knodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1000, 0x7) ioctl$vim2m_VIDIOC_DQBUF(0xffffffffffffffff, 0xc0585611, &(0x7f0000000180)={0xed9, 0x0, 0x4, 0x10, 0x6, {0x0, 0x2710}, {0x1, 0x1, 0x0, 0xff, 0x6, 0x0, "77fd3864"}, 0x5, 0x1, @fd=r3, 0x5}) 01:06:25 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x6, 0x0, 0x0}) 01:06:25 executing program 4: socketpair(0x2c, 0x0, 0x33, &(0x7f0000000100)) 01:06:25 executing program 5: syz_io_uring_setup(0x6787, &(0x7f00000002c0)={0x0, 0x10066d5, 0x2b}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) 01:06:25 executing program 2: socketpair(0x22, 0x0, 0x156, &(0x7f0000000100)) 01:06:25 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_RX_RING(r1, 0x11b, 0x2, &(0x7f0000001e40)=0x100080, 0x4) syz_open_dev$binderN(&(0x7f0000000180)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000340)={0x8c, 0x0, &(0x7f0000000240)=[@clear_death={0x400c630f, 0x3}, @acquire={0x40046305, 0x1}, @free_buffer, @increfs={0x40046304, 0x3}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x18, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x1, &(0x7f0000000040)=""/253, 0xfd, 0x0, 0x41}, @ptr={0x70742a85, 0x0, &(0x7f00000001c0)=""/16, 0x10, 0x0, 0x3d}, @fda={0x66646185, 0xa, 0x1, 0x5}}, &(0x7f0000000200)={0x0, 0x28, 0x50}}}, @acquire_done={0x40106309, 0x3}, @register_looper, @register_looper], 0x7, 0x0, &(0x7f0000000300)="6be64bbd28cc6d"}) ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f00000024c0)={0x2, 0x0, 0x0, 0x0, 0x0, 0x0}) 01:06:25 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x802) ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f00000024c0)={0x2, 0x0, 0x0, 0x0, 0x0, 0x0}) clock_gettime(0x0, &(0x7f00000000c0)={0x0, 0x0}) ioctl$vim2m_VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000100)={0x3, 0x1, 0x4, 0x0, 0x2, {r1, r2/1000+10000}, {0x2, 0xc, 0xe5, 0x2, 0x8, 0xbf, "033a72e1"}, 0x80, 0x3, @fd, 0x9}) mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1000, 0x7) [ 1384.669692][T13337] binder: 13334:13337 unknown command 28 [ 1384.675416][T13337] binder: 13334:13337 ioctl c0306201 20000100 returned -22 01:06:25 executing program 5: syz_io_uring_setup(0x6787, &(0x7f00000002c0)={0x0, 0x10066d5, 0x2b}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, 0x0, &(0x7f0000000380)) 01:06:25 executing program 4: socketpair(0x2c, 0x0, 0x34, &(0x7f0000000100)) 01:06:25 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x7, 0x0, 0x0}) 01:06:25 executing program 2: socketpair(0x22, 0x0, 0x157, &(0x7f0000000100)) 01:06:25 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f00000024c0)={0x2, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) syz_io_uring_setup(0x4506, &(0x7f0000000140)={0x0, 0x9e12, 0x0, 0x1, 0x3}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f00000001c0), &(0x7f0000000200)) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xa, 0x100010, r1, 0x8000000) sendmsg$AUDIT_LIST_RULES(r1, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x10, 0x3f5, 0x200, 0x70bd29, 0x25dfdbfe, "", ["", "", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x800}, 0x2041) 01:06:26 executing program 5: syz_io_uring_setup(0x6787, &(0x7f00000002c0)={0x0, 0x10066d5, 0x2b}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, 0x0, &(0x7f0000000380)) 01:06:26 executing program 4: socketpair(0x2c, 0x0, 0x35, &(0x7f0000000100)) 01:06:26 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x802) ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f00000024c0)={0x2, 0x0, 0x0, 0x0, 0x0, 0x0}) clock_gettime(0x0, &(0x7f00000000c0)) mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1000, 0x7) [ 1384.895325][T13355] binder: 13352:13355 unknown command 28 [ 1384.923847][T13355] binder: 13352:13355 ioctl c0306201 20000100 returned -22 01:06:26 executing program 2: socketpair(0x22, 0x0, 0x158, &(0x7f0000000100)) 01:06:26 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f00000024c0)={0x2, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$IOCTL_VMCI_QUEUEPAIR_SETVA(0xffffffffffffffff, 0x7a4, &(0x7f0000000040)={{@any, 0x7fffffff}, 0xfffffffffffffff9, 0x9, 0xffffffff, 0x6}) 01:06:26 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x8, 0x0, 0x0}) 01:06:26 executing program 5: syz_io_uring_setup(0x6787, &(0x7f00000002c0)={0x0, 0x10066d5, 0x2b}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, 0x0, &(0x7f0000000380)) 01:06:26 executing program 4: socketpair(0x2c, 0x0, 0x36, &(0x7f0000000100)) 01:06:26 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x802) ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f00000024c0)={0x2, 0x0, 0x0, 0x0, 0x0, 0x0}) mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1000, 0x7) 01:06:26 executing program 2: socketpair(0x22, 0x0, 0x159, &(0x7f0000000100)) [ 1385.170507][T13371] binder: 13368:13371 unknown command 28 [ 1385.181913][T13371] binder: 13368:13371 ioctl c0306201 20000100 returned -22 01:06:26 executing program 0: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0x5421, &(0x7f00000024c0)={0x2, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f0000000040)={0xffffffffffffffff}) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f0000000100)={&(0x7f0000000140)=""/55, 0x8000, 0x1000, 