f0000000080)='/dev/vbi#\x00', 0x2, 0x2) ioctl$SNDRV_CTL_IOCTL_CARD_INFO(r1, 0x81785501, &(0x7f00000003c0)=""/84) r2 = getpid() socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$int_in(r3, 0x5452, &(0x7f00005ebff8)=0x3f) fcntl$setsig(r3, 0xa, 0x12) fcntl$setownex(r3, 0xf, &(0x7f0000000180)={0x2, r2}) recvmsg(r4, &(0x7f000095cfc8)={0x0, 0x0, 0x0}, 0x0) dup2(r3, r4) clone(0x0, 0x0, 0x0, 0x0, 0x0) 16:29:19 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47b") r1 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x1, 0xfeffff, &(0x7f0000000040)='t'}) 16:29:19 executing program 4: r0 = socket$inet(0x10, 0x3, 0xc) sendmsg(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000000)="2400000002031f001cfffd946fa2830020200a000900010001e700000000a3a2", 0x20}], 0x1}, 0x0) sendmsg(r0, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000180)="24000000030307031dfffd946ff20c0020200a0009000100021d85680c1baba20400ff7e", 0x24}], 0x1}, 0x0) 16:29:19 executing program 3: openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000340)={0x26, 'hash\x00', 0x0, 0x0, 'sha3-384\x00'}, 0x58) r1 = accept4(r0, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000001bc0), 0xfe, 0x0, &(0x7f0000001d00)={0x77359400}) 16:29:19 executing program 2: r0 = openat$usbmon(0xffffffffffffff9c, &(0x7f0000000640)='/dev/usbmon0\x00', 0x0, 0x0) readv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/202, 0x1}], 0x1) syz_open_dev$usb(&(0x7f0000000200)='/dev/bus/usb/00#/00#\x00', 0x6602, 0x0) 16:29:19 executing program 4: r0 = socket$inet(0x10, 0x3, 0xc) sendmsg(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000000)="2400000002031f001cfffd946fa2830020200a000900010001e700000000a3a20404", 0x22}], 0x1}, 0x0) sendmsg(r0, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000180)="24000000030307031dfffd946ff20c0020200a0009000100021d85680c1baba20400ff7e", 0x24}], 0x1}, 0x0) [ 225.507574][T10221] binder: 10219:10221 unknown command 0 [ 225.538653][T10221] binder: 10219:10221 ioctl c0306201 20000440 returned -22 16:29:19 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47b") r1 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x1, 0xfeffff, &(0x7f0000000040)='t'}) [ 225.788080][T10336] binder: 10334:10336 unknown command 0 [ 225.804526][T10336] binder: 10334:10336 ioctl c0306201 20000440 returned -22 16:29:19 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x20986100, 0x0, 0x0, 0x0, &(0x7f0000000100)="d353ff072d48b2eed022aa5fa8b3d94c22") 16:29:19 executing program 4: r0 = socket$inet(0x10, 0x3, 0xc) sendmsg(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000000)="2400000002031f001cfffd946fa2830020200a000900010001e700000000a3a20404", 0x22}], 0x1}, 0x0) sendmsg(r0, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000180)="24000000030307031dfffd946ff20c0020200a0009000100021d85680c1baba20400ff7e", 0x24}], 0x1}, 0x0) 16:29:19 executing program 2: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/cuse\x00', 0x2842, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r1, r0) 16:29:19 executing program 3: openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000340)={0x26, 'hash\x00', 0x0, 0x0, 'sha3-384\x00'}, 0x58) r1 = accept4(r0, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000001bc0), 0xfe, 0x0, &(0x7f0000001d00)={0x77359400}) 16:29:19 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47b") r1 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x1, 0xfeffff, &(0x7f0000000040)='t'}) [ 225.982945][T10348] binder: 10346:10348 unknown command 0 [ 226.017148][T10348] binder: 10346:10348 ioctl c0306201 20000440 returned -22 16:29:19 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf0") r1 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x1, 0xfeffff, &(0x7f0000000040)='t'}) 16:29:19 executing program 4: r0 = socket$inet(0x10, 0x3, 0xc) sendmsg(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000000)="2400000002031f001cfffd946fa2830020200a000900010001e700000000a3a20404", 0x22}], 0x1}, 0x0) sendmsg(r0, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000180)="24000000030307031dfffd946ff20c0020200a0009000100021d85680c1baba20400ff7e", 0x24}], 0x1}, 0x0) 16:29:19 executing program 2: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/cuse\x00', 0x2842, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r1, r0) 16:29:19 executing program 5: syz_open_dev$mice(&(0x7f0000000140)='/dev/input/mice\x00', 0x0, 0x80) r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vga_arbiter\x00', 0xb906b8ede7baf7e2, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000002a00)=[@in={0x2, 0x4e24, @loopback}, @in={0x2, 0x4e23, @remote}, @in={0x2, 0x4e22, @loopback}, @in={0x2, 0x4e20, @empty}, @in6={0xa, 0x4e23, 0x7, @rand_addr="1469538582cada4b421af83532620324", 0x7}], 0xffffffe8) r1 = syz_open_dev$vbi(&(0x7f0000000080)='/dev/vbi#\x00', 0x2, 0x2) ioctl$SNDRV_CTL_IOCTL_CARD_INFO(r1, 0x81785501, &(0x7f00000003c0)=""/84) r2 = getpid() socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$int_in(r3, 0x5452, &(0x7f00005ebff8)=0x3f) fcntl$setsig(r3, 0xa, 0x12) fcntl$setownex(r3, 0xf, &(0x7f0000000180)={0x2, r2}) recvmsg(r4, &(0x7f000095cfc8)={0x0, 0x0, 0x0}, 0x0) dup2(r3, r4) clone(0x0, 0x0, 0x0, 0x0, 0x0) 16:29:19 executing program 3: openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000340)={0x26, 'hash\x00', 0x0, 0x0, 'sha3-384\x00'}, 0x58) recvmmsg(0xffffffffffffffff, &(0x7f0000001bc0), 0xfe, 0x0, &(0x7f0000001d00)={0x77359400}) 16:29:19 executing program 2: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) set_mempolicy(0x8003, &(0x7f0000000080)=0x1, 0x4) write$apparmor_current(0xffffffffffffffff, &(0x7f0000000140)=@profile={'changeprofile ', '\\}-posix_acl_accessself\x00'}, 0x26) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='numa_maps\x00') readv(r0, &(0x7f0000000040)=[{&(0x7f0000002400)=""/4096, 0x10b6}], 0x1) [ 226.389846][T10465] binder: 10463:10465 unknown command 0 [ 226.406508][T10465] binder: 10463:10465 ioctl c0306201 20000440 returned -22 16:29:20 executing program 4: r0 = socket$inet(0x10, 0x3, 0xc) sendmsg(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000000)="2400000002031f001cfffd946fa2830020200a000900010001e700000000a3a20404ff", 0x23}], 0x1}, 0x0) sendmsg(r0, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000180)="24000000030307031dfffd946ff20c0020200a0009000100021d85680c1baba20400ff7e", 0x24}], 0x1}, 0x0) 16:29:20 executing program 1: syz_emit_ethernet(0x3e, &(0x7f00000000c0)={@broadcast, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x1, 0x0, @remote={0xac, 0x70}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x2, {0x5, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @local}}}}}}, 0x0) 16:29:20 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf0") r1 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x1, 0xfeffff, &(0x7f0000000040)='t'}) 16:29:20 executing program 3: openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000340)={0x26, 'hash\x00', 0x0, 0x0, 'sha3-384\x00'}, 0x58) recvmmsg(0xffffffffffffffff, &(0x7f0000001bc0), 0xfe, 0x0, &(0x7f0000001d00)={0x77359400}) 16:29:20 executing program 4: r0 = socket$inet(0x10, 0x3, 0xc) sendmsg(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000000)="2400000002031f001cfffd946fa2830020200a000900010001e700000000a3a20404ff", 0x23}], 0x1}, 0x0) sendmsg(r0, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000180)="24000000030307031dfffd946ff20c0020200a0009000100021d85680c1baba20400ff7e", 0x24}], 0x1}, 0x0) 16:29:20 executing program 2: r0 = semget(0x3, 0x0, 0x0) semop(r0, &(0x7f0000000e40)=[{}], 0x1) 16:29:20 executing program 4: r0 = socket$inet(0x10, 0x3, 0xc) sendmsg(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000000)="2400000002031f001cfffd946fa2830020200a000900010001e700000000a3a20404ff", 0x23}], 0x1}, 0x0) sendmsg(r0, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000180)="24000000030307031dfffd946ff20c0020200a0009000100021d85680c1baba20400ff7e", 0x24}], 0x1}, 0x0) [ 226.837661][T10584] binder: 10582:10584 unknown command 0 [ 226.867491][T10584] binder: 10582:10584 ioctl c0306201 20000440 returned -22 16:29:20 executing program 2: syz_emit_ethernet(0x70, &(0x7f0000000080)={@local, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff84, 0x0, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd]}, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x2800]}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, 0x0) 16:29:20 executing program 3: openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000340)={0x26, 'hash\x00', 0x0, 0x0, 'sha3-384\x00'}, 0x58) recvmmsg(0xffffffffffffffff, &(0x7f0000001bc0), 0xfe, 0x0, &(0x7f0000001d00)={0x77359400}) 16:29:20 executing program 5: syz_open_dev$mice(&(0x7f0000000140)='/dev/input/mice\x00', 0x0, 0x80) r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vga_arbiter\x00', 0xb906b8ede7baf7e2, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000002a00)=[@in={0x2, 0x4e24, @loopback}, @in={0x2, 0x4e23, @remote}, @in={0x2, 0x4e22, @loopback}, @in={0x2, 0x4e20, @empty}, @in6={0xa, 0x4e23, 0x7, @rand_addr="1469538582cada4b421af83532620324", 0x7}], 0xffffffe8) r1 = syz_open_dev$vbi(&(0x7f0000000080)='/dev/vbi#\x00', 0x2, 0x2) ioctl$SNDRV_CTL_IOCTL_CARD_INFO(r1, 0x81785501, &(0x7f00000003c0)=""/84) r2 = getpid() socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$int_in(r3, 0x5452, &(0x7f00005ebff8)=0x3f) fcntl$setsig(r3, 0xa, 0x12) fcntl$setownex(r3, 0xf, &(0x7f0000000180)={0x2, r2}) recvmsg(r4, &(0x7f000095cfc8)={0x0, 0x0, 0x0}, 0x0) dup2(r3, r4) tkill(r2, 0x15) 16:29:20 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000080)) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, 0x0, 0x0) connect$inet(r1, &(0x7f0000000180)={0x2, 0x4e21}, 0x10) shutdown(0xffffffffffffffff, 0x0) fsetxattr$security_smack_entry(0xffffffffffffffff, 0x0, &(0x7f00000002c0)='eth1mime_typeppp1\xecFmd5sum^:\xf8\x00', 0x1d, 0x0) ioctl$KDSKBSENT(0xffffffffffffffff, 0x4b49, 0x0) r2 = memfd_create(&(0x7f0000000640)='\xd74fQ7', 0x0) r3 = socket(0x10, 0x3, 0x0) ioctl$sock_ifreq(r3, 0x89f0, &(0x7f0000000080)={'sit0\x00', @ifru_data=&(0x7f0000000000)="b06f31673d3da2b793d4f9a507e3c9133ba7ce8f5e6e538ecf8829b08f7f4aae"}) fcntl$setown(0xffffffffffffffff, 0x8, 0x0) execveat(r2, &(0x7f0000000500)='\x00', 0x0, 0x0, 0x1000) clone(0x80000000, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ptrace$setopts(0xffffffffffffffff, 0x0, 0x0, 0x0) syz_open_pts(r0, 0x0) ioctl$TIOCSSOFTCAR(r0, 0x5441, 0x0) 16:29:20 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf0") r1 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x1, 0xfeffff, &(0x7f0000000040)='t'}) 16:29:20 executing program 2: syz_emit_ethernet(0x32, &(0x7f00000000c0)={@local, @empty, [], {@ipv4={0x800, {{0x9, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x0, 0x0, @remote, @empty, {[@timestamp={0x44, 0x10, 0x6, 0x11, 0x0, [{}, {[@multicast1]}]}]}}}}}}, 0x0) 16:29:20 executing program 3: openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) r1 = accept4(r0, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000001bc0), 0xfe, 0x0, &(0x7f0000001d00)={0x77359400}) 16:29:20 executing program 4: r0 = socket$inet(0x10, 0x3, 0xc) sendmsg(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000000)="2400000002031f001cfffd946fa2830020200a000900010001e700000000a3a20404ff7e", 0x24}], 0x1}, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000180)="24000000030307031dfffd946ff20c0020200a0009000100021d85680c1baba20400ff7e", 0x24}], 0x1}, 0x0) 16:29:20 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x1, 0xfeffff, &(0x7f0000000040)='t'}) 16:29:20 executing program 2: syz_emit_ethernet(0x83, &(0x7f0000000340)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaaaa86dd601bfc97004d8800fe800000000000000000000000000000ff02000000000000000000000000000100004e20004d9078e29607149378d33e1db1c73936c77aa3f7fac33b042bd383000000531934ecb1c373d6ea51369e92fb96cc7c6fe4e24d1fcafff87429e50b32881721afab69cc3712c37ed0"], 0x0) [ 227.303181][T10615] binder: 10614:10615 unknown command 0 [ 227.316904][T10616] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. [ 227.325367][T10615] binder: 10614:10615 ioctl c0306201 20000440 returned -22 16:29:20 executing program 4: r0 = socket$inet(0x10, 0x3, 0xc) sendmsg(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000000)="2400000002031f001cfffd946fa2830020200a000900010001e700000000a3a20404ff7e", 0x24}], 0x1}, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000180)="24000000030307031dfffd946ff20c0020200a0009000100021d85680c1baba20400ff7e", 0x24}], 0x1}, 0x0) [ 227.398237][T10621] ERROR: Domain ' /sbin/init /etc/init.d/rc /sbin/startpar /etc/init.d/ssh /sbin/start-stop-daemon /usr/sbin/sshd /usr/sbin/sshd /bin/bash /root/syz-fuzzer /root/syz-executor.1 proc:/self/fd/6' not defined. 