0x0, 0x1}, 0x20) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f00000000c0)={0x1, 0x28}, 0x10) eventfd2(0x1c0, 0x800) 01:06:26 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x48, 0x0, 0x0}) 01:06:26 executing program 5: syz_io_uring_setup(0x6787, &(0x7f00000002c0)={0x0, 0x10066d5, 0x2b}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000000340), 0x0) 01:06:26 executing program 2: socketpair(0x22, 0x0, 0x15a, &(0x7f0000000100)) 01:06:26 executing program 4: socketpair(0x2c, 0x0, 0x37, &(0x7f0000000100)) 01:06:26 executing program 3: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x802) mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1000, 0x7) [ 1385.372368][T13384] binder: 13381:13384 unknown command 28 [ 1385.388537][T13384] binder: 13381:13384 ioctl c0306201 20000100 returned -22 01:06:26 executing program 2: socketpair(0x22, 0x0, 0x15b, &(0x7f0000000100)) 01:06:26 executing program 0: ioctl$IOCTL_VMCI_DATAGRAM_SEND(0xffffffffffffffff, 0x7ab, &(0x7f0000000480)={&(0x7f0000000040)={{@any, 0x6}, {@host, 0x2}, 0x400, "fbfec985d0059ee431bcf43bf3f93200d27e98b4f75667bcdd38ed818e38c2a940a244dec9f2e5537191880df9f867410e3a571ae71f51ba6476d5659aa867e26e29cac0d56df0a14b5cd91b6eff20801bd5587ab2e2cd5b09354ea117023beba593a490f8e6ada18f6174f05834f21808308c6f88d23b4e7b7d07d806832607c5902f2d0fa43f70c2d0d181d11c9f00df6b2eaf0b4d833df28ace3372fbcb48f9c1d6da2f014a3da8e68833140b39ff475bf306bc8ea6d7671b269df88eaca11c5bd7b0d2301cf785434e0de59b2981b54523ad0ca85b310a23e287272a0e5bfe2d6b72ab8fa73b0c8b09af5e71d1efd578623f097127b611abf3dcb46bcf37c50c0a3cee7270629bfb9df6e6bbdc81150014bf302913d9ad76cae184dfe2fcc8e72562dd685879ddec3c6c856a16168a7f5a0cda2169b727e11e610cb11721ecb8afa366ceefcca3fc457ede3b8b81d3179a1b6039344fcdb76553675faa46aa534a229b97384ce0a07acc22bd409f6e4e122d53e3e7f28a2f2d3af4e3e4901517a7fbb2aae19f0b09f48f233ca5b567b2a5f05cb1780e8508e9536d602a1006e4ee85e7d9a192b30d02f32069514da7c5727e38ebf0ef6d7275f310c0480c375e1fe742b4b5752845145537641cf0f205c65ef4544fd1c3a42dd868de04ffb4fbcd159e26f3a26a9b3379fa7af33f71738520810879ff090b652aad2ab3471fa468ad243a9c2842b31719ab77014e6df184a97373f6ce2e33884d9d049639941cef395de01d057612889818f8ab73821089a344fc468a544ca26e2cd93ac681b3e3d799c4535b08afcb3007b6e887f303938580c6475ff355de986ca329877f9c9c6b20fe1d650cc1f3594c99607cc54307427903531584cd210805e4668042b22ddc1f39375983133d27325c24f3cb6c328e1a04644515e16e8e388b1e13de31727a5e4c52c46b5f2357538de046e65f5fa067b535aac701af19f65b54f7e04b556b65e68c7f50e263ce2803d8513dc4cea8ba7d0230f32f1e1ad85e6be2812232d60233c512a29525fff507dee46ae3abd9632263e52c39cfa575c5c3ec00484db522cc4522e6923f7935e72afaa312aa243cca120444695110a858191eaa44a256da906a7c127d406ee8c6854c7eb8cafbe2b8122729599aafc32754aaa1ee823532eb3753155efc00e0fdc8103fe4f3ec49c17a6407fb8b809bd7eeae94fe4081f7f029e25a904cc45448243f87935ccc9434d7cbdcd7a278382f952863eaa6e4aad17c3102c13aa7731bfaf1009cbf07fe89f15f3ba2744ad8497d10ac7a10985d0ad008425b604dc9c30cf22a794dd2b3929c1f7cd0b38ab7fdd48b993181fa379f01154b41ced1d636fbc346f378a94e4cd817ae7e1c58b10d93ee68e4bf81529b1d0e3ae7be41567d13d29426128f877b424b1a8be9925f2018e5"}, 0x418, 0x7}) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f00000024c0)={0x2, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = openat$zero(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/zero\x00', 0x100, 0x0) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r2, 0x8000000) r3 = syz_open_dev$sndctrl(&(0x7f0000000580)='/dev/snd/controlC#\x00', 0x1ff, 0x323080) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r2, 0x40182103, &(0x7f00000005c0)={0x0, 0x1, r3, 0x3, 0x80000}) r4 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000600)='/dev/vmci\x00', 0x2, 0x0) ioctl$IOCTL_VMCI_QUEUEPAIR_SETVA(r4, 0x7a4, &(0x7f0000000640)={{@host, 0xfffffff9}, 0xf7, 0xdc27, 0xfffffffd, 0x58}) ioctl$FS_IOC_GET_ENCRYPTION_KEY_STATUS(r1, 0xc080661a, &(0x7f0000000500)={@desc={0x1, 0x0, @desc4='\x85\xba\xa1t\xf0\xcb\x11B'}}) 01:06:26 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x4c, 0x0, 0x0}) 01:06:26 executing program 5: syz_io_uring_setup(0x6787, &(0x7f00000002c0)={0x0, 0x10066d5, 0x2b}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000000340), 0x0) 01:06:26 executing program 4: socketpair(0x2c, 0x0, 0x38, &(0x7f0000000100)) 01:06:26 executing program 3: mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1000, 0x7) 01:06:26 executing program 2: socketpair(0x22, 0x0, 0x15c, &(0x7f0000000100)) [ 1385.582292][T13397] binder: 13395:13397 unknown command 28 [ 1385.613875][T13397] binder: 13395:13397 ioctl c0306201 20000100 returned -22 01:06:26 executing program 5: syz_io_uring_setup(0x6787, &(0x7f00000002c0)={0x0, 0x10066d5, 0x2b}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000000340), 0x0) 01:06:26 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000180)='/dev/zero\x00', 0x0, 0x0) syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x800) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r1, 0x8000000) write$RDMA_USER_CM_CMD_BIND(r1, &(0x7f0000000040)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x1c, 0x0, @in={0x2, 0x4e22, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, 0x90) ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 