16:29:21 executing program 3: openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) r1 = accept4(r0, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000001bc0), 0xfe, 0x0, &(0x7f0000001d00)={0x77359400}) 16:29:21 executing program 5: syz_open_dev$mice(&(0x7f0000000140)='/dev/input/mice\x00', 0x0, 0x80) r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vga_arbiter\x00', 0xb906b8ede7baf7e2, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000002a00)=[@in={0x2, 0x4e24, @loopback}, @in={0x2, 0x4e23, @remote}, @in={0x2, 0x4e22, @loopback}, @in={0x2, 0x4e20, @empty}, @in6={0xa, 0x4e23, 0x7, @rand_addr="1469538582cada4b421af83532620324", 0x7}], 0xffffffe8) r1 = syz_open_dev$vbi(&(0x7f0000000080)='/dev/vbi#\x00', 0x2, 0x2) ioctl$SNDRV_CTL_IOCTL_CARD_INFO(r1, 0x81785501, &(0x7f00000003c0)=""/84) r2 = getpid() socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$int_in(r3, 0x5452, &(0x7f00005ebff8)=0x3f) fcntl$setsig(r3, 0xa, 0x12) fcntl$setownex(r3, 0xf, &(0x7f0000000180)={0x2, r2}) recvmsg(r4, &(0x7f000095cfc8)={0x0, 0x0, 0x0}, 0x0) dup2(r3, r4) tkill(r2, 0x15) 16:29:21 executing program 2: setuid(0xee01) semget(0x2, 0x0, 0x0) [ 227.522724][T10631] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. 16:29:21 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x1, 0xfeffff, &(0x7f0000000040)='t'}) 16:29:21 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000080)) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, 0x0, 0x0) connect$inet(r1, &(0x7f0000000180)={0x2, 0x4e21}, 0x10) shutdown(0xffffffffffffffff, 0x0) fsetxattr$security_smack_entry(0xffffffffffffffff, 0x0, &(0x7f00000002c0)='eth1mime_typeppp1\xecFmd5sum^:\xf8\x00', 0x1d, 0x0) ioctl$KDSKBSENT(0xffffffffffffffff, 0x4b49, 0x0) r2 = memfd_create(&(0x7f0000000640)='\xd74fQ7', 0x0) r3 = socket(0x10, 0x3, 0x0) ioctl$sock_ifreq(r3, 0x89f0, &(0x7f0000000080)={'sit0\x00', @ifru_data=&(0x7f0000000000)="b06f31673d3da2b793d4f9a507e3c9133ba7ce8f5e6e538ecf8829b08f7f4aae"}) fcntl$setown(0xffffffffffffffff, 0x8, 0x0) execveat(r2, &(0x7f0000000500)='\x00', 0x0, 0x0, 0x1000) clone(0x80000000, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ptrace$setopts(0xffffffffffffffff, 0x0, 0x0, 0x0) syz_open_pts(r0, 0x0) ioctl$TIOCSSOFTCAR(r0, 0x5441, 0x0) 16:29:21 executing program 3: openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) r1 = accept4(r0, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000001bc0), 0xfe, 0x0, &(0x7f0000001d00)={0x77359400}) 16:29:21 executing program 4: r0 = socket$inet(0x10, 0x3, 0xc) sendmsg(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000000)="2400000002031f001cfffd946fa2830020200a000900010001e700000000a3a20404ff7e", 0x24}], 0x1}, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000180)="24000000030307031dfffd946ff20c0020200a0009000100021d85680c1baba20400ff7e", 0x24}], 0x1}, 0x0) 16:29:21 executing program 5: syz_open_dev$mice(&(0x7f0000000140)='/dev/input/mice\x00', 0x0, 0x80) r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vga_arbiter\x00', 0xb906b8ede7baf7e2, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000002a00)=[@in={0x2, 0x4e24, @loopback}, @in={0x2, 0x4e23, @remote}, @in={0x2, 0x4e22, @loopback}, @in={0x2, 0x4e20, @empty}, @in6={0xa, 0x4e23, 0x7, @rand_addr="1469538582cada4b421af83532620324", 0x7}], 0xffffffe8) r1 = syz_open_dev$vbi(&(0x7f0000000080)='/dev/vbi#\x00', 0x2, 0x2) ioctl$SNDRV_CTL_IOCTL_CARD_INFO(r1, 0x81785501, &(0x7f00000003c0)=""/84) r2 = getpid() socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$int_in(r3, 0x5452, &(0x7f00005ebff8)=0x3f) fcntl$setsig(r3, 0xa, 0x12) fcntl$setownex(r3, 0xf, &(0x7f0000000180)={0x2, r2}) recvmsg(r4, &(0x7f000095cfc8)={0x0, 0x0, 0x0}, 0x0) dup2(r3, r4) tkill(r2, 0x15) 16:29:21 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x1, 0xfeffff, &(0x7f0000000040)='t'}) 16:29:21 executing program 2: r0 = msgget$private(0x0, 0x0) msgrcv(r0, 0x0, 0x0, 0x0, 0x1001) msgrcv(r0, &(0x7f00000012c0)=ANY=[@ANYBLOB="0200000000000000000000000000000000000000000000000000000000000000000000000000000000000007000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006b16ba4f9bf748f900000000cc193bb307c86100000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c73519053e107a83a2a967975d4f4d49052464893c3afc3530ca5a67cd7b719379a9261fbff0a2eb6c6fc8a4235187488e07bf2b"], 0x1, 0x0, 0x1000) msgsnd(r0, &(0x7f0000002940)={0x3, "15172acadae625b23dad4ce5b586a11b3eeca9a01cc9c80d4bc43024fdb290ff28503e9ecb9011b61ea3681af8b661518d72dc427e8b29df5230a5eea8addc9bcab9e7f4f85defa20e4e4e06a50cf0fbaff3b425adb1f4a8225a3306a55c216bcbe33dfaf531e52006b9793a02ea52ae609d35131767bfecf14e7031aa428e84a39fd3750266aae070133d8f8d23ec8af261e503a44f54b85bb8136284063ae2f8b749032ad3f64d43954979060a57a5dc9064698a715dcaaaa38d171b228ca7eb519e7ac4955cf574b4cd052428090bca38c0550d3d39027035667c27e368"}, 0xe7, 0x800) msgsnd(r0, &(0x7f00000028c0)=ANY=[@ANYPTR64=&(0x7f00000014c0)=ANY=[@ANYRES16, @ANYRESDEC=0x0], @ANYRESHEX, @ANYPTR64=&(0x7f0000002880)=ANY=[@ANYRESDEC, @ANYRES16], @ANYBLOB="c2ef85bcc198c99ba610efb95a80f6c0e3bd36e8c0c712d4cd8a61f850a43c8346b2250c5d580c15ecdd9536e0111ffcea20365b684b812240b4f7ebc9d2ffb80c3dafd09add7f6deab9b05188447762"], 0x4, 0x800) [ 228.217556][T10662] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. 16:29:21 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") r1 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x1, 0xfeffff, &(0x7f0000000040)='t'}) 16:29:21 executing program 3: openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000000340)={0x26, 'hash\x00', 0x0, 0x0, 'sha3-384\x00'}, 0x58) r0 = accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f0000001bc0), 0xfe, 0x0, &(0x7f0000001d00)={0x77359400}) 16:29:21 executing program 4: r0 = socket$inet(0x10, 0x3, 0xc) sendmsg(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000000)="2400000002031f001cfffd946fa2830020200a000900010001e700000000a3a20404ff7e", 0x24}], 0x1}, 0x0) sendmsg(r0, 0x0, 0x0) 16:29:22 executing program 5: syz_open_dev$mice(&(0x7f0000000140)='/dev/input/mice\x00', 0x0, 0x80) r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vga_arbiter\x00', 0xb906b8ede7baf7e2, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000002a00)=[@in={0x2, 0x4e24, @loopback}, @in={0x2, 0x4e23, @remote}, @in={0x2, 0x4e22, @loopback}, @in={0x2, 0x4e20, @empty}, @in6={0xa, 0x4e23, 0x7, @rand_addr="1469538582cada4b421af83532620324", 0x7}], 0xffffffe8) r1 = syz_open_dev$vbi(&(0x7f0000000080)='/dev/vbi#\x00', 0x2, 0x2) ioctl$SNDRV_CTL_IOCTL_CARD_INFO(r1, 0x81785501, &(0x7f00000003c0)=""/84) r2 = getpid() socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$int_in(r3, 0x5452, &(0x7f00005ebff8)=0x3f) fcntl$setsig(r3, 0xa, 0x12) fcntl$setownex(r3, 0xf, &(0x7f0000000180)={0x2, r2}) recvmsg(r4, &(0x7f000095cfc8)={0x0, 0x0, 0x0}, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) tkill(r2, 0x15) 16:29:22 executing program 2: r0 = socket$inet(0x10, 0x802, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000000)="24000000560007031dfffd946f610500070000001f000000fe000000421ba3a20400ff7e", 0x24}], 0x1}, 0x0) setsockopt$CAIFSO_REQ_PARAM(0xffffffffffffffff, 0x116, 0x80, &(0x7f00000001c0), 0x0) 16:29:22 executing program 3: openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000000340)={0x26, 'hash\x00', 0x0, 0x0, 'sha3-384\x00'}, 0x58) r0 = accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f0000001bc0), 0xfe, 0x0, &(0x7f0000001d00)={0x77359400}) [ 228.555319][T10787] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. 16:29:22 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000080)) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, 0x0, 0x0) connect$inet(r1, &(0x7f0000000180)={0x2, 0x4e21}, 0x10) shutdown(0xffffffffffffffff, 0x0) fsetxattr$security_smack_entry(0xffffffffffffffff, 0x0, &(0x7f00000002c0)='eth1mime_typeppp1\xecFmd5sum^:\xf8\x00', 0x1d, 0x0) ioctl$KDSKBSENT(0xffffffffffffffff, 0x4b49, 0x0) r2 = memfd_create(&(0x7f0000000640)='\xd74fQ7', 0x0) r3 = socket(0x10, 0x3, 0x0) ioctl$sock_ifreq(r3, 0x89f0, &(0x7f0000000080)={'sit0\x00', @ifru_data=&(0x7f0000000000)="b06f31673d3da2b793d4f9a507e3c9133ba7ce8f5e6e538ecf8829b08f7f4aae"}) fcntl$setown(0xffffffffffffffff, 0x8, 0x0) execveat(r2, &(0x7f0000000500)='\x00', 0x0, 0x0, 0x1000) clone(0x80000000, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ptrace$setopts(0xffffffffffffffff, 0x0, 0x0, 0x0) syz_open_pts(r0, 0x0) ioctl$TIOCSSOFTCAR(r0, 0x5441, 0x0) 16:29:22 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") r1 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x1, 0xfeffff, &(0x7f0000000040)='t'}) 16:29:22 executing program 4: r0 = socket$inet(0x10, 0x3, 0xc) sendmsg(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000000)="2400000002031f001cfffd946fa2830020200a000900010001e700000000a3a20404ff7e", 0x24}], 0x1}, 0x0) sendmsg(r0, 0x0, 0x0) 16:29:22 executing program 3: openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000000340)={0x26, 'hash\x00', 0x0, 0x0, 'sha3-384\x00'}, 0x58) r0 = accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f0000001bc0), 0xfe, 0x0, &(0x7f0000001d00)={0x77359400}) 16:29:22 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = syz_init_net_socket$rose(0xb, 0x5, 0x0) getsockopt$rose(r1, 0x104, 0x5, 0x0, &(0x7f0000000040)=0x2db) [ 228.804267][T10904] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. 16:29:22 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") r1 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x1, 0xfeffff, &(0x7f0000000040)='t'}) 16:29:22 executing program 4: r0 = socket$inet(0x10, 0x3, 0xc) sendmsg(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000000)="2400000002031f001cfffd946fa2830020200a000900010001e700000000a3a20404ff7e", 0x24}], 0x1}, 0x0) sendmsg(r0, 0x0, 0x0) 16:29:22 executing program 3: openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x0, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000340)={0x26, 'hash\x00', 0x0, 0x0, 'sha3-384\x00'}, 0x58) r1 = accept4(r0, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000001bc0), 0xfe, 0x0, &(0x7f0000001d00)={0x77359400}) [ 229.076817][T10942] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. 16:29:22 executing program 2: r0 = socket(0x40000000000a, 0x803, 0x2) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000004080)={'vxcan1\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)=@ipv6_newaddr={0x2c, 0x14, 0x90b, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_ADDRESS={0x14, 0x1, @mcast1}]}, 0x2c}}, 0x0) 16:29:25 executing program 5: syz_open_dev$mice(&(0x7f0000000140)='/dev/input/mice\x00', 0x0, 0x80) r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vga_arbiter\x00', 0xb906b8ede7baf7e2, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000002a00)=[@in={0x2, 0x4e24, @loopback}, @in={0x2, 0x4e23, @remote}, @in={0x2, 0x4e22, @loopback}, @in={0x2, 0x4e20, @empty}, @in6={0xa, 0x4e23, 0x7, @rand_addr="1469538582cada4b421af83532620324", 0x7}], 0xffffffe8) r1 = syz_open_dev$vbi(&(0x7f0000000080)='/dev/vbi#\x00', 0x2, 0x2) ioctl$SNDRV_CTL_IOCTL_CARD_INFO(r1, 0x81785501, &(0x7f00000003c0)=""/84) r2 = getpid() socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$int_in(r3, 0x5452, &(0x7f00005ebff8)=0x3f) fcntl$setsig(r3, 0xa, 0x12) fcntl$setownex(r3, 0xf, &(0x7f0000000180)={0x2, r2}) recvmsg(r4, &(0x7f000095cfc8)={0x0, 0x0, 0x0}, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) tkill(r2, 0x15) 16:29:25 executing program 4: r0 = socket$inet(0x10, 0x3, 0xc) sendmsg(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000000)="2400000002031f001cfffd946fa2830020200a000900010001e700000000a3a20404ff7e", 0x24}], 0x1}, 0x0) sendmsg(r0, &(0x7f0000011fc8)={0x0, 0x0, 0x0}, 0x0) 16:29:25 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") r1 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x1, 0xfeffff, &(0x7f0000000040)='t'}) 16:29:25 executing program 3: openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x0, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000340)={0x26, 'hash\x00', 0x0, 0x0, 'sha3-384\x00'}, 0x58) r1 = accept4(r0, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000001bc0), 0xfe, 0x0, &(0x7f0000001d00)={0x77359400}) 16:29:25 executing program 1: 16:29:25 executing program 2: 16:29:25 executing program 2: [ 