01:06:26 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x60, 0x0, 0x0}) 01:06:26 executing program 4: socketpair(0x2c, 0x0, 0x39, &(0x7f0000000100)) 01:06:26 executing program 3: mknodat(0xffffffffffffff9c, 0x0, 0x1000, 0x7) 01:06:26 executing program 2: socketpair(0x22, 0x0, 0x15d, &(0x7f0000000100)) 01:06:27 executing program 0: setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, &(0x7f0000000140)={&(0x7f0000000040)=""/244, 0x214000, 0x0, 0x9}, 0x20) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000180)='/dev/binder#\x00', 0x0, 0x802) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000024c0)={0x44, 0x0, &(0x7f00000022c0)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x4, 0x0, &(0x7f0000002400)="c4efa381"}) ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f00000024c0)={0x2, 0x0, 0x0, 0x0, 0x0, 0x0}) 01:06:27 executing program 5: ioctl$IOCTL_VMCI_DATAGRAM_SEND(0xffffffffffffffff, 0x7ab, &(0x7f0000000480)={&(0x7f0000000040)={{@any, 0x6}, {@host, 0x2}, 0x400, "fbfec985d0059ee431bcf43bf3f93200d27e98b4f75667bcdd38ed818e38c2a940a244dec9f2e5537191880df9f867410e3a571ae71f51ba6476d5659aa867e26e29cac0d56df0a14b5cd91b6eff20801bd5587ab2e2cd5b09354ea117023beba593a490f8e6ada18f6174f05834f21808308c6f88d23b4e7b7d07d806832607c5902f2d0fa43f70c2d0d181d11c9f00df6b2eaf0b4d833df28ace3372fbcb48f9c1d6da2f014a3da8e68833140b39ff475bf306bc8ea6d7671b269df88eaca11c5bd7b0d2301cf785434e0de59b2981b54523ad0ca85b310a23e287272a0e5bfe2d6b72ab8fa73b0c8b09af5e71d1efd578623f097127b611abf3dcb46bcf37c50c0a3cee7270629bfb9df6e6bbdc81150014bf302913d9ad76cae184dfe2fcc8e72562dd685879ddec3c6c856a16168a7f5a0cda2169b727e11e610cb11721ecb8afa366ceefcca3fc457ede3b8b81d3179a1b6039344fcdb76553675faa46aa534a229b97384ce0a07acc22bd409f6e4e122d53e3e7f28a2f2d3af4e3e4901517a7fbb2aae19f0b09f48f233ca5b567b2a5f05cb1780e8508e9536d602a1006e4ee85e7d9a192b30d02f32069514da7c5727e38ebf0ef6d7275f310c0480c375e1fe742b4b5752845145537641cf0f205c65ef4544fd1c3a42dd868de04ffb4fbcd159e26f3a26a9b3379fa7af33f71738520810879ff090b652aad2ab3471fa468ad243a9c2842b31719ab77014e6df184a97373f6ce2e33884d9d049639941cef395de01d057612889818f8ab73821089a344fc468a544ca26e2cd93ac681b3e3d799c4535b08afcb3007b6e887f303938580c6475ff355de986ca329877f9c9c6b20fe1d650cc1f3594c99607cc54307427903531584cd210805e4668042b22ddc1f39375983133d27325c24f3cb6c328e1a04644515e16e8e388b1e13de31727a5e4c52c46b5f2357538de046e65f5fa067b535aac701af19f65b54f7e04b556b65e68c7f50e263ce2803d8513dc4cea8ba7d0230f32f1e1ad85e6be2812232d60233c512a29525fff507dee46ae3abd9632263e52c39cfa575c5c3ec00484db522cc4522e6923f7935e72afaa312aa243cca120444695110a858191eaa44a256da906a7c127d406ee8c6854c7eb8cafbe2b8122729599aafc32754aaa1ee823532eb3753155efc00e0fdc8103fe4f3ec49c17a6407fb8b809bd7eeae94fe4081f7f029e25a904cc45448243f87935ccc9434d7cbdcd7a278382f952863eaa6e4aad17c3102c13aa7731bfaf1009cbf07fe89f15f3ba2744ad8497d10ac7a10985d0ad008425b604dc9c30cf22a794dd2b3929c1f7cd0b38ab7fdd48b993181fa379f01154b41ced1d636fbc346f378a94e4cd817ae7e1c58b10d93ee68e4bf81529b1d0e3ae7be41567d13d29426128f877b424b1a8be9925f2018e5"}, 0x418, 0x7}) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f00000024c0)={0x2, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = openat$zero(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/zero\x00', 0x100, 0x0) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r2, 0x8000000) r3 = syz_open_dev$sndctrl(&(0x7f0000000580)='/dev/snd/controlC#\x00', 0x1ff, 0x323080) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r2, 0x40182103, &(0x7f00000005c0)={0x0, 0x1, r3, 0x3, 0x80000}) r4 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000600)='/dev/vmci\x00', 0x2, 0x0) ioctl$IOCTL_VMCI_QUEUEPAIR_SETVA(r4, 0x7a4, &(0x7f0000000640)={{@host, 0xfffffff9}, 0xf7, 0xdc27, 0xfffffffd, 0x58}) ioctl$FS_IOC_GET_ENCRYPTION_KEY_STATUS(r1, 0xc080661a, &(0x7f0000000500)={@desc={0x1, 0x0, @desc4='\x85\xba\xa1t\xf0\xcb\x11B'}}) [ 1385.860913][T13415] binder: 13412:13415 unknown command 28 [ 1385.883270][T13415] binder: 13412:13415 ioctl c0306201 20000100 returned -22 01:06:27 executing program 4: socketpair(0x2c, 0x0, 0x3a, &(0x7f0000000100)) 01:06:27 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x68, 0x0, 0x0}) 01:06:27 executing program 3: mknodat(0xffffffffffffff9c, 0x0, 0x1000, 0x7) 01:06:27 executing program 2: socketpair(0x22, 0x0, 0x15e, &(0x7f0000000100)) [ 1386.046534][T13423] binder: 13421:13423 ioctl c0306201 200024c0 returned -14 01:06:27 executing program 5: ioctl$IOCTL_VMCI_DATAGRAM_SEND(0xffffffffffffffff, 0x7ab, &(0x7f0000000480)={&(0x7f0000000040)={{@any, 0x6}, {@host, 0x2}, 