231.638717][T11140] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. [ 231.655053][T11145] binder: 11138:11145 ioctl c0306201 0 returned -14 16:29:25 executing program 1: 16:29:25 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") r1 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000100)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x1, 0xfeffff, &(0x7f0000000040)='t'}) 16:29:25 executing program 4: r0 = socket$inet(0x10, 0x3, 0xc) sendmsg(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000000)="2400000002031f001cfffd946fa2830020200a000900010001e700000000a3a20404ff7e", 0x24}], 0x1}, 0x0) sendmsg(r0, &(0x7f0000011fc8)={0x0, 0x0, 0x0}, 0x0) 16:29:25 executing program 3: openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x0, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000340)={0x26, 'hash\x00', 0x0, 0x0, 'sha3-384\x00'}, 0x58) r1 = accept4(r0, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000001bc0), 0xfe, 0x0, &(0x7f0000001d00)={0x77359400}) 16:29:25 executing program 1: [ 231.898980][T11162] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. [ 231.951472][T11164] binder: 11159:11164 ioctl c0306201 0 returned -14 16:29:28 executing program 5: syz_open_dev$mice(&(0x7f0000000140)='/dev/input/mice\x00', 0x0, 0x80) r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vga_arbiter\x00', 0xb906b8ede7baf7e2, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000002a00)=[@in={0x2, 0x4e24, @loopback}, @in={0x2, 0x4e23, @remote}, @in={0x2, 0x4e22, @loopback}, @in={0x2, 0x4e20, @empty}, @in6={0xa, 0x4e23, 0x7, @rand_addr="1469538582cada4b421af83532620324", 0x7}], 0xffffffe8) r1 = syz_open_dev$vbi(&(0x7f0000000080)='/dev/vbi#\x00', 0x2, 0x2) ioctl$SNDRV_CTL_IOCTL_CARD_INFO(r1, 0x81785501, &(0x7f00000003c0)=""/84) r2 = getpid() socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$int_in(r3, 0x5452, &(0x7f00005ebff8)=0x3f) fcntl$setsig(r3, 0xa, 0x12) fcntl$setownex(r3, 0xf, &(0x7f0000000180)={0x2, r2}) recvmsg(r4, &(0x7f000095cfc8)={0x0, 0x0, 0x0}, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) tkill(r2, 0x15) 16:29:28 executing program 2: 16:29:28 executing program 3: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000340)={0x26, 'hash\x00', 0x0, 0x0, 'sha3-384\x00'}, 0x58) r1 = accept4(r0, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000001bc0), 0xfe, 0x0, &(0x7f0000001d00)={0x77359400}) 16:29:28 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") r1 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000100)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x1, 0xfeffff, &(0x7f0000000040)='t'}) 16:29:28 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, &(0x7f0000000040)) ioctl$KVM_SET_PIT(r1, 0x8048ae66, &(0x7f0000000080)={[{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}]}) 16:29:28 executing program 4: r0 = socket$inet(0x10, 0x3, 0xc) sendmsg(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000000)="2400000002031f001cfffd946fa2830020200a000900010001e700000000a3a20404ff7e", 0x24}], 0x1}, 0x0) sendmsg(r0, &(0x7f0000011fc8)={0x0, 0x0, 0x0}, 0x0) [ 234.799062][T11175] binder: 11174:11175 ioctl c0306201 0 returned -14 [ 234.807951][T11181] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 234.825476][T11180] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. 16:29:28 executing program 2: r0 = socket(0x10, 0x2, 0x0) sendto(r0, &(0x7f0000000140)="120000001200e7ef007b1a3fcd00000000a1", 0x3a, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xc, &(0x7f0000000380)=[{&(0x7f0000000040)=""/95, 0x3d}, {&(0x7f00000000c0)=""/85, 0x4c8}, {&(0x7f00000024c0)=""/4096, 0x1038}, {&(0x7f0000000400)=""/120, 0x78}, {&(0x7f0000000480)=""/60, 0xc6}, {&(0x7f0000000280)=""/77, 0x4d}, {&(0x7f0000000540)=""/154, 0x9a}, {&(0x7f0000000340)=""/22, 0x1de}], 0x348, &(0x7f0000002400)=""/191, 0x1f9}, 0xc00}], 0x4000000000001de, 0x6, &(0x7f0000003700)={0x77359400}) 16:29:28 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") r1 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000100)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x1, 0xfeffff, &(0x7f0000000040)='t'}) 16:29:28 executing program 4: r0 = socket$inet(0x10, 0x3, 0xc) sendmsg(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000000)="2400000002031f001cfffd946fa2830020200a000900010001e700000000a3a20404ff7e", 0x24}], 0x1}, 0x0) sendmsg(r0, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f0000000200)}, 0x0) 16:29:28 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20}, 0x1c) recvmmsg(r0, &(0x7f0000009900)=[{{&(0x7f0000000000)=@xdp, 0x80, 0x0}}], 0x1, 0x0, 0x0) ioctl$SIOCGSTAMP(r0, 0x8906, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f0000000300)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) 16:29:28 executing program 3: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000340)={0x26, 'hash\x00', 0x0, 0x0, 'sha3-384\x00'}, 0x58) r1 = accept4(r0, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000001bc0), 0xfe, 0x0, &(0x7f0000001d00)={0x77359400}) [ 235.092104][T11194] binder: 11190:11194 ioctl c0306201 0 returned -14 16:29:28 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") r1 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) [ 235.165038][T11244] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. [ 235.222223][T11292] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. [ 235.280384][T11305] binder: 11304:11305 ioctl c0306201 0 returned -14 [ 235.320304][T11305] binder: 11304:11305 ioctl c0306201 0 returned -14 16:29:31 executing program 5: syz_open_dev$mice(&(0x7f0000000140)='/dev/input/mice\x00', 0x0, 0x80) r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vga_arbiter\x00', 0xb906b8ede7baf7e2, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000002a00)=[@in={0x2, 0x4e24, @loopback}, @in={0x2, 0x4e23, @remote}, @in={0x2, 0x4e22, @loopback}, @in={0x2, 0x4e20, @empty}, @in6={0xa, 0x4e23, 0x7, @rand_addr="1469538582cada4b421af83532620324", 0x7}], 0xffffffe8) r1 = syz_open_dev$vbi(&(0x7f0000000080)='/dev/vbi#\x00', 0x2, 0x2) ioctl$SNDRV_CTL_IOCTL_CARD_INFO(r1, 0x81785501, &(0x7f00000003c0)=""/84) r2 = getpid() socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$int_in(r3, 0x5452, &(0x7f00005ebff8)=0x3f) fcntl$setsig(r3, 0xa, 0x12) recvmsg(r4, &(0x7f000095cfc8)={0x0, 0x0, 0x0}, 0x0) dup2(r3, r4) clone(0x0, 0x0, 0x0, 0x0, 0x0) tkill(r2, 0x15) 16:29:31 executing program 2: r0 = socket(0x10, 0x2, 0x0) sendto(r0, &(0x7f0000000140)="120000001200e7ef007b1a3fcd00000000a1", 0x3a, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0x23, &(0x7f0000000380)=[{&(0x7f0000000040)=""/95, 0x3d}, {&(0x7f00000000c0)=""/85, 0x4c8}, {&(0x7f00000024c0)=""/4096, 0x1008}, {&(0x7f0000000400)=""/120, 0x78}, {&(0x7f0000000480)=""/60, 0xc6}, {&(0x7f0000000280)=""/77, 0x4d}, {&(0x7f0000000540)=""/154, 0x9a}, {&(0x7f0000000340)=""/22, 0x1de}], 0x348, &(0x7f0000002400)=""/191, 0x1f9}, 0x12c}], 0x4000000000001de, 0x6, &(0x7f0000003700)={0x77359400}) 16:29:31 executing program 4: r0 = socket$inet(0x10, 0x3, 0xc) sendmsg(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000000)="2400000002031f001cfffd946fa2830020200a000900010001e700000000a3a20404ff7e", 0x24}], 0x1}, 0x0) sendmsg(r0, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f0000000200)}, 0x0) 16:29:31 executing program 3: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000340)={0x26, 'hash\x00', 0x0, 0x0, 'sha3-384\x00'}, 0x58) r1 = accept4(r0, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000001bc0), 0xfe, 0x0, &(0x7f0000001d00)={0x77359400}) 16:29:31 executing program 1: r0 = socket$inet_sctp(0x2, 0x1, 0x84) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg$inet_sctp(r0, &(0x7f0000000300)={&(0x7f0000000180)=@in={0x2, 0x0, @local}, 0x10, &(0x7f00000001c0)=[{&(0x7f0000000240)="8c", 0x1}], 0x1, &(0x7f0000000700)=ANY=[@ANYBLOB="180000000000000084000000080000000800ffff", @ANYRES32], 0x18}, 0x0) 16:29:31 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") r1 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) 16:29:31 executing program 1: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) syz_open_dev$vbi(&(0x7f0000000240)='/dev/vbi#\x00', 0x3, 0x2) getsockopt$inet_sctp_SCTP_GET_PEER_ADDRS(0xffffffffffffffff, 0x84, 0x6c, &(0x7f00000005c0)=ANY=[@ANYBLOB], 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x130) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = msgget$private(0x0, 0x10) msgctl$MSG_INFO(r2, 0xc, &(0x7f0000000480)=""/44) fsetxattr$trusted_overlay_opaque(0xffffffffffffffff, &(0x7f0000000200)='trusted.overlay.opaque\x00', &(0x7f0000000440)='y\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r0, 0xc0045516, &(0x7f0000000780)=0xffffffffffffff83) io_setup(0x5, &(0x7f0000000580)=0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000740)) prctl$PR_SET_CHILD_SUBREAPER(0x24, 0x0) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000100)={0x100, 0x9, 0x3, 0x9, 0x4}, 0x14) setsockopt$inet_group_source_req(r0, 0x0, 0x2e, &(0x7f0000000300)={0x0, {{0x2, 0x0, @empty}}, {{0x2, 0x4e21, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, 0x108) setxattr$trusted_overlay_redirect(&(0x7f0000000500)='./file0\x00', &(0x7f0000000800)='trusted.overlay.redirect\x00', &(0x7f0000000840)='./file0\x00', 0x8, 0x1) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x80000000000000, 0x1, 0x0, r1, &(0x7f0000000000), 0x377140be6b5ef4c7, 0xe0000}]) 16:29:31 executing program 3: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000340)={0x26, 'hash\x00', 0x0, 0x0, 'sha3-384\x00'}, 0x58) r1 = accept4(r0, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000001bc0), 0xfe, 0x0, &(0x7f0000001d00)={0x77359400}) [ 238.009290][T11321] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. [ 238.024119][T11323] binder: 11315:11323 ioctl c0306201 0 returned -14 [ 238.047851][T11323] binder: 11315:11323 ioctl c0306201 0 returned -14 16:29:31 executing program 2: io_setup(0x0, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) r1 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000380)='/proc/capi/capi20ncci\x00', 0x84102, 0x0) ioctl$MON_IOCH_MFLUSH(r1, 0x9208, 0xfff) unshare(0x2040400) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x2239, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000180)='TIPCv2\x00') sendmsg$TIPC_NL_NAME_TABLE_GET(r0, &(0x7f0000000340)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x30001211}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)={0x74, r2, 0x100, 0x70bd28, 0x25dfdbfe, {}, [@TIPC_NLA_SOCK={0x28, 0x2, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0xfff}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x6}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_REF={0x8}]}, @TIPC_NLA_NET={0x38, 0x7, [@TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x8}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x800}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0xffff}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x7fff}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x100}]}]}, 0x74}, 0x1, 0x0, 0x0, 0x10}, 0x40) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x8000, 0x0) ioctl$KVM_TPR_ACCESS_REPORTING(0xffffffffffffffff, 0xc028ae92, &(0x7f00000001c0)={0x100000001, 0xed}) r3 = msgget$private(0x0, 0x0) msgctl$IPC_STAT(r3, 0x2, 0x0) ioctl$KVM_ARM_SET_DEVICE_ADDR(0xffffffffffffffff, 0x4010aeab, &(0x7f0000000080)={0x0, 0x5002}) getpeername$packet(0xffffffffffffffff, 0x0, &(0x7f0000000200)) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) openat$urandom(0xffffffffffffff9c, &(0x7f0000000140)='/dev/urandom\x00', 0x0, 0x0) r5 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000)='/dev/hwrng\x00', 0x40, 0x0) ioctl$VIDIOC_S_FREQUENCY(r5, 0x402c5639, 0x0) ioctl$sock_ifreq(r4, 0x8990, &(0x7f0000000240)={'bond0\x00\xe1\x03\n\x00!!\x00\x01\x00', @ifru_names='bond_slave_1\x00\x00\x00\b'}) 16:29:31 executing program 4: r0 = socket$inet(0x10, 0x3, 0xc) sendmsg(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000000)="2400000002031f001cfffd946fa2830020200a000900010001e700000000a3a20404ff7e", 0x24}], 0x1}, 0x0) sendmsg(r0, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f0000000200)}, 0x0) 16:29:31 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") r1 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) [ 238.350187][T11447] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. [ 238.373324][T11448] binder: 11446:11448 ioctl c0306201 0 returned -14 16:29:31 executing program 3: perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000340)={0x26, 'hash\x00', 0x0, 0x0, 'sha3-384\x00'}, 0x58) r1 = accept4(r0, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000001bc0), 0xfe, 0x0, &(0x7f0000001d00)={0x77359400}) [ 238.402728][T11448] binder: 11446:11448 ioctl c0306201 0 returned -14 16:29:34 executing program 5: syz_open_dev$mice(&(0x7f0000000140)='/dev/input/mice\x00', 0x0, 0x80) r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vga_arbiter\x00', 0xb906b8ede7baf7e2, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000002a00)=[@in={0x2, 0x4e24, @loopback}, @in={0x2, 0x4e23, @remote}, @in={0x2, 0x4e22, @loopback}, @in={0x2, 0x4e20, @empty}, @in6={0xa, 0x4e23, 0x7, @rand_addr="1469538582cada4b421af83532620324", 0x7}], 0xffffffe8) r1 = syz_open_dev$vbi(&(0x7f0000000080)='/dev/vbi#\x00', 0x2, 0x2) ioctl$SNDRV_CTL_IOCTL_CARD_INFO(r1, 0x81785501, &(0x7f00000003c0)=""/84) r2 = getpid() socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$int_in(r3, 0x5452, &(0x7f00005ebff8)=0x3f) fcntl$setsig(r3, 0xa, 0x12) recvmsg(r4, &(0x7f000095cfc8)={0x0, 0x0, 0x0}, 0x0) dup2(r3, r4) clone(0x0, 0x0, 0x0, 0x0, 0x0) tkill(r2, 0x15) 16:29:34 executing program 4: r0 = socket$inet(0x10, 0x3, 0xc) sendmsg(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000000)="2400000002031f001cfffd946fa2830020200a000900010001e700000000a3a20404ff7e", 0x24}], 0x1}, 0x0) sendmsg(r0, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f0000000200)=[{0x0}], 0x1}, 0x0) 16:29:34 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") r1 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0xfeffff, &(0x7f0000000040)='t'}) 16:29:34 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000180)={@initdev={0xfe, 0x88, [], 0x0, 0x0}}, &(0x7f0000000240)=0x20) 16:29:34 executing program 3: perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000340)={0x26, 'hash\x00', 0x0, 0x0, 'sha3-384\x00'}, 0x58) r1 = accept4(r0, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000001bc0), 0xfe, 0x0, &(0x7f0000001d00)={0x77359400}) 16:29:34 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_inet_SIOCSARP(r0, 0x8955, &(0x7f00000002c0)={{}, {0x0, @link_local}, 0x8, {0x2, 0x0, @local}, 'bpq0\x00'}) getsockopt$inet_mreq(r0, 0x0, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x365f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$sock_inet_SIOCDARP(r0, 0x8953, &(0x7f0000006000)={{}, {0x0, @remote}, 0x9, {0x2, 0x0, @multicast2}, 'ip6tnl0\x00'}) [ 241.136987][T11568] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. [ 241.138353][T11570] binder: 11565:11570 ioctl c0306201 0 returned -14 16:29:34 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_inet_SIOCSARP(r0, 0x8955, &(0x7f00000002c0)={{}, {0x0, @link_local}, 0x8, {0x2, 0x0, @local}, 'bpq0\x00'}) getsockopt$inet_mreq(r0, 0x0, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x365f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$sock_inet_SIOCDARP(r0, 0x8953, &(0x7f0000006000)={{}, {0x0, @remote}, 0x9, {0x2, 0x0, @multicast2}, 'ip6tnl0\x00'}) 16:29:34 executing program 2: r0 = socket$inet(0x2, 0x6000000000000003, 0x6) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040)='sit0\x00', 0x10) sendto$inet(r0, 0x0, 0x0, 0x404c0c0, &(0x7f00000000c0)={0x2, 0x0, @multicast1}, 0x10) 16:29:34 executing program 4: r0 = socket$inet(0x10, 0x3, 0xc) sendmsg(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000000)="2400000002031f001cfffd946fa2830020200a000900010001e700000000a3a20404ff7e", 0x24}], 0x1}, 0x0) sendmsg(r0, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f0000000200)=[{0x0}], 0x1}, 0x0) 16:29:34 executing program 3: perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000340)={0x26, 'hash\x00', 0x0, 0x0, 'sha3-384\x00'}, 0x58) r1 = accept4(r0, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000001bc0), 0xfe, 0x0, &(0x7f0000001d00)={0x77359400}) [ 241.401939][T11614] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. 16:29:35 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_inet_SIOCSARP(r0, 0x8955, &(0x7f00000002c0)={{}, {0x0, @link_local}, 0x8, {0x2, 0x0, @local}, 'bpq0\x00'}) getsockopt$inet_mreq(r0, 0x0, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x365f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$sock_inet_SIOCDARP(r0, 0x8953, &(0x7f0000006000)={{}, {0x0, @remote}, 0x9, {0x2, 0x0, @multicast2}, 'ip6tnl0\x00'}) 16:29:35 executing program 4: r0 = socket$inet(0x10, 0x3, 0xc) sendmsg(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000000)="2400000002031f001cfffd946fa2830020200a000900010001e700000000a3a20404ff7e", 0x24}], 0x1}, 0x0) sendmsg(r0, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f0000000200)=[{0x0}], 0x1}, 0x0) [ 241.588086][T11698] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. 16:29:37 executing program 5: syz_open_dev$mice(&(0x7f0000000140)='/dev/input/mice\x00', 0x0, 0x80) r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vga_arbiter\x00', 0xb906b8ede7baf7e2, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000002a00)=[@in={0x2, 0x4e24, @loopback}, @in={0x2, 0x4e23, @remote}, @in={0x2, 0x4e22, @loopback}, @in={0x2, 0x4e20, @empty}, @in6={0xa, 0x4e23, 0x7, @rand_addr="1469538582cada4b421af83532620324", 0x7}], 0xffffffe8) r1 = syz_open_dev$vbi(&(0x7f0000000080)='/dev/vbi#\x00', 0x2, 0x2) ioctl$SNDRV_CTL_IOCTL_CARD_INFO(r1, 0x81785501, &(0x7f00000003c0)=""/84) r2 = getpid() socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$int_in(r3, 0x5452, &(0x7f00005ebff8)=0x3f) fcntl$setsig(r3, 0xa, 0x12) recvmsg(r4, &(0x7f000095cfc8)={0x0, 0x0, 0x0}, 0x0) dup2(r3, r4) clone(0x0, 0x0, 0x0, 0x0, 0x0) tkill(r2, 0x15) 16:29:37 executing program 3: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000340)={0x26, 'hash\x00', 0x0, 0x0, 'sha3-384\x00'}, 0x58) r1 = accept4(r0, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000001bc0), 0xfe, 0x0, &(0x7f0000001d00)={0x77359400}) 16:29:37 executing program 2: bind$alg(0xffffffffffffffff, &(0x7f0000000400)={0x26, 'hash\x00', 0x0, 0x0, 'sha1-ssse3\x00'}, 0x58) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dmmidi(&(0x7f0000000080)='/dev/dmmidi#\x00', 0xfe5, 0xc5353d90f4c2ff1c) ioctl$VT_ACTIVATE(r0, 0x5606, 0x6) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000002b80)=[{{0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000180)=""/255, 0xff}], 0x1}}, {{0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0) r2 = openat$cgroup_subtree(r1, &(0x7f0000000040)='cgroup.subtree_control\x00', 0x2, 0x0) writev(r2, &(0x7f00000000c0), 0x20000000000002dd) getsockopt$inet_sctp_SCTP_GET_ASSOC_NUMBER(r0, 0x84, 0x1c, &(0x7f00000000c0), &(0x7f0000000140)=0x4) 16:29:37 executing program 1: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000100)='/dev/loop-control\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) close(r0) openat$vimc1(0xffffffffffffff9c, &(0x7f0000000000)='/dev/video1\x00', 0x2, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x32e) 16:29:37 executing program 4: r0 = socket$inet(0x10, 0x3, 0xc) sendmsg(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000000)="2400000002031f001cfffd946fa2830020200a000900010001e700000000a3a20404ff7e", 0x24}], 0x1}, 0x0) sendmsg(r0, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000180)}], 0x1}, 0x0) 16:29:37 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") r1 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0xfeffff, &(0x7f0000000040)='t'}) [ 244.294885][T11709] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. [ 244.316455][T11711] binder: 11703:11711 ioctl c0306201 0 returned -14 16:29:37 executing program 3: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000340)={0x26, 'hash\x00', 0x0, 0x0, 'sha3-384\x00'}, 0x58) r1 = accept4(r0, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000001bc0), 0xfe, 0x0, &(0x7f0000001d00)={0x77359400}) 16:29:37 executing program 4: r0 = socket$inet(0x10, 0x3, 0xc) sendmsg(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000000)="2400000002031f001cfffd946fa2830020200a000900010001e700000000a3a20404ff7e", 0x24}], 0x1}, 0x0) sendmsg(r0, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000180)}], 0x1}, 0x0) 16:29:38 executing program 1: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000100)='/dev/loop-control\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) close(r0) openat$vimc1(0xffffffffffffff9c, &(0x7f0000000000)='/dev/video1\x00', 0x2, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x32e) 16:29:38 executing program 2: socketpair$unix(0x1, 0x100000000001, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r2, 0x0, 0x8ec0, 0x0) write$FUSE_CREATE_OPEN(r2, &(0x7f0000000380)={0xa0, 0x0, 0x0, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x1f, 0x0, 0x0, 0x4}}}}, 0xa0) fcntl$setpipe(r2, 0x407, 0x0) write$FUSE_NOTIFY_POLL(r2, &(0x7f0000000080)={0x18}, 0x18) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000340)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) close(r1) [ 244.494897][T11821] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. 16:29:38 executing program 4: r0 = socket$inet(0x10, 0x3, 0xc) sendmsg(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000000)="2400000002031f001cfffd946fa2830020200a000900010001e700000000a3a20404ff7e", 0x24}], 0x1}, 0x0) sendmsg(r0, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000180)}], 0x1}, 0x0) 16:29:38 executing program 3: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000340)={0x26, 'hash\x00', 0x0, 0x0, 'sha3-384\x00'}, 0x58) r1 = accept4(r0, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000001bc0), 0xfe, 0x0, &(0x7f0000001d00)={0x77359400}) [ 244.695917][T11832] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. 16:29:40 executing program 5: syz_open_dev$mice(&(0x7f0000000140)='/dev/input/mice\x00', 0x0, 0x80) r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vga_arbiter\x00', 0xb906b8ede7baf7e2, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000002a00)=[@in={0x2, 0x4e24, @loopback}, @in={0x2, 0x4e23, @remote}, @in={0x2, 0x4e22, @loopback}, @in={0x2, 0x4e20, @empty}, @in6={0xa, 0x4e23, 0x7, @rand_addr="1469538582cada4b421af83532620324", 0x7}], 0xffffffe8) r1 = syz_open_dev$vbi(&(0x7f0000000080)='/dev/vbi#\x00', 0x2, 0x2) ioctl$SNDRV_CTL_IOCTL_CARD_INFO(r1, 0x81785501, &(0x7f00000003c0)=""/84) r2 = getpid() socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$int_in(r3, 0x5452, &(0x7f00005ebff8)=0x3f) fcntl$setownex(r3, 0xf, &(0x7f0000000180)={0x2, r2}) recvmsg(r4, &(0x7f000095cfc8)={0x0, 0x0, 0x0}, 0x0) dup2(r3, r4) clone(0x0, 0x0, 0x0, 0x0, 0x0) tkill(r2, 0x15) 16:29:40 executing program 4: r0 = socket$inet(0x10, 0x3, 0xc) sendmsg(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000000)="2400000002031f001cfffd946fa2830020200a000900010001e700000000a3a20404ff7e", 0x24}], 0x1}, 0x0) sendmsg(r0, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000180)="24000000030307031dfffd946ff20c002020", 0x12}], 0x1}, 0x0) 16:29:40 executing program 3: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000340)={0x26, 'hash\x00', 0x0, 0x0, 'sha3-384\x00'}, 0x58) r1 = accept4(r0, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000001bc0), 0xfe, 0x0, &(0x7f0000001d00)={0x77359400}) 16:29:40 executing program 1: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000100)='/dev/loop-control\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) close(r0) openat$vimc1(0xffffffffffffff9c, &(0x7f0000000000)='/dev/video1\x00', 0x2, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x32e) 16:29:40 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000240)='net/ptype\x00') preadv(r0, &(0x7f0000000340)=[{&(0x7f0000000080)=""/23, 0x17}, {&(0x7f00000000c0)=""/142, 0x8e}], 0x2, 0xb) 16:29:40 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") r1 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0xfeffff, &(0x7f0000000040)='t'}) [ 247.433148][T11946] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. [ 247.478719][T11947] binder: 11943:11947 ioctl c0306201 0 returned -14 16:29:41 executing program 2: socketpair$unix(0x1, 0x100000000001, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r2, 0x0, 0x8ec0, 0x0) fcntl$setpipe(r2, 0x407, 0x0) write$FUSE_NOTIFY_POLL(r2, &(0x7f0000000080)={0x18}, 0x18) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000340)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) close(r1) 16:29:41 executing program 4: r0 = socket$inet(0x10, 0x3, 0xc) sendmsg(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000000)="2400000002031f001cfffd946fa2830020200a000900010001e700000000a3a20404ff7e", 0x24}], 0x1}, 0x0) sendmsg(r0, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000180)="24000000030307031dfffd946ff20c002020", 0x12}], 0x1}, 0x0) 16:29:41 executing program 1: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000100)='/dev/loop-control\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) close(r0) openat$vimc1(0xffffffffffffff9c, &(0x7f0000000000)='/dev/video1\x00', 0x2, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x32e) [ 247.653030][T11960] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. 