0x400, "fbfec985d0059ee431bcf43bf3f93200d27e98b4f75667bcdd38ed818e38c2a940a244dec9f2e5537191880df9f867410e3a571ae71f51ba6476d5659aa867e26e29cac0d56df0a14b5cd91b6eff20801bd5587ab2e2cd5b09354ea117023beba593a490f8e6ada18f6174f05834f21808308c6f88d23b4e7b7d07d806832607c5902f2d0fa43f70c2d0d181d11c9f00df6b2eaf0b4d833df28ace3372fbcb48f9c1d6da2f014a3da8e68833140b39ff475bf306bc8ea6d7671b269df88eaca11c5bd7b0d2301cf785434e0de59b2981b54523ad0ca85b310a23e287272a0e5bfe2d6b72ab8fa73b0c8b09af5e71d1efd578623f097127b611abf3dcb46bcf37c50c0a3cee7270629bfb9df6e6bbdc81150014bf302913d9ad76cae184dfe2fcc8e72562dd685879ddec3c6c856a16168a7f5a0cda2169b727e11e610cb11721ecb8afa366ceefcca3fc457ede3b8b81d3179a1b6039344fcdb76553675faa46aa534a229b97384ce0a07acc22bd409f6e4e122d53e3e7f28a2f2d3af4e3e4901517a7fbb2aae19f0b09f48f233ca5b567b2a5f05cb1780e8508e9536d602a1006e4ee85e7d9a192b30d02f32069514da7c5727e38ebf0ef6d7275f310c0480c375e1fe742b4b5752845145537641cf0f205c65ef4544fd1c3a42dd868de04ffb4fbcd159e26f3a26a9b3379fa7af33f71738520810879ff090b652aad2ab3471fa468ad243a9c2842b31719ab77014e6df184a97373f6ce2e33884d9d049639941cef395de01d057612889818f8ab73821089a344fc468a544ca26e2cd93ac681b3e3d799c4535b08afcb3007b6e887f303938580c6475ff355de986ca329877f9c9c6b20fe1d650cc1f3594c99607cc54307427903531584cd210805e4668042b22ddc1f39375983133d27325c24f3cb6c328e1a04644515e16e8e388b1e13de31727a5e4c52c46b5f2357538de046e65f5fa067b535aac701af19f65b54f7e04b556b65e68c7f50e263ce2803d8513dc4cea8ba7d0230f32f1e1ad85e6be2812232d60233c512a29525fff507dee46ae3abd9632263e52c39cfa575c5c3ec00484db522cc4522e6923f7935e72afaa312aa243cca120444695110a858191eaa44a256da906a7c127d406ee8c6854c7eb8cafbe2b8122729599aafc32754aaa1ee823532eb3753155efc00e0fdc8103fe4f3ec49c17a6407fb8b809bd7eeae94fe4081f7f029e25a904cc45448243f87935ccc9434d7cbdcd7a278382f952863eaa6e4aad17c3102c13aa7731bfaf1009cbf07fe89f15f3ba2744ad8497d10ac7a10985d0ad008425b604dc9c30cf22a794dd2b3929c1f7cd0b38ab7fdd48b993181fa379f01154b41ced1d636fbc346f378a94e4cd817ae7e1c58b10d93ee68e4bf81529b1d0e3ae7be41567d13d29426128f877b424b1a8be9925f2018e5"}, 0x418, 0x7}) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f00000024c0)={0x2, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = openat$zero(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/zero\x00', 0x100, 0x0) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r2, 0x8000000) r3 = syz_open_dev$sndctrl(&(0x7f0000000580)='/dev/snd/controlC#\x00', 0x1ff, 0x323080) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r2, 0x40182103, &(0x7f00000005c0)={0x0, 0x1, r3, 0x3, 0x80000}) r4 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000600)='/dev/vmci\x00', 0x2, 0x0) ioctl$IOCTL_VMCI_QUEUEPAIR_SETVA(r4, 0x7a4, &(0x7f0000000640)={{@host, 0xfffffff9}, 0xf7, 0xdc27, 0xfffffffd, 0x58}) ioctl$FS_IOC_GET_ENCRYPTION_KEY_STATUS(r1, 0xc080661a, &(0x7f0000000500)={@desc={0x1, 0x0, @desc4='\x85\xba\xa1t\xf0\xcb\x11B'}}) [ 1386.108121][T13430] binder: 13428:13430 unknown command 28 [ 1386.128884][T13430] binder: 13428:13430 ioctl c0306201 20000100 returned -22 01:06:27 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x1c, 0x0, &(0x7f0000001100)=[@request_death={0x400c630e, 0x2}, @dead_binder_done], 0x8f, 0x0, &(0x7f0000001180)="3746d16551dfcf6b8e0b102b3f94e97081cf4f28e5035b7fe166a750519d9006b97de524bf0d24a17c86a47724da9ddc6d80f672287ce06bdaee5d6442193258915e55a695ba25594a07829fae3f3c7fa6b1a08acaa84d174f8e6d7660c5d17b5f598a8cc46634fb99d0051be2fc26b4bd943b4c099a1fe5fc98804346605b50468feb323486959987ff32e3c52c35"}) write$RDMA_USER_CM_CMD_SET_OPTION(0xffffffffffffffff, &(0x7f0000001300)={0xe, 0x18, 0xfa00, @id_afonly={&(0x7f00000012c0)=0x1, 0xffffffffffffffff, 0x0, 0x2, 0x4}}, 0x20) openat$zero(0xffffffffffffff9c, &(0x7f0000001280)='/dev/zero\x00', 0x507000, 0x0) syz_open_dev$sndctrl(&(0x7f0000001340)='/dev/snd/controlC#\x00', 0x7fff, 0x24ac0) 01:06:27 executing program 4: socketpair(0x2c, 0x0, 0x3b, &(0x7f0000000100)) 01:06:27 executing program 3: mknodat(0xffffffffffffff9c, 0x0, 0x1000, 0x7) 01:06:27 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x6c, 0x0, 0x0}) 01:06:27 executing program 2: socketpair(0x22, 0x0, 0x15f, &(0x7f0000000100)) 01:06:27 executing program 3: mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0, 0x7) 01:06:27 executing program 5: ioctl$IOCTL_VMCI_DATAGRAM_SEND(0xffffffffffffffff, 0x7ab, &(0x7f0000000480)={&(0x7f0000000040)={{@any, 0x6}, {@host, 0x2}, 0x400, "fbfec985d0059ee431bcf43bf3f93200d27e98b4f75667bcdd38ed818e38c2a940a244dec9f2e5537191880df9f867410e3a571ae71f51ba6476d5659aa867e26e29cac0d56df0a14b5cd91b6eff20801bd5587ab2e2cd5b09354ea117023beba593a490f8e6ada18f6174f05834f21808308c6f88d23b4e7b7d07d806832607c5902f2d0fa43f70c2d0d181d11c9f00df6b2eaf0b4d833df28ace3372fbcb48f9c1d6da2f014a3da8e68833140b39ff475bf306bc8ea6d7671b269df88eaca11c5bd7b0d2301cf785434e0de59b2981b54523ad0ca85b310a23e287272a0e5bfe2d6b72ab8fa73b0c8b09af5e71d1efd578623f097127b611abf3dcb46bcf37c50c0a3cee7270629bfb9df6e6bbdc81150014bf302913d9ad76cae184dfe2fcc8e72562dd685879ddec3c6c856a16168a7f5a0cda2169b727e11e610cb11721ecb8afa366ceefcca3fc457ede3b8b81d3179a1b6039344fcdb76553675faa46aa534a229b97384ce0a07acc22bd409f6e4e122d53e3e7f28a2f2d3af4e3e4901517a7fbb2aae19f0b09f48f233ca5b567b2a5f05cb1780e8508e9536d602a1006e4ee85e7d9a192b30d02f32069514da7c5727e38ebf0ef6d7275f310c0480c375e1fe742b4b5752845145537641cf0f205c65ef4544fd1c3a42dd868de04ffb4fbcd159e26f3a26a9b3379fa7af33f71738520810879ff090b652aad2ab3471fa468ad243a9c2842b31719ab77014e6df184a97373f6ce2e33884d9d049639941cef395de01d057612889818f8ab73821089a344fc468a544ca26e2cd93ac681b3e3d799c4535b08afcb3007b6e887f303938580c6475ff355de986ca329877f9c9c6b20fe1d650cc1f3594c99607cc54307427903531584cd210805e4668042b22ddc1f39375983133d27325c24f3cb6c328e1a04644515e16e8e388b1e13de31727a5e4c52c46b5f2357538de046e65f5fa067b535aac701af19f65b54f7e04b556b65e68c7f50e263ce2803d8513dc4cea8ba7d0230f32f1e1ad85e6be2812232d60233c512a29525fff507dee46ae3abd9632263e52c39cfa575c5c3ec00484db522cc4522e6923f7935e72afaa312aa243cca120444695110a858191eaa44a256da906a7c127d406ee8c6854c7eb8cafbe2b8122729599aafc32754aaa1ee823532eb3753155efc00e0fdc8103fe4f3ec49c17a6407fb8b809bd7eeae94fe4081f7f029e25a904cc45448243f87935ccc9434d7cbdcd7a278382f952863eaa6e4aad17c3102c13aa7731bfaf1009cbf07fe89f15f3ba2744ad8497d10ac7a10985d0ad008425b604dc9c30cf22a794dd2b3929c1f7cd0b38ab7fdd48b993181fa379f01154b41ced1d636fbc346f378a94e4cd817ae7e1c58b10d93ee68e4bf81529b1d0e3ae7be41567d13d29426128f877b424b1a8be9925f2018e5"}, 