16:29:41 executing program 3: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000340)={0x26, 'hash\x00', 0x0, 0x0, 'sha3-384\x00'}, 0x58) r1 = accept4(r0, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000001bc0), 0xfe, 0x0, &(0x7f0000001d00)={0x77359400}) 16:29:41 executing program 4: r0 = socket$inet(0x10, 0x3, 0xc) sendmsg(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000000)="2400000002031f001cfffd946fa2830020200a000900010001e700000000a3a20404ff7e", 0x24}], 0x1}, 0x0) sendmsg(r0, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000180)="24000000030307031dfffd946ff20c002020", 0x12}], 0x1}, 0x0) 16:29:41 executing program 5: syz_open_dev$mice(&(0x7f0000000140)='/dev/input/mice\x00', 0x0, 0x80) r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vga_arbiter\x00', 0xb906b8ede7baf7e2, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000002a00)=[@in={0x2, 0x4e24, @loopback}, @in={0x2, 0x4e23, @remote}, @in={0x2, 0x4e22, @loopback}, @in={0x2, 0x4e20, @empty}, @in6={0xa, 0x4e23, 0x7, @rand_addr="1469538582cada4b421af83532620324", 0x7}], 0xffffffe8) r1 = syz_open_dev$vbi(&(0x7f0000000080)='/dev/vbi#\x00', 0x2, 0x2) ioctl$SNDRV_CTL_IOCTL_CARD_INFO(r1, 0x81785501, &(0x7f00000003c0)=""/84) r2 = getpid() socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$int_in(r3, 0x5452, &(0x7f00005ebff8)=0x3f) fcntl$setownex(r3, 0xf, &(0x7f0000000180)={0x2, r2}) recvmsg(r4, &(0x7f000095cfc8)={0x0, 0x0, 0x0}, 0x0) dup2(r3, r4) clone(0x0, 0x0, 0x0, 0x0, 0x0) tkill(r2, 0x15) 16:29:41 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x0) r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x0, 0x0) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0xfffffffffffffffe) r1 = syz_open_dev$loop(&(0x7f0000000140)='/dev/loop#\x00', 0x0, 0x182) ioctl$ASHMEM_SET_PROT_MASK(r0, 0x40087705, &(0x7f00000007c0)) openat$proc_capi20(0xffffffffffffff9c, &(0x7f00000004c0)='/proc/capi/capi20\x00', 0x121101, 0x0) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, &(0x7f0000000800)=ANY=[@ANYRES32=0x0, @ANYRES32=0x0], 0x0) r2 = memfd_create(&(0x7f0000000380)='iC;`\xb6p+\x10', 0x0) clock_getres(0x6, 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000040)='\'', 0x1}], 0x1, 0x81805) ioctl$LOOP_CHANGE_FD(r1, 0x4c00, r2) syz_genetlink_get_family_id$team(&(0x7f0000000080)='team\x00') rt_sigprocmask(0x2, &(0x7f0000000240)={0x9}, &(0x7f00000002c0), 0x8) write$P9_RLCREATE(r0, 0x0, 0x0) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000100)={@loopback}, &(0x7f0000000280)=0x14) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000780)={0x0, @broadcast, @initdev}, &(0x7f0000000300)=0xc) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r0, 0x0, 0x0) openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/qat_adf_ctl\x00', 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x173, 0xfa00, {0x0, &(0x7f0000000400), 0x2}}, 0x20) ioctl$BLKREPORTZONE(r2, 0xc0101282, 0x0) add_key$user(&(0x7f00000001c0)='user\x00', &(0x7f0000000480)={'syz', 0x3}, &(0x7f00000006c0), 0x0, 0xfffffffffffffff9) sendfile(r1, r1, 0x0, 0x2000005) ioctl$LOOP_CLR_FD(r1, 0x4c01) 16:29:41 executing program 1: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000100)='/dev/loop-control\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) close(r0) openat$vimc1(0xffffffffffffff9c, &(0x7f0000000000)='/dev/video1\x00', 0x2, 0x0) syz_kvm_setup_cpu$x86(r0, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x32e) [ 247.920179][T12077] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. 16:29:41 executing program 4: r0 = socket$inet(0x10, 0x3, 0xc) sendmsg(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000000)="2400000002031f001cfffd946fa2830020200a000900010001e700000000a3a20404ff7e", 0x24}], 0x1}, 0x0) sendmsg(r0, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000180)="24000000030307031dfffd946ff20c0020200a0009000100021d85", 0x1b}], 0x1}, 0x0) 16:29:41 executing program 5: syz_open_dev$mice(&(0x7f0000000140)='/dev/input/mice\x00', 0x0, 0x80) r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vga_arbiter\x00', 0xb906b8ede7baf7e2, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000002a00)=[@in={0x2, 0x4e24, @loopback}, @in={0x2, 0x4e23, @remote}, @in={0x2, 0x4e22, @loopback}, @in={0x2, 0x4e20, @empty}, @in6={0xa, 0x4e23, 0x7, @rand_addr="1469538582cada4b421af83532620324", 0x7}], 0xffffffe8) r1 = syz_open_dev$vbi(&(0x7f0000000080)='/dev/vbi#\x00', 0x2, 0x2) ioctl$SNDRV_CTL_IOCTL_CARD_INFO(r1, 0x81785501, &(0x7f00000003c0)=""/84) r2 = getpid() socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$int_in(r3, 0x5452, &(0x7f00005ebff8)=0x3f) fcntl$setownex(r3, 0xf, &(0x7f0000000180)={0x2, r2}) recvmsg(r4, &(0x7f000095cfc8)={0x0, 0x0, 0x0}, 0x0) dup2(r3, r4) clone(0x0, 0x0, 0x0, 0x0, 0x0) tkill(r2, 0x15) 16:29:41 executing program 1: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000100)='/dev/loop-control\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) close(r0) openat$vimc1(0xffffffffffffff9c, &(0x7f0000000000)='/dev/video1\x00', 0x2, 0x0) syz_kvm_setup_cpu$x86(r0, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x32e) [ 248.157835][T12125] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. 16:29:41 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") r1 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000380), 0x1, 0xfeffff, &(0x7f0000000040)='t'}) 16:29:41 executing program 3: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000340)={0x26, 'hash\x00', 0x0, 0x0, 'sha3-384\x00'}, 0x58) r1 = accept4(r0, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000001bc0), 0xfe, 0x0, &(0x7f0000001d00)={0x77359400}) 16:29:41 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket(0x10, 0x2, 0x0) sendto(r1, &(0x7f0000000140)="120000001200e7ef007b1a3fcd00000000a1", 0x3a, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0x23, &(0x7f0000000380)=[{&(0x7f0000000040)=""/95, 0x3d}, {&(0x7f00000000c0)=""/85, 0x4c8}, {&(0x7f00000024c0)=""/4096, 0x1008}, {&(0x7f0000000400)=""/120, 0x78}, {&(0x7f0000000480)=""/60, 0xc6}, {&(0x7f0000000280)=""/77, 0x4d}, {&(0x7f0000000540)=""/154, 0x9a}, {&(0x7f0000000340)=""/22, 0x1de}], 0x348, &(0x7f0000002400)=""/191, 0x1f9}}], 0x4000000000001de, 0x6, &(0x7f0000003700)={0x77359400}) 16:29:41 executing program 4: r0 = socket$inet(0x10, 0x3, 0xc) sendmsg(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000000)="2400000002031f001cfffd946fa2830020200a000900010001e700000000a3a20404ff7e", 0x24}], 0x1}, 0x0) sendmsg(r0, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000180)="24000000030307031dfffd946ff20c0020200a0009000100021d85", 0x1b}], 0x1}, 0x0) 16:29:42 executing program 1: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000100)='/dev/loop-control\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) close(r0) openat$vimc1(0xffffffffffffff9c, &(0x7f0000000000)='/dev/video1\x00', 0x2, 0x0) syz_kvm_setup_cpu$x86(r0, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x32e) [ 248.460031][T12202] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. [ 248.499239][T12207] binder: 12199:12207 ioctl c0306201 0 returned -14 16:29:42 executing program 5: syz_open_dev$mice(&(0x7f0000000140)='/dev/input/mice\x00', 0x0, 0x80) r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vga_arbiter\x00', 0xb906b8ede7baf7e2, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000002a00)=[@in={0x2, 0x4e24, @loopback}, @in={0x2, 0x4e23, @remote}, @in={0x2, 0x4e22, @loopback}, @in={0x2, 0x4e20, @empty}, @in6={0xa, 0x4e23, 0x7, @rand_addr="1469538582cada4b421af83532620324", 0x7}], 0xffffffe8) r1 = syz_open_dev$vbi(&(0x7f0000000080)='/dev/vbi#\x00', 0x2, 0x2) ioctl$SNDRV_CTL_IOCTL_CARD_INFO(r1, 0x81785501, &(0x7f00000003c0)=""/84) r2 = getpid() socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setsig(r3, 0xa, 0x12) fcntl$setownex(r3, 0xf, &(0x7f0000000180)={0x2, r2}) recvmsg(r4, &(0x7f000095cfc8)={0x0, 0x0, 0x0}, 0x0) dup2(r3, r4) clone(0x0, 0x0, 0x0, 0x0, 0x0) tkill(r2, 0x15) 16:29:42 executing program 3: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000000340)={0x26, 'hash\x00', 0x0, 0x0, 'sha3-384\x00'}, 0x58) r1 = accept4(r0, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000001bc0), 0xfe, 0x0, &(0x7f0000001d00)={0x77359400}) 16:29:42 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") r1 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000380), 0x1, 0xfeffff, &(0x7f0000000040)='t'}) 16:29:42 executing program 4: r0 = socket$inet(0x10, 0x3, 0xc) sendmsg(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000000)="2400000002031f001cfffd946fa2830020200a000900010001e700000000a3a20404ff7e", 0x24}], 0x1}, 0x0) sendmsg(r0, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000180)="24000000030307031dfffd946ff20c0020200a0009000100021d85", 0x1b}], 0x1}, 0x0) 16:29:42 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getdents64(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_inet_udp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x2, 0x0) write$uinput_user_dev(r0, &(0x7f0000000400)={'syz1\x00'}, 0x45c) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) sendmmsg(0xffffffffffffffff, 0x0, 0x6d, 0x0) openat$nullb(0xffffffffffffff9c, &(0x7f0000000100)='/dev/nullb0\x00', 0x0, 0x0) 16:29:42 executing program 1: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000100)='/dev/loop-control\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) close(r0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x32e) [ 248.826345][T12325] binder: 12320:12325 ioctl c0306201 0 returned -14 [ 248.846400][T12327] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. 16:29:42 executing program 3: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000000340)={0x26, 'hash\x00', 0x0, 0x0, 'sha3-384\x00'}, 0x58) r1 = accept4(r0, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000001bc0), 0xfe, 0x0, &(0x7f0000001d00)={0x77359400}) [ 248.902207][T12330] input: syz1 as /devices/virtual/input/input11 16:29:42 executing program 4: r0 = socket$inet(0x10, 0x3, 0xc) sendmsg(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000000)="2400000002031f001cfffd946fa2830020200a000900010001e700000000a3a20404ff7e", 0x24}], 0x1}, 0x0) sendmsg(r0, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000180)="24000000030307031dfffd946ff20c0020200a0009000100021d85680c1baba2", 0x20}], 0x1}, 0x0) 16:29:42 executing program 3: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000000340)={0x26, 'hash\x00', 0x0, 0x0, 'sha3-384\x00'}, 0x58) r1 = accept4(r0, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000001bc0), 0xfe, 0x0, &(0x7f0000001d00)={0x77359400}) [ 249.131918][T12441] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. 16:29:42 executing program 1: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000100)='/dev/loop-control\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) close(r0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x32e) 16:29:42 executing program 2: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_group_source_req(r0, 0x29, 0x1000000002e, &(0x7f0000000300)={0x0, {{0xa, 0x0, 0x0, @mcast2}}, {{0xa, 0x0, 0x0, @remote}}}, 0x108) syz_emit_ethernet(0x3e, &(0x7f0000000500)={@link_local={0x1, 0x80, 0xc2, 0x3a000000}, @link_local, [], {@ipv6={0x86dd, {0x0, 0x6, "093a06", 0x8, 0x3a, 0x0, @remote, @mcast2, {[], @udp={0x0, 0x0, 0x8}}}}}}, 0x0) 16:29:42 executing program 4: r0 = socket$inet(0x10, 0x3, 0xc) sendmsg(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000000)="2400000002031f001cfffd946fa2830020200a000900010001e700000000a3a20404ff7e", 0x24}], 0x1}, 0x0) sendmsg(r0, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000180)="24000000030307031dfffd946ff20c0020200a0009000100021d85680c1baba2", 0x20}], 0x1}, 0x0) [ 249.377909][T12516] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. 