0x418, 0x7}) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f00000024c0)={0x2, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = openat$zero(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/zero\x00', 0x100, 0x0) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r2, 0x8000000) r3 = syz_open_dev$sndctrl(&(0x7f0000000580)='/dev/snd/controlC#\x00', 0x1ff, 0x323080) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r2, 0x40182103, &(0x7f00000005c0)={0x0, 0x1, r3, 0x3, 0x80000}) r4 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000600)='/dev/vmci\x00', 0x2, 0x0) ioctl$IOCTL_VMCI_QUEUEPAIR_SETVA(r4, 0x7a4, &(0x7f0000000640)={{@host, 0xfffffff9}, 0xf7, 0xdc27, 0xfffffffd, 0x58}) ioctl$FS_IOC_GET_ENCRYPTION_KEY_STATUS(r1, 0xc080661a, &(0x7f0000000500)={@desc={0x1, 0x0, @desc4='\x85\xba\xa1t\xf0\xcb\x11B'}}) 01:06:27 executing program 0: ioctl$sock_bt_bnep_BNEPGETSUPPFEAT(0xffffffffffffffff, 0x800442d4, &(0x7f0000000040)=0x4) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f00000024c0)={0x2, 0x0, 0x0, 0x0, 0x0, 0x0}) 01:06:27 executing program 4: socketpair(0x2c, 0x0, 0x3c, &(0x7f0000000100)) 01:06:27 executing program 2: socketpair(0x22, 0x0, 0x160, &(0x7f0000000100)) [ 1386.375409][T13446] binder: 13443:13446 unknown command 28 [ 1386.409622][T13446] binder: 13443:13446 ioctl c0306201 20000100 returned -22 01:06:27 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x74, 0x0, 0x0}) 01:06:27 executing program 3: mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0, 0x7) 01:06:27 executing program 4: socketpair(0x2c, 0x0, 0x3d, &(0x7f0000000100)) 01:06:27 executing program 2: socketpair(0x22, 0x0, 0x161, &(0x7f0000000100)) 01:06:27 executing program 0: ioctl$SNDRV_CTL_IOCTL_RAWMIDI_INFO(0xffffffffffffffff, 0xc10c5541, &(0x7f0000000040)={0x4, 0x2f50, 0x1}) openat$ocfs2_control(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ocfs2_control\x00', 0x30800, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x802) ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f00000024c0)={0x2, 0x0, 0x0, 0x0, 0x0, 0x0}) accept(0xffffffffffffffff, &(0x7f0000000200)=@isdn, &(0x7f0000000280)=0x80) 01:06:27 executing program 5: ioctl$IOCTL_VMCI_DATAGRAM_SEND(0xffffffffffffffff, 0x7ab, &(0x7f0000000480)={&(0x7f0000000040)={{@any, 0x6}, {@host, 0x2}, 0x400, "fbfec985d0059ee431bcf43bf3f93200d27e98b4f75667bcdd38ed818e38c2a940a244dec9f2e5537191880df9f867410e3a571ae71f51ba6476d5659aa867e26e29cac0d56df0a14b5cd91b6eff20801bd5587ab2e2cd5b09354ea117023beba593a490f8e6ada18f6174f05834f21808308c6f88d23b4e7b7d07d806832607c5902f2d0fa43f70c2d0d181d11c9f00df6b2eaf0b4d833df28ace3372fbcb48f9c1d6da2f014a3da8e68833140b39ff475bf306bc8ea6d7671b269df88eaca11c5bd7b0d2301cf785434e0de59b2981b54523ad0ca85b310a23e287272a0e5bfe2d6b72ab8fa73b0c8b09af5e71d1efd578623f097127b611abf3dcb46bcf37c50c0a3cee7270629bfb9df6e6bbdc81150014bf302913d9ad76cae184dfe2fcc8e72562dd685879ddec3c6c856a16168a7f5a0cda2169b727e11e610cb11721ecb8afa366ceefcca3fc457ede3b8b81d3179a1b6039344fcdb76553675faa46aa534a229b97384ce0a07acc22bd409f6e4e122d53e3e7f28a2f2d3af4e3e4901517a7fbb2aae19f0b09f48f233ca5b567b2a5f05cb1780e8508e9536d602a1006e4ee85e7d9a192b30d02f32069514da7c5727e38ebf0ef6d7275f310c0480c375e1fe742b4b5752845145537641cf0f205c65ef4544fd1c3a42dd868de04ffb4fbcd159e26f3a26a9b3379fa7af33f71738520810879ff090b652aad2ab3471fa468ad243a9c2842b31719ab77014e6df184a97373f6ce2e33884d9d049639941cef395de01d057612889818f8ab73821089a344fc468a544ca26e2cd93ac681b3e3d799c4535b08afcb3007b6e887f303938580c6475ff355de986ca329877f9c9c6b20fe1d650cc1f3594c99607cc54307427903531584cd210805e4668042b22ddc1f39375983133d27325c24f3cb6c328e1a04644515e16e8e388b1e13de31727a5e4c52c46b5f2357538de046e65f5fa067b535aac701af19f65b54f7e04b556b65e68c7f50e263ce2803d8513dc4cea8ba7d0230f32f1e1ad85e6be2812232d60233c512a29525fff507dee46ae3abd9632263e52c39cfa575c5c3ec00484db522cc4522e6923f7935e72afaa312aa243cca120444695110a858191eaa44a256da906a7c127d406ee8c6854c7eb8cafbe2b8122729599aafc32754aaa1ee823532eb3753155efc00e0fdc8103fe4f3ec49c17a6407fb8b809bd7eeae94fe4081f7f029e25a904cc45448243f87935ccc9434d7cbdcd7a278382f952863eaa6e4aad17c3102c13aa7731bfaf1009cbf07fe89f15f3ba2744ad8497d10ac7a10985d0ad008425b604dc9c30cf22a794dd2b3929c1f7cd0b38ab7fdd48b993181fa379f01154b41ced1d636fbc346f378a94e4cd817ae7e1c58b10d93ee68e4bf81529b1d0e3ae7be41567d13d29426128f877b424b1a8be9925f2018e5"}, 0x418, 0x7}) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f00000024c0)={0x2, 0x0, 0x0, 0x0, 0x0, 0x0}) openat$zero(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/zero\x00', 0x100, 0x0) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r1, 0x8000000) r2 = syz_open_dev$sndctrl(&(0x7f0000000580)='/dev/snd/controlC#\x00', 0x1ff, 0x323080) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r1, 0x40182103, &(0x7f00000005c0)={0x0, 0x1, r2, 0x3, 0x80000}) r3 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000600)='/dev/vmci\x00', 0x2, 0x0) ioctl$IOCTL_VMCI_QUEUEPAIR_SETVA(r3, 0x7a4, &(0x7f0000000640)={{@host, 0xfffffff9}, 0xf7, 0xdc27, 0xfffffffd, 0x58}) [ 1386.620857][T13460] binder: 13458:13460 unknown command 28 01:06:27 executing program 3: mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0, 0x7) [ 1386.668573][T13460] binder: 13458:13460 ioctl c0306201 20000100 returned -22 01:06:27 executing program 2: socketpair(0x22, 0x0, 0x162, &(0x7f0000000100)) 01:06:27 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x7a, 0x0, 0x0}) 01:06:27 executing program 4: socketpair(0x2c, 0x0, 0x3e, &(0x7f0000000100)) 01:06:27 executing program 5: ioctl$IOCTL_VMCI_DATAGRAM_SEND(0xffffffffffffffff, 0x7ab, &(0x7f0000000480)={&(0x7f0000000040)={{@any, 0x6}, {@host, 0x2}, 0x400, "fbfec985d0059ee431bcf43bf3f93200d27e98b4f75667bcdd38ed818e38c2a940a244dec9f2e5537191880df9f867410e3a571ae71f51ba6476d5659aa867e26e29cac0d56df0a14b5cd91b6eff20801bd5587ab2e2cd5b09354ea117023beba593a490f8e6ada18f6174f05834f21808308c6f88d23b4e7b7d07d806832607c5902f2d0fa43f70c2d0d181d11c9f00df6b2eaf0b4d833df28ace3372fbcb48f9c1d6da2f014a3da8e68833140b39ff475bf306bc8ea6d7671b269df88eaca11c5bd7b0d2301cf785434e0de59b2981b54523ad0ca85b310a23e287272a0e5bfe2d6b72ab8fa73b0c8b09af5e71d1efd578623f097127b611abf3dcb46bcf37c50c0a3cee7270629bfb9df6e6bbdc81150014bf302913d9ad76cae184dfe2fcc8e72562dd685879ddec3c6c856a16168a7f5a0cda2169b727e11e610cb11721ecb8afa366ceefcca3fc457ede3b8b81d3179a1b6039344fcdb76553675faa46aa534a229b97384ce0a07acc22bd409f6e4e122d53e3e7f28a2f2d3af4e3e4901517a7fbb2aae19f0b09f48f233ca5b567b2a5f05cb1780e8508e9536d602a1006e4ee85e7d9a192b30d02f32069514da7c5727e38ebf0ef6d7275f310c0480c375e1fe742b4b5752845145537641cf0f205c65ef4544fd1c3a42dd868de04ffb4fbcd159e26f3a26a9b3379fa7af33f71738520810879ff090b652aad2ab3471fa468ad243a9c2842b31719ab77014e6df184a97373f6ce2e33884d9d049639941cef395de01d057612889818f8ab73821089a344fc468a544ca26e2cd93ac681b3e3d799c4535b08afcb3007b6e887f303938580c6475ff355de986ca329877f9c9c6b20fe1d650cc1f3594c99607cc54307427903531584cd210805e4668042b22ddc1f39375983133d27325c24f3cb6c328e1a04644515e16e8e388b1e13de31727a5e4c52c46b5f2357538de046e65f5fa067b535aac701af19f65b54f7e04b556b65e68c7f50e263ce2803d8513dc4cea8ba7d0230f32f1e1ad85e6be2812232d60233c512a29525fff507dee46ae3abd9632263e52c39cfa575c5c3ec00484db522cc4522e6923f7935e72afaa312aa243cca120444695110a858191eaa44a256da906a7c127d406ee8c6854c7eb8cafbe2b8122729599aafc32754aaa1ee823532eb3753155efc00e0fdc8103fe4f3ec49c17a6407fb8b809bd7eeae94fe4081f7f029e25a904cc45448243f87935ccc9434d7cbdcd7a278382f952863eaa6e4aad17c3102c13aa7731bfaf1009cbf07fe89f15f3ba2744ad8497d10ac7a10985d0ad008425b604dc9c30cf22a794dd2b3929c1f7cd0b38ab7fdd48b993181fa379f01154b41ced1d636fbc346f378a94e4cd817ae7e1c58b10d93ee68e4bf81529b1d0e3ae7be41567d13d29426128f877b424b1a8be9925f2018e5"}, 0x418, 0x7}) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f00000024c0)={0x2, 0x0, 0x0, 0x0, 0x0, 0x0}) openat$zero(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/zero\x00', 0x100, 0x0) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r1, 0x8000000) r2 = syz_open_dev$sndctrl(&(0x7f0000000580)='/dev/snd/controlC#\x00', 0x1ff, 0x323080) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r1, 0x40182103, &(0x7f00000005c0)={0x0, 0x1, r2, 0x3, 0x80000}) ioctl$IOCTL_VMCI_QUEUEPAIR_SETVA(0xffffffffffffffff, 0x7a4, &(0x7f0000000640)={{@host, 0xfffffff9}, 0xf7, 0xdc27, 0xfffffffd, 0x58}) 01:06:27 executing program 3: mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1000, 0x0) 01:06:27 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x2) ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f00000024c0)={0x2, 0x0, 0x0, 0x0, 0x0, 0x0}) 01:06:28 executing program 2: socketpair(0x22, 0x0, 0x163, &(0x7f0000000100)) [ 1386.895552][T13477] binder: 13474:13477 unknown command 28 [ 1386.913193][T13477] binder: 13474:13477 ioctl c0306201 20000100 returned -22 01:06:28 executing program 4: socketpair(0x2c, 0x0, 0x41, &(0x7f0000000100)) 01:06:28 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x300, 0x0, 0x0}) 01:06:28 executing program 5: ioctl$IOCTL_VMCI_DATAGRAM_SEND(0xffffffffffffffff, 0x7ab, &(0x7f0000000480)={&(0x7f0000000040)={{@any, 0x6}, {@host, 0x2}, 