16:29:45 executing program 5: syz_open_dev$mice(&(0x7f0000000140)='/dev/input/mice\x00', 0x0, 0x80) r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vga_arbiter\x00', 0xb906b8ede7baf7e2, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000002a00)=[@in={0x2, 0x4e24, @loopback}, @in={0x2, 0x4e23, @remote}, @in={0x2, 0x4e22, @loopback}, @in={0x2, 0x4e20, @empty}, @in6={0xa, 0x4e23, 0x7, @rand_addr="1469538582cada4b421af83532620324", 0x7}], 0xffffffe8) r1 = syz_open_dev$vbi(&(0x7f0000000080)='/dev/vbi#\x00', 0x2, 0x2) ioctl$SNDRV_CTL_IOCTL_CARD_INFO(r1, 0x81785501, &(0x7f00000003c0)=""/84) r2 = getpid() socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setsig(r3, 0xa, 0x12) fcntl$setownex(r3, 0xf, &(0x7f0000000180)={0x2, r2}) recvmsg(r4, &(0x7f000095cfc8)={0x0, 0x0, 0x0}, 0x0) dup2(r3, r4) clone(0x0, 0x0, 0x0, 0x0, 0x0) tkill(r2, 0x15) 16:29:45 executing program 3: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, 0x0, 0x0) r1 = accept4(r0, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000001bc0), 0xfe, 0x0, &(0x7f0000001d00)={0x77359400}) 16:29:45 executing program 2: r0 = socket$inet6(0xa, 0x800000000000002, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendto$inet6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000140)={0xa, 0x4e22, 0x0, @mcast1}, 0x1c) sendto$inet6(r0, 0x0, 0x4, 0x0, 0x0, 0x0) 16:29:45 executing program 1: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000100)='/dev/loop-control\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) close(r0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x32e) 16:29:45 executing program 4: r0 = socket$inet(0x10, 0x3, 0xc) sendmsg(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000000)="2400000002031f001cfffd946fa2830020200a000900010001e700000000a3a20404ff7e", 0x24}], 0x1}, 0x0) sendmsg(r0, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000180)="24000000030307031dfffd946ff20c0020200a0009000100021d85680c1baba2", 0x20}], 0x1}, 0x0) 16:29:45 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") r1 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000380), 0x1, 0xfeffff, &(0x7f0000000040)='t'}) [ 251.784875][T12565] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. [ 251.800757][T12564] binder: 12562:12564 ioctl c0306201 0 returned -14 16:29:45 executing program 3: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, 0x0, 0x0) r1 = accept4(r0, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000001bc0), 0xfe, 0x0, &(0x7f0000001d00)={0x77359400}) 16:29:45 executing program 4: r0 = socket$inet(0x10, 0x3, 0xc) sendmsg(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000000)="2400000002031f001cfffd946fa2830020200a000900010001e700000000a3a20404ff7e", 0x24}], 0x1}, 0x0) sendmsg(r0, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000180)="24000000030307031dfffd946ff20c0020200a0009000100021d85680c1baba20400", 0x22}], 0x1}, 0x0) 16:29:45 executing program 2: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000200)=@un=@abs={0x0, 0x0, 0x4e22}, 0x80) 16:29:45 executing program 1: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000100)='/dev/loop-control\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) openat$vimc1(0xffffffffffffff9c, &(0x7f0000000000)='/dev/video1\x00', 0x2, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x32e) 16:29:45 executing program 3: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, 0x0, 0x0) r1 = accept4(r0, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000001bc0), 0xfe, 0x0, &(0x7f0000001d00)={0x77359400}) [ 252.062875][T12679] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. 16:29:45 executing program 4: r0 = socket$inet(0x10, 0x3, 0xc) sendmsg(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000000)="2400000002031f001cfffd946fa2830020200a000900010001e700000000a3a20404ff7e", 0x24}], 0x1}, 0x0) sendmsg(r0, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000180)="24000000030307031dfffd946ff20c0020200a0009000100021d85680c1baba20400", 0x22}], 0x1}, 0x0) 16:29:48 executing program 5: syz_open_dev$mice(&(0x7f0000000140)='/dev/input/mice\x00', 0x0, 0x80) r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vga_arbiter\x00', 0xb906b8ede7baf7e2, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000002a00)=[@in={0x2, 0x4e24, @loopback}, @in={0x2, 0x4e23, @remote}, @in={0x2, 0x4e22, @loopback}, @in={0x2, 0x4e20, @empty}, @in6={0xa, 0x4e23, 0x7, @rand_addr="1469538582cada4b421af83532620324", 0x7}], 0xffffffe8) r1 = syz_open_dev$vbi(&(0x7f0000000080)='/dev/vbi#\x00', 0x2, 0x2) ioctl$SNDRV_CTL_IOCTL_CARD_INFO(r1, 0x81785501, &(0x7f00000003c0)=""/84) r2 = getpid() socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setsig(r3, 0xa, 0x12) fcntl$setownex(r3, 0xf, &(0x7f0000000180)={0x2, r2}) recvmsg(r4, &(0x7f000095cfc8)={0x0, 0x0, 0x0}, 0x0) dup2(r3, r4) clone(0x0, 0x0, 0x0, 0x0, 0x0) tkill(r2, 0x15) 16:29:48 executing program 3: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000340)={0x26, 'hash\x00', 0x0, 0x0, 'sha3-384\x00'}, 0x58) r1 = accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000001bc0), 0xfe, 0x0, &(0x7f0000001d00)={0x77359400}) 16:29:48 executing program 4: r0 = socket$inet(0x10, 0x3, 0xc) sendmsg(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000000)="2400000002031f001cfffd946fa2830020200a000900010001e700000000a3a20404ff7e", 0x24}], 0x1}, 0x0) sendmsg(r0, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000180)="24000000030307031dfffd946ff20c0020200a0009000100021d85680c1baba20400", 0x22}], 0x1}, 0x0) 16:29:48 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uhid\x00', 0x400000002, 0x0) write$UHID_CREATE(r0, &(0x7f0000001080)={0x0, 'syz1\x00', 'syz1\x00', 'syz0\x00', &(0x7f0000000000)=""/11, 0xb}, 0x120) write$UHID_DESTROY(r0, &(0x7f0000000240), 0x4) getresgid(0x0, 0x0, 0x0) r1 = socket$inet_smc(0x2b, 0x1, 0x0) dup2(r1, r0) 16:29:48 executing program 1: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000100)='/dev/loop-control\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) openat$vimc1(0xffffffffffffff9c, &(0x7f0000000000)='/dev/video1\x00', 0x2, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x32e) 16:29:48 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") r1 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0xfeffff, 0x0}) [ 254.950999][T12801] __nla_validate_parse: 1 callbacks suppressed [ 254.951009][T12801] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. [ 254.981254][T12803] binder: 12802:12803 ioctl c0306201 0 returned -14 16:29:48 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") r1 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0xfeffff, 0x0}) 16:29:48 executing program 4: r0 = socket$inet(0x10, 0x3, 0xc) sendmsg(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000000)="2400000002031f001cfffd946fa2830020200a000900010001e700000000a3a20404ff7e", 0x24}], 0x1}, 0x0) sendmsg(r0, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000180)="24000000030307031dfffd946ff20c0020200a0009000100021d85680c1baba20400ff", 0x23}], 0x1}, 0x0) [ 255.055022][ T8920] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 16:29:48 executing program 3: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000340)={0x26, 'hash\x00', 0x0, 0x0, 'sha3-384\x00'}, 0x58) r1 = accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000001bc0), 0xfe, 0x0, &(0x7f0000001d00)={0x77359400}) [ 255.108611][ T8920] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 255.167924][ T8920] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 255.192360][T12878] binder: 12874:12878 ioctl c0306201 0 returned -14 [ 255.201098][T12885] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. [ 255.221790][ T8920] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 255.245620][ T8920] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 255.254206][ T8920] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 16:29:48 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") r1 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0xfeffff, 0x0}) 16:29:48 executing program 4: r0 = socket$inet(0x10, 0x3, 0xc) sendmsg(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000000)="2400000002031f001cfffd946fa2830020200a000900010001e700000000a3a20404ff7e", 0x24}], 0x1}, 0x0) sendmsg(r0, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000180)="24000000030307031dfffd946ff20c0020200a0009000100021d85680c1baba20400ff", 0x23}], 0x1}, 0x0) 16:29:48 executing program 3: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000340)={0x26, 'hash\x00', 0x0, 0x0, 'sha3-384\x00'}, 0x58) r1 = accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000001bc0), 0xfe, 0x0, &(0x7f0000001d00)={0x77359400}) [ 255.267499][ T8920] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 255.283280][ T8920] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 255.296531][ T8920] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 255.307744][ T8920] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 255.347179][ T8920] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 255.397362][T12930] binder: 12926:12930 ioctl c0306201 0 returned -14 [ 255.424588][T12932] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. [ 255.431549][ T8920] hid-generic 0000:0000:0000.0001: hidraw0: HID v0.00 Device [syz1] on syz1 16:29:51 executing program 5: syz_open_dev$mice(&(0x7f0000000140)='/dev/input/mice\x00', 0x0, 0x80) r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vga_arbiter\x00', 0xb906b8ede7baf7e2, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000002a00)=[@in={0x2, 0x4e24, @loopback}, @in={0x2, 0x4e23, @remote}, @in={0x2, 0x4e22, @loopback}, @in={0x2, 0x4e20, @empty}, @in6={0xa, 0x4e23, 0x7, @rand_addr="1469538582cada4b421af83532620324", 0x7}], 0xffffffe8) r1 = syz_open_dev$vbi(&(0x7f0000000080)='/dev/vbi#\x00', 0x2, 0x2) ioctl$SNDRV_CTL_IOCTL_CARD_INFO(r1, 0x81785501, &(0x7f00000003c0)=""/84) r2 = getpid() ioctl$int_in(0xffffffffffffffff, 0x5452, &(0x7f00005ebff8)=0x3f) fcntl$setsig(0xffffffffffffffff, 0xa, 0x12) fcntl$setownex(0xffffffffffffffff, 0xf, &(0x7f0000000180)={0x2, r2}) recvmsg(0xffffffffffffffff, &(0x7f000095cfc8)={0x0, 0x0, 0x0}, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) clone(0x0, 0x0, 0x0, 0x0, 0x0) tkill(r2, 0x15) 16:29:51 executing program 3: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000340)={0x26, 'hash\x00', 0x0, 0x0, 'sha3-384\x00'}, 0x58) accept4(r0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000001bc0), 0xfe, 0x0, &(0x7f0000001d00)={0x77359400}) 16:29:51 executing program 1: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000100)='/dev/loop-control\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) openat$vimc1(0xffffffffffffff9c, &(0x7f0000000000)='/dev/video1\x00', 0x2, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x32e) 16:29:51 executing program 4: r0 = socket$inet(0x10, 0x3, 0xc) sendmsg(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000000)="2400000002031f001cfffd946fa2830020200a000900010001e700000000a3a20404ff7e", 0x24}], 0x1}, 0x0) sendmsg(r0, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000180)="24000000030307031dfffd946ff20c0020200a0009000100021d85680c1baba20400ff", 0x23}], 0x1}, 0x0) 16:29:51 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") r1 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0xfeffff, &(0x7f0000000040)}) 16:29:51 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uhid\x00', 0x400000002, 0x0) write$UHID_CREATE(r0, &(0x7f0000001080)={0x0, 'syz1\x00', 'syz1\x00', 'syz0\x00', &(0x7f0000000000)=""/11, 0xb}, 0x120) write$UHID_DESTROY(r0, &(0x7f0000000240), 0x4) getresgid(0x0, 0x0, 0x0) r1 = socket$inet_smc(0x2b, 0x1, 0x0) dup2(r1, r0) [ 258.113168][T12941] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. [ 258.138184][T12947] binder: 12940:12947 ioctl c0306201 0 returned -14 [ 258.172384][ T8920] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 258.189751][ T8920] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 258.209007][ T8920] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 16:29:51 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") r1 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0xfeffff, &(0x7f0000000040)}) [ 258.226895][ T8920] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 258.250792][ T8920] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 16:29:51 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$swradio(&(0x7f00000001c0)='/dev/swradio#\x00', 0x0, 0x2) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, &(0x7f0000000100)={0x0, 0x1, 0x0, [0xf00000000], &(0x7f00000000c0)={0x98f909, 0xd408, [], @p_u8=&(0x7f0000000140)}}) 16:29:51 executing program 3: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000340)={0x26, 'hash\x00', 0x0, 0x0, 'sha3-384\x00'}, 0x58) accept4(r0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000001bc0), 0xfe, 0x0, &(0x7f0000001d00)={0x77359400}) [ 258.277950][ T8920] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 258.302436][ T8920] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 258.355620][ T8920] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 258.391912][ T8920] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 16:29:52 executing program 1: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000100)='/dev/loop-control\x00', 0x0, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) close(r0) openat$vimc1(0xffffffffffffff9c, &(0x7f0000000000)='/dev/video1\x00', 0x2, 0x0) r1 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r1, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x32e) [ 258.417425][T13062] binder: 13061:13062 ioctl c0306201 0 returned -14 [ 258.429832][ T8920] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 258.463421][ T8920] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 258.484967][ T8920] hid-generic 0000:0000:0000.0002: hidraw0: HID v0.00 Device [syz1] on syz1 16:29:52 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$swradio(&(0x7f00000001c0)='/dev/swradio#\x00', 0x0, 0x2) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, &(0x7f0000000100)={0x0, 0x1, 0x0, [0xf00000000], &(0x7f00000000c0)={0x98f909, 0xd408, [], @p_u8=&(0x7f0000000140)}}) 16:29:52 executing program 3: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000340)={0x26, 'hash\x00', 0x0, 0x0, 'sha3-384\x00'}, 0x58) accept4(r0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000001bc0), 0xfe, 0x0, &(0x7f0000001d00)={0x77359400}) 16:29:54 executing program 5: syz_open_dev$mice(&(0x7f0000000140)='/dev/input/mice\x00', 0x0, 0x80) r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vga_arbiter\x00', 0xb906b8ede7baf7e2, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000002a00)=[@in={0x2, 0x4e24, @loopback}, @in={0x2, 0x4e23, @remote}, @in={0x2, 0x4e22, @loopback}, @in={0x2, 0x4e20, @empty}, @in6={0xa, 0x4e23, 0x7, @rand_addr="1469538582cada4b421af83532620324", 0x7}], 0xffffffe8) r1 = syz_open_dev$vbi(&(0x7f0000000080)='/dev/vbi#\x00', 0x2, 0x2) ioctl$SNDRV_CTL_IOCTL_CARD_INFO(r1, 0x81785501, &(0x7f00000003c0)=""/84) r2 = getpid() ioctl$int_in(0xffffffffffffffff, 0x5452, &(0x7f00005ebff8)=0x3f) fcntl$setsig(0xffffffffffffffff, 0xa, 0x12) fcntl$setownex(0xffffffffffffffff, 0xf, &(0x7f0000000180)={0x2, r2}) recvmsg(0xffffffffffffffff, &(0x7f000095cfc8)={0x0, 0x0, 0x0}, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) clone(0x0, 0x0, 0x0, 0x0, 0x0) tkill(r2, 0x15) 16:29:54 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") r1 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0xfeffff, &(0x7f0000000040)}) 16:29:54 executing program 1: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000100)='/dev/loop-control\x00', 0x0, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) close(r0) openat$vimc1(0xffffffffffffff9c, &(0x7f0000000000)='/dev/video1\x00', 0x2, 0x0) r1 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r1, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x32e) 16:29:54 executing program 2: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) msync(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) io_setup(0x6, &(0x7f0000000180)=0x0) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0xffff1f0000000000, 0x80000000000016, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7, 0xe0000}]) 16:29:54 executing program 4: 16:29:54 executing program 3: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000340)={0x26, 'hash\x00', 0x0, 0x0, 'sha3-384\x00'}, 0x58) r1 = accept4(r0, 0x0, 0x0, 0x0) recvmmsg(r1, 0x0, 0x0, 0x0, &(0x7f0000001d00)={0x77359400}) 16:29:54 executing program 4: [ 261.265193][T13086] binder: 13085:13086 ioctl c0306201 0 returned -14 16:29:54 executing program 1: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000100)='/dev/loop-control\x00', 0x0, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) close(r0) openat$vimc1(0xffffffffffffff9c, &(0x7f0000000000)='/dev/video1\x00', 0x2, 0x0) r1 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r1, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x32e) 16:29:54 executing program 3: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000340)={0x26, 'hash\x00', 0x0, 0x0, 'sha3-384\x00'}, 0x58) r1 = accept4(r0, 0x0, 0x0, 0x0) recvmmsg(r1, 0x0, 0x0, 0x0, &(0x7f0000001d00)={0x77359400}) 16:29:55 executing program 0: 16:29:55 executing program 4: 16:29:55 executing program 2: 16:29:57 executing program 5: syz_open_dev$mice(&(0x7f0000000140)='/dev/input/mice\x00', 0x0, 0x80) r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vga_arbiter\x00', 0xb906b8ede7baf7e2, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000002a00)=[@in={0x2, 0x4e24, @loopback}, @in={0x2, 0x4e23, @remote}, @in={0x2, 0x4e22, @loopback}, @in={0x2, 0x4e20, @empty}, @in6={0xa, 0x4e23, 0x7, @rand_addr="1469538582cada4b421af83532620324", 0x7}], 0xffffffe8) r1 = syz_open_dev$vbi(&(0x7f0000000080)='/dev/vbi#\x00', 0x2, 0x2) ioctl$SNDRV_CTL_IOCTL_CARD_INFO(r1, 0x81785501, &(0x7f00000003c0)=""/84) r2 = getpid() ioctl$int_in(0xffffffffffffffff, 0x5452, &(0x7f00005ebff8)=0x3f) fcntl$setsig(0xffffffffffffffff, 0xa, 0x12) fcntl$setownex(0xffffffffffffffff, 0xf, &(0x7f0000000180)={0x2, r2}) recvmsg(0xffffffffffffffff, &(0x7f000095cfc8)={0x0, 0x0, 0x0}, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) clone(0x0, 0x0, 0x0, 0x0, 0x0) tkill(r2, 0x15) 16:29:57 executing program 0: 16:29:57 executing program 3: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000340)={0x26, 'hash\x00', 0x0, 0x0, 'sha3-384\x00'}, 0x58) r1 = accept4(r0, 0x0, 0x0, 0x0) recvmmsg(r1, 0x0, 0x0, 0x0, &(0x7f0000001d00)={0x77359400}) 16:29:57 executing program 1: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000100)='/dev/loop-control\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) close(r0) openat$vimc1(0xffffffffffffff9c, &(0x7f0000000000)='/dev/video1\x00', 0x2, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r2, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x32e) 16:29:57 executing program 4: 16:29:57 executing program 2: 16:29:58 executing program 4: 16:29:58 executing program 0: 16:29:58 executing program 2: 16:29:58 executing program 1: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000100)='/dev/loop-control\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) close(r0) openat$vimc1(0xffffffffffffff9c, &(0x7f0000000000)='/dev/video1\x00', 0x2, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r2, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x32e) 16:29:58 executing program 3: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000340)={0x26, 'hash\x00', 0x0, 0x0, 'sha3-384\x00'}, 0x58) r1 = accept4(r0, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000001bc0), 0x0, 0x0, 0x0) 16:29:58 executing program 4: 16:30:01 executing program 5: syz_open_dev$mice(&(0x7f0000000140)='/dev/input/mice\x00', 0x0, 0x80) r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vga_arbiter\x00', 0xb906b8ede7baf7e2, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000002a00)=[@in={0x2, 0x4e24, @loopback}, @in={0x2, 0x4e23, @remote}, @in={0x2, 0x4e22, @loopback}, @in={0x2, 0x4e20, @empty}, @in6={0xa, 0x4e23, 0x7, @rand_addr="1469538582cada4b421af83532620324", 0x7}], 0xffffffe8) r1 = syz_open_dev$vbi(&(0x7f0000000080)='/dev/vbi#\x00', 0x2, 0x2) ioctl$SNDRV_CTL_IOCTL_CARD_INFO(r1, 0x81785501, &(0x7f00000003c0)=""/84) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$int_in(r2, 0x5452, &(0x7f00005ebff8)=0x3f) fcntl$setsig(r2, 0xa, 0x12) fcntl$setownex(r2, 0xf, &(0x7f0000000180)={0x2}) recvmsg(r3, &(0x7f000095cfc8)={0x0, 0x0, 0x0}, 0x0) dup2(r2, r3) clone(0x0, 0x0, 0x0, 0x0, 0x0) tkill(0x0, 0x15) 16:30:01 executing program 0: 16:30:01 executing program 2: 16:30:01 executing program 1: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000100)='/dev/loop-control\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) close(r0) openat$vimc1(0xffffffffffffff9c, &(0x7f0000000000)='/dev/video1\x00', 0x2, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r2, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x32e) 16:30:01 executing program 3: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000340)={0x26, 'hash\x00', 0x0, 0x0, 'sha3-384\x00'}, 0x58) r1 = accept4(r0, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000001bc0), 0x0, 0x0, 0x0) 16:30:01 executing program 4: 16:30:01 executing program 4: 16:30:01 executing program 2: 16:30:01 executing program 3: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000340)={0x26, 'hash\x00', 0x0, 0x0, 'sha3-384\x00'}, 0x58) r1 = accept4(r0, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000001bc0), 0x0, 0x0, 0x0) 16:30:01 executing program 0: 16:30:01 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) close(0xffffffffffffffff) openat$vimc1(0xffffffffffffff9c, &(0x7f0000000000)='/dev/video1\x00', 0x2, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x32e) 16:30:01 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x41, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x1}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x8, 0x24c00) recvmsg(0xffffffffffffffff, &(0x7f0000000d40)={0x0, 0x0, &(0x7f0000000bc0)=[{0x0}, {0x0}, {&(0x7f0000000800)=""/231, 0xe7}, {0x0}, {&(0x7f0000000b40)=""/93, 0x5d}], 0x5, &(0x7f0000000c40)=""/236, 0xec}, 0x1) r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000080)='/proc/self/net/pfkey\x00', 0x60000, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000140)={&(0x7f0000000280)={0xc8, 0x34, 0x10, 0x70bd29, 0x25dfdbfc, {0xd}, [@typed={0x8, 0x30, @ipv4=@dev={0xac, 0x14, 0x14, 0x20}}, @generic="22ae954610b864dadb4a251ebd12e3ca73cef07cdbcb4fd97ab86dc76fb9126e6c5f6f26a118dc27eb382f974ccbf68375e7e7c61f56fe54fe7519937691a143189befc14cc3341c008e1ad8a432fe9e88a90b82fb0692eb11bb4ffe62472eac2fe6296ee18d30576fbeae9ab20714d23920bb3ff0bdf5884b6d3a7486dcb6ef35875eb048be823e847bb367fd2e2bc5f340132c12175f901c5621a56179771df0ec95", @typed={0x8, 0x21, @ipv4=@initdev={0xac, 0x1e, 0x1, 0x0}}]}, 0xc8}, 0x1, 0x0, 0x0, 0x3f1ab0607040596a}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x3, 0x7) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) sendmmsg(r1, &(0x7f0000000480), 0x2e9, 0x0) clock_getres(0x4, &(0x7f0000000000)) 16:30:02 executing program 5: syz_open_dev$mice(&(0x7f0000000140)='/dev/input/mice\x00', 0x0, 0x80) r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vga_arbiter\x00', 0xb906b8ede7baf7e2, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000002a00)=[@in={0x2, 0x4e24, @loopback}, @in={0x2, 0x4e23, @remote}, @in={0x2, 0x4e22, @loopback}, @in={0x2, 0x4e20, @empty}, @in6={0xa, 0x4e23, 0x7, @rand_addr="1469538582cada4b421af83532620324", 0x7}], 0xffffffe8) r1 = syz_open_dev$vbi(&(0x7f0000000080)='/dev/vbi#\x00', 0x2, 0x2) ioctl$SNDRV_CTL_IOCTL_CARD_INFO(r1, 0x81785501, &(0x7f00000003c0)=""/84) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$int_in(r2, 0x5452, &(0x7f00005ebff8)=0x3f) fcntl$setsig(r2, 0xa, 0x12) fcntl$setownex(r2, 0xf, &(0x7f0000000180)={0x2}) recvmsg(r3, &(0x7f000095cfc8)={0x0, 0x0, 0x0}, 0x0) dup2(r2, r3) clone(0x0, 0x0, 0x0, 0x0, 0x0) tkill(0x0, 0x15) 16:30:02 executing program 4: r0 = syz_open_dev$loop(&(0x7f0000000040)='/dev/loop#\x00', 0x0, 0x1100082) r1 = memfd_create(&(0x7f0000000200)='/\xd2\a\xaa(\t0\xedj\\\x14E\x80VfM\'\x80\xb1\xce\x86Wp#\x00\xc2\xf8\x03\xb5\a\x9e\x83X\x8e?yE\xec\xeb2-\xbb\vO\xf9P\xd7\xd7\xf5\xa8\xaeW\x8e\xe5Q\xd9\x9ew\x8e}\x868\x9f2\xf9\x17\xf5\xf8;\xd5g\bQ\xf1a\x0e$9[k@\x0fj\x83\x9d\xb1\xd5\xd7\xa5\xc1\x05ox\xe4\xdc6\x04\xc1n\xf6\xf8\x1c\xf2\xa9\xbb\xbc\x12u\xfd\xeb0bK\xb8A\x93\xb3\x8co\a\xe1}R\xa6x\xde\xb5;\xea\xa0', 0x0) open(&(0x7f0000000000)='./file0\x00', 0x10000, 0x20) syz_genetlink_get_family_id$ipvs(&(0x7f0000000100)='IPVS\x00') pwritev(r1, &(0x7f0000000340)=[{&(0x7f00000001c0)='\'', 0x1}], 0x1, 0x1081806) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendfile(r0, r1, 0x0, 0x2000004) 16:30:02 executing program 0: syz_mount_image$ext4(0x0, 0x0, 0x0, 0x1, &(0x7f00000007c0)=[{&(0x7f0000001840)="62f23e748cdfecc0d3bcb88248f9f8f8e87edc5637656d6e511dcdc6041c8d8a0957939950c15c7ac6360c7820e1d5957ba4167f17600b58767db91e29eb92a20f86dddfb0f8dda322d3ddeadba924051c7894f228f090746b1a55e851e7dcaae4d8411f6806d216b4f2e7eca231a301cc0c9bb4bb5598a94336a99790d3b77dcda45483c1fb1194c56ddfddb587442754e6c815", 0x94, 0x9}], 0x0, 0x0) ioctl$sock_inet_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f0000000240)={0x0, {0x2, 