0x400, "fbfec985d0059ee431bcf43bf3f93200d27e98b4f75667bcdd38ed818e38c2a940a244dec9f2e5537191880df9f867410e3a571ae71f51ba6476d5659aa867e26e29cac0d56df0a14b5cd91b6eff20801bd5587ab2e2cd5b09354ea117023beba593a490f8e6ada18f6174f05834f21808308c6f88d23b4e7b7d07d806832607c5902f2d0fa43f70c2d0d181d11c9f00df6b2eaf0b4d833df28ace3372fbcb48f9c1d6da2f014a3da8e68833140b39ff475bf306bc8ea6d7671b269df88eaca11c5bd7b0d2301cf785434e0de59b2981b54523ad0ca85b310a23e287272a0e5bfe2d6b72ab8fa73b0c8b09af5e71d1efd578623f097127b611abf3dcb46bcf37c50c0a3cee7270629bfb9df6e6bbdc81150014bf302913d9ad76cae184dfe2fcc8e72562dd685879ddec3c6c856a16168a7f5a0cda2169b727e11e610cb11721ecb8afa366ceefcca3fc457ede3b8b81d3179a1b6039344fcdb76553675faa46aa534a229b97384ce0a07acc22bd409f6e4e122d53e3e7f28a2f2d3af4e3e4901517a7fbb2aae19f0b09f48f233ca5b567b2a5f05cb1780e8508e9536d602a1006e4ee85e7d9a192b30d02f32069514da7c5727e38ebf0ef6d7275f310c0480c375e1fe742b4b5752845145537641cf0f205c65ef4544fd1c3a42dd868de04ffb4fbcd159e26f3a26a9b3379fa7af33f71738520810879ff090b652aad2ab3471fa468ad243a9c2842b31719ab77014e6df184a97373f6ce2e33884d9d049639941cef395de01d057612889818f8ab73821089a344fc468a544ca26e2cd93ac681b3e3d799c4535b08afcb3007b6e887f303938580c6475ff355de986ca329877f9c9c6b20fe1d650cc1f3594c99607cc54307427903531584cd210805e4668042b22ddc1f39375983133d27325c24f3cb6c328e1a04644515e16e8e388b1e13de31727a5e4c52c46b5f2357538de046e65f5fa067b535aac701af19f65b54f7e04b556b65e68c7f50e263ce2803d8513dc4cea8ba7d0230f32f1e1ad85e6be2812232d60233c512a29525fff507dee46ae3abd9632263e52c39cfa575c5c3ec00484db522cc4522e6923f7935e72afaa312aa243cca120444695110a858191eaa44a256da906a7c127d406ee8c6854c7eb8cafbe2b8122729599aafc32754aaa1ee823532eb3753155efc00e0fdc8103fe4f3ec49c17a6407fb8b809bd7eeae94fe4081f7f029e25a904cc45448243f87935ccc9434d7cbdcd7a278382f952863eaa6e4aad17c3102c13aa7731bfaf1009cbf07fe89f15f3ba2744ad8497d10ac7a10985d0ad008425b604dc9c30cf22a794dd2b3929c1f7cd0b38ab7fdd48b993181fa379f01154b41ced1d636fbc346f378a94e4cd817ae7e1c58b10d93ee68e4bf81529b1d0e3ae7be41567d13d29426128f877b424b1a8be9925f2018e5"}, 0x418, 0x7}) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f00000024c0)={0x2, 0x0, 0x0, 0x0, 0x0, 0x0}) openat$zero(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/zero\x00', 0x100, 0x0) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r1, 0x8000000) r2 = syz_open_dev$sndctrl(&(0x7f0000000580)='/dev/snd/controlC#\x00', 0x1ff, 0x323080) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r1, 0x40182103, &(0x7f00000005c0)={0x0, 0x1, r2, 0x3, 0x80000}) ioctl$IOCTL_VMCI_QUEUEPAIR_SETVA(0xffffffffffffffff, 0x7a4, &(0x7f0000000640)={{@host, 0xfffffff9}, 0xf7, 0xdc27, 0xfffffffd, 0x58}) 01:06:28 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x1c, 0x0, &(0x7f0000001100)=[@request_death={0x400c630e, 0x2}, @dead_binder_done], 0x8f, 0x0, &(0x7f0000001180)="3746d16551dfcf6b8e0b102b3f94e97081cf4f28e5035b7fe166a750519d9006b97de524bf0d24a17c86a47724da9ddc6d80f672287ce06bdaee5d6442193258915e55a695ba25594a07829fae3f3c7fa6b1a08acaa84d174f8e6d7660c5d17b5f598a8cc46634fb99d0051be2fc26b4bd943b4c099a1fe5fc98804346605b50468feb323486959987ff32e3c52c35"}) write$RDMA_USER_CM_CMD_SET_OPTION(0xffffffffffffffff, &(0x7f0000001300)={0xe, 0x18, 0xfa00, @id_afonly={&(0x7f00000012c0)=0x1, 0xffffffffffffffff, 0x0, 0x2, 0x4}}, 0x20) openat$zero(0xffffffffffffff9c, &(0x7f0000001280)='/dev/zero\x00', 0x507000, 0x0) syz_open_dev$sndctrl(&(0x7f0000001340)='/dev/snd/controlC#\x00', 0x7fff, 0x24ac0) 01:06:28 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) bind$xdp(0xffffffffffffffff, &(0x7f0000000040)={0x2c, 0xa, 0x0, 0x1f}, 0x10) ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f00000024c0)={0x2, 0x0, 0x0, 0x0, 0x0, 0x0}) 01:06:28 executing program 2: socketpair(0x22, 0x0, 0x164, &(0x7f0000000100)) 01:06:28 executing program 4: socketpair(0x2c, 0x0, 0x42, &(0x7f0000000100)) [ 1387.141527][T13493] binder: 13489:13493 unknown command 28 [ 1387.172035][T13493] binder: 13489:13493 ioctl c0306201 20000100 returned -22 01:06:28 executing program 5: ioctl$IOCTL_VMCI_DATAGRAM_SEND(0xffffffffffffffff, 0x7ab, &(0x7f0000000480)={&(0x7f0000000040)={{@any, 0x6}, {@host, 0x2}, 0x400, "fbfec985d0059ee431bcf43bf3f93200d27e98b4f75667bcdd38ed818e38c2a940a244dec9f2e5537191880df9f867410e3a571ae71f51ba6476d5659aa867e26e29cac0d56df0a14b5cd91b6eff20801bd5587ab2e2cd5b09354ea117023beba593a490f8e6ada18f6174f05834f21808308c6f88d23b4e7b7d07d806832607c5902f2d0fa43f70c2d0d181d11c9f00df6b2eaf0b4d833df28ace3372fbcb48f9c1d6da2f014a3da8e68833140b39ff475bf306bc8ea6d7671b269df88eaca11c5bd7b0d2301cf785434e0de59b2981b54523ad0ca85b310a23e287272a0e5bfe2d6b72ab8fa73b0c8b09af5e71d1efd578623f097127b611abf3dcb46bcf37c50c0a3cee7270629bfb9df6e6bbdc81150014bf302913d9ad76cae184dfe2fcc8e72562dd685879ddec3c6c856a16168a7f5a0cda2169b727e11e610cb11721ecb8afa366ceefcca3fc457ede3b8b81d3179a1b6039344fcdb76553675faa46aa534a229b97384ce0a07acc22bd409f6e4e122d53e3e7f28a2f2d3af4e3e4901517a7fbb2aae19f0b09f48f233ca5b567b2a5f05cb1780e8508e9536d602a1006e4ee85e7d9a192b30d02f32069514da7c5727e38ebf0ef6d7275f310c0480c375e1fe742b4b5752845145537641cf0f205c65ef4544fd1c3a42dd868de04ffb4fbcd159e26f3a26a9b3379fa7af33f71738520810879ff090b652aad2ab3471fa468ad243a9c2842b31719ab77014e6df184a97373f6ce2e33884d9d049639941cef395de01d057612889818f8ab73821089a344fc468a544ca26e2cd93ac681b3e3d799c4535b08afcb3007b6e887f303938580c6475ff355de986ca329877f9c9c6b20fe1d650cc1f3594c99607cc54307427903531584cd210805e4668042b22ddc1f39375983133d27325c24f3cb6c328e1a04644515e16e8e388b1e13de31727a5e4c52c46b5f2357538de046e65f5fa067b535aac701af19f65b54f7e04b556b65e68c7f50e263ce2803d8513dc4cea8ba7d0230f32f1e1ad85e6be2812232d60233c512a29525fff507dee46ae3abd9632263e52c39cfa575c5c3ec00484db522cc4522e6923f7935e72afaa312aa243cca120444695110a858191eaa44a256da906a7c127d406ee8c6854c7eb8cafbe2b8122729599aafc32754aaa1ee823532eb3753155efc00e0fdc8103fe4f3ec49c17a6407fb8b809bd7eeae94fe4081f7f029e25a904cc45448243f87935ccc9434d7cbdcd7a278382f952863eaa6e4aad17c3102c13aa7731bfaf1009cbf07fe89f15f3ba2744ad8497d10ac7a10985d0ad008425b604dc9c30cf22a794dd2b3929c1f7cd0b38ab7fdd48b993181fa379f01154b41ced1d636fbc346f378a94e4cd817ae7e1c58b10d93ee68e4bf81529b1d0e3ae7be41567d13d29426128f877b424b1a8be9925f2018e5"}, 