0x0, @loopback}, {0x2, 0x0, @dev}, {0x2, 0x0, @remote}}) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000000)='./file0\x00', 0x0, 0xaaaaaaaaaaaab31, &(0x7f0000000100)=[{&(0x7f00000000c0)="800000003804000019000300e60100006c000000000000000100000001000000004000000040000080000000000000006d5ebe5a0000ffff53ef", 0x2c3, 0x400}], 0x1, 0x0) 16:30:02 executing program 3: r0 = open(&(0x7f00000001c0)='./file0\x00', 0x10040, 0x1) write$FUSE_LSEEK(r0, &(0x7f0000000340)={0x18, 0xfffffffffffffffe, 0x7, {0x5e9}}, 0x18) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x41, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$netlink(0x10, 0x3, 0xf) r2 = open(&(0x7f0000000180)='./file0\x00', 0x8000, 0x10) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f00000046c0)={{{@in6=@mcast2, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6}, 0x0, @in=@multicast1}}, &(0x7f00000047c0)=0xe8) ioctl$sock_inet6_SIOCSIFDSTADDR(r2, 0x8918, &(0x7f0000004800)={@mcast2, 0x73, r3}) openat$apparmor_task_exec(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/attr/exec\x00', 0x2, 0x0) writev(r1, &(0x7f000037d000)=[{&(0x7f0000000000)="1f00000002031900000007000000068100ed853b09000100010100ff3ffe58", 0x1f}], 0x1) r4 = openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x7ff) syncfs(r4) r5 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$LOOP_GET_STATUS64(r4, 0x4c05, &(0x7f0000000200)) ioctl$PERF_EVENT_IOC_REFRESH(r5, 0x2402, 0xf17) unshare(0x40040400) perf_event_open(&(0x7f00000000c0)={0x0, 0x70, 0x0, 0x0, 0x7, 0x1, 0x0, 0x1, 0x4000, 0xc, 0x89, 0x0, 0x1, 0x8, 0xa5c, 0x80000000, 0x9, 0x1, 0x1f6, 0xfff, 0x0, 0x5, 0x0, 0x5, 0x2, 0x9, 0x0, 0x8, 0xe, 0x400, 0x0, 0x0, 0x2, 0x9, 0x400, 0x4, 0x0, 0xb, 0x0, 0x2, 0x0, @perf_config_ext={0x9, 0x100000000}, 0x280, 0x5e, 0xeb67, 0x0, 0x0, 0x0, 0x5}, 0x0, 0x0, 0xffffffffffffffff, 0x8) r6 = add_key(&(0x7f0000000080)='id_resolver\x00', &(0x7f00000000c0)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffc) r7 = add_key$keyring(&(0x7f0000000100)='keyring\x00', &(0x7f0000000140)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffd) keyctl$unlink(0x9, r6, r7) setsockopt$inet6_MCAST_LEAVE_GROUP(r2, 0x29, 0x2d, &(0x7f0000000280)={0x6, {{0xa, 0x4e24, 0xfff, @ipv4={[], [], @remote}, 0x4}}}, 0x88) 16:30:02 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) close(0xffffffffffffffff) openat$vimc1(0xffffffffffffff9c, &(0x7f0000000000)='/dev/video1\x00', 0x2, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x32e) 16:30:02 executing program 2: setuid(0xee00) setreuid(0x0, 0x0) 16:30:02 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000040)={0x26, 'hash\x00', 0x0, 0x0, 'md5\x00'}, 0x58) r1 = accept4(r0, 0x0, 0x0, 0x0) sendmsg$TIPC_CMD_RESET_LINK_STATS(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) 16:30:02 executing program 4: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) preadv(r0, &(0x7f0000000740)=[{&(0x7f0000000480)=""/164, 0xa4}], 0x1, 0x0) mknod$loop(&(0x7f00000001c0)='./file0/file1\x00', 0x0, 0xffffffffffffffff) read$FUSE(r0, &(0x7f0000000780), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1, {0x7, 0x1e}}, 0x50) read$FUSE(r0, &(0x7f00000040c0), 0x1000) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2, {0x0, 0x0, 0x800000000000}}, 0x90) write$FUSE_ENTRY(r0, &(0x7f0000000380)={0x90, 0x0, 0x3, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x85eb}}}, 0x90) 16:30:02 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) close(0xffffffffffffffff) openat$vimc1(0xffffffffffffff9c, &(0x7f0000000000)='/dev/video1\x00', 0x2, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x32e) [ 268.646910][T13379] EXT4-fs (loop0): ext4_check_descriptors: Block bitmap for group 0 overlaps superblock [ 268.703601][T13379] EXT4-fs (loop0): ext4_check_descriptors: Inode bitmap for group 0 overlaps superblock [ 268.733921][T13402] fuse: Bad value for 'subtype' [ 268.736110][T13386] IPVS: ftp: loaded support on port[0] = 21 [ 268.757253][T13379] EXT4-fs (loop0): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 268.796881][T13470] fuse: Bad value for 'subtype' 16:30:02 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000080)) r1 = syz_open_pts(r0, 0x0) readv(r0, &(0x7f0000000040)=[{&(0x7f0000000000)=""/45, 0x2d}], 0x1) ioctl$TCXONC(r1, 0x540a, 0x3) 16:30:02 executing program 1: r0 = openat$loop_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) close(r0) openat$vimc1(0xffffffffffffff9c, &(0x7f0000000000)='/dev/video1\x00', 0x2, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x32e) [ 268.814325][T13379] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue 16:30:02 executing program 2: r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet6(0xa, 0x400000000001, 0x0) r2 = dup(r1) setsockopt$sock_timeval(r1, 0x1, 0x15, &(0x7f0000000080)={0x0, 0x7530}, 0xfe28) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r2, 0x0, 0x0, 0x20000008, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendmsg$TIPC_NL_PEER_REMOVE(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=ANY=[@ANYBLOB], 0x1}}, 0x4c080) setsockopt$inet_tcp_int(r2, 0x6, 0x2000000000000013, &(0x7f0000000180)=0x1, 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000380)=0x1, 0x4) r3 = open(&(0x7f0000000280)='./file0\x00', 0x110000141042, 0x0) writev(r2, &(0x7f0000000140)=[{&(0x7f00000000c0)=',', 0x1}], 0x1) ftruncate(r3, 0x10099b7) sendfile(r1, r3, 0x0, 0x88000fc000000) [ 268.911660][T13393] IPVS: ftp: loaded support on port[0] = 21 [ 269.027445][ T8907] [ 269.033151][ T8907] ============================= [ 269.055040][ T8907] WARNING: suspicious RCU usage [ 269.078555][ T8907] 5.3.0-rc6-next-20190826 #73 Not tainted [ 269.096444][ T8907] ----------------------------- [ 269.103051][ T8907] fs/ext4/block_validity.c:333 suspicious rcu_dereference_check() usage! [ 269.123186][ T8907] [ 269.123186][ T8907] other info that might help us debug this: [ 269.123186][ T8907] [ 269.154721][ T8907] [ 269.154721][ T8907] rcu_scheduler_active = 2, debug_locks = 1 [ 269.170406][ T8907] 1 lock held by syz-executor.0/8907: [ 269.176317][ T8907] #0: ffff88809a1a6398 (&type->s_umount_key#32){++++}, at: deactivate_super+0x1aa/0x1d0 [ 269.187721][ T8907] [ 269.187721][ T8907] stack backtrace: [ 269.194367][ T8907] CPU: 1 PID: 8907 Comm: syz-executor.0 Not tainted 5.3.0-rc6-next-20190826 #73 [ 269.203766][ T8907] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 269.203782][ T8907] Call Trace: [ 269.203865][ T8907] dump_stack+0x172/0x1f0 [ 269.203893][ T8907] lockdep_rcu_suspicious+0x153/0x15d [ 269.223638][ T8907] ext4_release_system_zone+0x166/0x1a0 [ 269.223652][ T8907] ext4_put_super+0x954/0xd70 [ 269.223672][ T8907] ? ext4_quota_write+0x5a0/0x5a0 [ 269.239820][ T8907] generic_shutdown_super+0x14c/0x370 [ 269.239838][ T8907] kill_block_super+0xa0/0x100 [ 269.239856][ T8907] deactivate_locked_super+0x95/0x100 [ 269.239871][ T8907] deactivate_super+0x1b2/0x1d0 [ 269.239884][ T8907] ? mount_bdev+0x3c0/0x3c0 [ 269.239895][ T8907] ? dput+0x38/0xe10 [ 269.239907][ T8907] ? dput+0x1f2/0xe10 [ 269.239920][ T8907] ? mnt_get_writers.isra.0+0xf9/0x150 [ 269.239936][ T8907] cleanup_mnt+0x351/0x4c0 [ 269.239950][ T8907] ? trace_hardirqs_on+0x67/0x240 [ 269.239961][ T8907] ? __kasan_check_read+0x11/0x20 [ 269.239980][ T8907] __cleanup_mnt+0x16/0x20 [ 269.303364][ T8907] task_work_run+0x145/0x1c0 [ 269.307946][ T8907] exit_to_usermode_loop+0x316/0x380 [ 269.313224][ T8907] do_syscall_64+0x65f/0x760 [ 269.318321][ T8907] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 269.324564][ T8907] RIP: 0033:0x45c2a7 [ 269.329230][ T8907] Code: 64 89 04 25 d0 02 00 00 58 5f ff d0 48 89 c7 e8 2f be ff ff 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 a6 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 9d 8d fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 269.350376][ T8907] RSP: 002b:00007ffd4ce442d8 EFLAGS: 00000202 ORIG_RAX: 00000000000000a6 [ 269.358862][ T8907] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 000000000045c2a7 [ 269.367278][ T8907] RDX: 0000000000403520 RSI: 0000000000000002 RDI: 00007ffd4ce44380 [ 269.375491][ T8907] RBP: 00000000000000cd R08: 0000000000000000 R09: 000000000000000a [ 269.383799][ T8907] R10: 0000000000000005 R11: 0000000000000202 R12: 00007ffd4ce45410 [ 269.392274][ T8907] R13: 0000555556e5a940 R14: 0000000000000000 R15: 00007ffd4ce45410 [ 269.406611][ T8907] ------------[ cut here ]------------ [ 269.412541][ T8907] ODEBUG: free active (active state 0) object type: percpu_counter hint: 0x0 [ 269.424379][ T8907] WARNING: CPU: 1 PID: 8907 at lib/debugobjects.c:481 debug_print_object+0x168/0x250 [ 269.436398][ T8907] Kernel panic - not syncing: panic_on_warn set ... [ 269.443636][ T8907] CPU: 1 PID: 8907 Comm: syz-executor.0 Not tainted 5.3.0-rc6-next-20190826 #73 [ 269.453629][ T8907] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 269.464775][ T8907] Call Trace: [ 269.468801][ T8907] dump_stack+0x172/0x1f0 [ 269.474286][ T8907] ? debug_print_object+0x90/0x250 [ 269.480136][ T8907] panic+0x2dc/0x755 [ 269.484038][ T8907] ? add_taint.cold+0x16/0x16 [ 269.489851][ T8907] ? __kasan_check_write+0x14/0x20 [ 269.495306][ T8907] ? __warn.cold+0x14/0x3c [ 269.499958][ T8907] ? __warn+0xd9/0x1d0 [ 269.504303][ T8907] ? debug_print_object+0x168/0x250 [ 269.510086][ T8907] __warn.cold+0x2f/0x3c [ 269.514612][ T8907] ? debug_print_object+0x168/0x250 [ 269.520023][ T8907] report_bug+0x289/0x300 [ 269.524804][ T8907] do_error_trap+0x11b/0x200 [ 269.530258][ T8907] do_invalid_op+0x37/0x50 [ 269.534679][ T8907] ? debug_print_object+0x168/0x250 [ 269.540571][ T8907] invalid_op+0x23/0x30 [ 269.545207][ T8907] RIP: 0010:debug_print_object+0x168/0x250 [ 269.551571][ T8907] Code: dd 60 6c e6 87 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 b5 00 00 00 48 8b 14 dd 60 6c e6 87 48 c7 c7 c0 61 e6 87 e8 20 31 01 fe <0f> 0b 83 05 f3 67 83 06 01 48 83 c4 20 5b 41 5c 41 5d 41 5e 5d c3 [ 269.572738][ T8907] RSP: 0018:ffff8880a40dfb80 EFLAGS: 00010086 [ 269.579071][ T8907] RAX: 0000000000000000 RBX: 0000000000000003 RCX: 0000000000000000 [ 269.587689][ T8907] RDX: 0000000000000000 RSI: ffffffff815bd606 RDI: ffffed101481bf62 [ 269.598504][ T8907] RBP: ffff8880a40dfbc0 R08: ffff888097e5e540 R09: ffffed1015d24109 [ 269.607183][ T8907] R10: ffffed1015d24108 R11: ffff8880ae920847 R12: 0000000000000001 [ 269.615815][ T8907] R13: ffffffff8935e800 R14: 0000000000000000 R15: ffff888086b92540 [ 269.624479][ T8907] ? vprintk_func+0x86/0x189 [ 269.629466][ T8907] debug_check_no_obj_freed+0x2d4/0x43f [ 269.635420][ T8907] ? rcu_read_lock_sched_held+0x9c/0xd0 [ 269.641402][ T8907] kfree+0xf8/0x2c0 [ 269.645942][ T8907] ext4_put_super+0x8e0/0xd70 [ 269.650989][ T8907] ? ext4_quota_write+0x5a0/0x5a0 [ 269.656720][ T8907] generic_shutdown_super+0x14c/0x370 [ 269.662724][ T8907] kill_block_super+0xa0/0x100 [ 269.675318][ T8907] deactivate_locked_super+0x95/0x100 [ 269.684560][ T8907] deactivate_super+0x1b2/0x1d0 [ 269.689756][ T8907] ? mount_bdev+0x3c0/0x3c0 [ 269.695037][ T8907] ? dput+0x38/0xe10 [ 269.700816][ T8907] ? dput+0x1f2/0xe10 [ 269.704900][ T8907] ? mnt_get_writers.isra.0+0xf9/0x150 [ 269.710830][ T8907] cleanup_mnt+0x351/0x4c0 [ 269.716288][ T8907] ? trace_hardirqs_on+0x67/0x240 [ 269.721517][ T8907] ? __kasan_check_read+0x11/0x20 [ 269.726813][ T8907] __cleanup_mnt+0x16/0x20 [ 269.731411][ T8907] task_work_run+0x145/0x1c0 [ 269.737003][ T8907] exit_to_usermode_loop+0x316/0x380 [ 269.742666][ T8907] do_syscall_64+0x65f/0x760 [ 269.747802][ T8907] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 269.753805][ T8907] RIP: 0033:0x45c2a7 [ 269.757914][ T8907] Code: 64 89 04 25 d0 02 00 00 58 5f ff d0 48 89 c7 e8 2f be ff ff 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 a6 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 9d 8d fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 269.778485][ T8907] RSP: 002b:00007ffd4ce442d8 EFLAGS: 00000202 ORIG_RAX: 00000000000000a6 [ 269.787369][ T8907] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 000000000045c2a7 [ 269.795780][ T8907] RDX: 0000000000403520 RSI: 0000000000000002 RDI: 00007ffd4ce44380 [ 269.804370][ T8907] RBP: 00000000000000cd R08: 0000000000000000 R09: 000000000000000a [ 269.812973][ T8907] R10: 0000000000000005 R11: 0000000000000202 R12: 00007ffd4ce45410 [ 269.821685][ T8907] R13: 0000555556e5a940 R14: 0000000000000000 R15: 00007ffd4ce45410 [ 269.833356][ T8907] Kernel Offset: disabled [ 269.838144][ T8907] Rebooting in 86400 seconds..