0x418, 0x7}) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f00000024c0)={0x2, 0x0, 0x0, 0x0, 0x0, 0x0}) openat$zero(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/zero\x00', 0x100, 0x0) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r1, 0x8000000) r2 = syz_open_dev$sndctrl(&(0x7f0000000580)='/dev/snd/controlC#\x00', 0x1ff, 0x323080) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r1, 0x40182103, &(0x7f00000005c0)={0x0, 0x1, r2, 0x3, 0x80000}) ioctl$IOCTL_VMCI_QUEUEPAIR_SETVA(0xffffffffffffffff, 0x7a4, &(0x7f0000000640)={{@host, 0xfffffff9}, 0xf7, 0xdc27, 0xfffffffd, 0x58}) 01:06:28 executing program 2: socketpair(0x22, 0x0, 0x165, &(0x7f0000000100)) 01:06:28 executing program 3: socketpair(0x22, 0x0, 0x158, &(0x7f0000000100)) 01:06:28 executing program 0: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r0, 0x8000000) ioctl$KVM_HYPERV_EVENTFD(0xffffffffffffffff, 0x4018aebd, &(0x7f00000000c0)={0x3, r0}) io_uring_setup(0x1f40, &(0x7f0000000180)={0x0, 0x12d8, 0x2, 0x2, 0x13a}) ioctl$FS_IOC_GET_ENCRYPTION_PWSALT(r0, 0x40106614, &(0x7f0000000140)) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r1, 0x8000000) ioctl$vim2m_VIDIOC_QUERYBUF(0xffffffffffffffff, 0xc0585609, &(0x7f0000000040)={0x16, 0x2, 0x4, 0xe000, 0x46, {}, {0x5, 0xc, 0xe0, 0x3, 0xc0, 0xff, "fc858b5f"}, 0x824, 0x3, @userptr=0x20000000000000, 0x8, 0x0, r1}) r2 = socket$bt_cmtp(0x1f, 0x3, 0x5) setsockopt$bt_BT_FLUSHABLE(r2, 0x112, 0x8, &(0x7f0000000100), 0x4) r3 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0x5421, &(0x7f00000024c0)={0x2, 0x0, 0x0, 0x0, 0x0, 0x0}) 01:06:28 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x500, 0x0, 0x0}) 01:06:28 executing program 4: socketpair(0x2c, 0x0, 0x43, &(0x7f0000000100)) 01:06:28 executing program 5: ioctl$IOCTL_VMCI_DATAGRAM_SEND(0xffffffffffffffff, 0x7ab, &(0x7f0000000480)={&(0x7f0000000040)={{@any, 0x6}, {@host, 0x2}, 0x400, "fbfec985d0059ee431bcf43bf3f93200d27e98b4f75667bcdd38ed818e38c2a940a244dec9f2e5537191880df9f867410e3a571ae71f51ba6476d5659aa867e26e29cac0d56df0a14b5cd91b6eff20801bd5587ab2e2cd5b09354ea117023beba593a490f8e6ada18f6174f05834f21808308c6f88d23b4e7b7d07d806832607c5902f2d0fa43f70c2d0d181d11c9f00df6b2eaf0b4d833df28ace3372fbcb48f9c1d6da2f014a3da8e68833140b39ff475bf306bc8ea6d7671b269df88eaca11c5bd7b0d2301cf785434e0de59b2981b54523ad0ca85b310a23e287272a0e5bfe2d6b72ab8fa73b0c8b09af5e71d1efd578623f097127b611abf3dcb46bcf37c50c0a3cee7270629bfb9df6e6bbdc81150014bf302913d9ad76cae184dfe2fcc8e72562dd685879ddec3c6c856a16168a7f5a0cda2169b727e11e610cb11721ecb8afa366ceefcca3fc457ede3b8b81d3179a1b6039344fcdb76553675faa46aa534a229b97384ce0a07acc22bd409f6e4e122d53e3e7f28a2f2d3af4e3e4901517a7fbb2aae19f0b09f48f233ca5b567b2a5f05cb1780e8508e9536d602a1006e4ee85e7d9a192b30d02f32069514da7c5727e38ebf0ef6d7275f310c0480c375e1fe742b4b5752845145537641cf0f205c65ef4544fd1c3a42dd868de04ffb4fbcd159e26f3a26a9b3379fa7af33f71738520810879ff090b652aad2ab3471fa468ad243a9c2842b31719ab77014e6df184a97373f6ce2e33884d9d049639941cef395de01d057612889818f8ab73821089a344fc468a544ca26e2cd93ac681b3e3d799c4535b08afcb3007b6e887f303938580c6475ff355de986ca329877f9c9c6b20fe1d650cc1f3594c99607cc54307427903531584cd210805e4668042b22ddc1f39375983133d27325c24f3cb6c328e1a04644515e16e8e388b1e13de31727a5e4c52c46b5f2357538de046e65f5fa067b535aac701af19f65b54f7e04b556b65e68c7f50e263ce2803d8513dc4cea8ba7d0230f32f1e1ad85e6be2812232d60233c512a29525fff507dee46ae3abd9632263e52c39cfa575c5c3ec00484db522cc4522e6923f7935e72afaa312aa243cca120444695110a858191eaa44a256da906a7c127d406ee8c6854c7eb8cafbe2b8122729599aafc32754aaa1ee823532eb3753155efc00e0fdc8103fe4f3ec49c17a6407fb8b809bd7eeae94fe4081f7f029e25a904cc45448243f87935ccc9434d7cbdcd7a278382f952863eaa6e4aad17c3102c13aa7731bfaf1009cbf07fe89f15f3ba2744ad8497d10ac7a10985d0ad008425b604dc9c30cf22a794dd2b3929c1f7cd0b38ab7fdd48b993181fa379f01154b41ced1d636fbc346f378a94e4cd817ae7e1c58b10d93ee68e4bf81529b1d0e3ae7be41567d13d29426128f877b424b1a8be9925f2018e5"}, 0x418, 0x7}) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f00000024c0)={0x2, 0x0, 0x0, 0x0, 0x0, 0x0}) openat$zero(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/zero\x00', 0x100, 0x0) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r1, 0x8000000) syz_open_dev$sndctrl(&(0x7f0000000580)='/dev/snd/controlC#\x00', 0x1ff, 0x323080) r2 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000600)='/dev/vmci\x00', 0x2, 0x0) ioctl$IOCTL_VMCI_QUEUEPAIR_SETVA(r2, 0x7a4, &(0x7f0000000640)={{@host, 0xfffffff9}, 0xf7, 0xdc27, 0xfffffffd, 0x58}) 01:06:28 executing program 2: socketpair(0x22, 0x0, 0x166, &(0x7f0000000100)) 01:06:28 executing program 3: ioctl$IOCTL_VMCI_DATAGRAM_SEND(0xffffffffffffffff, 0x7ab, &(0x7f0000000480)={&(0x7f0000000040)={{@any, 0x6}, {@host, 0x2}, 0x400, "fbfec985d0059ee431bcf43bf3f93200d27e98b4f75667bcdd38ed818e38c2a940a244dec9f2e5537191880df9f867410e3a571ae71f51ba6476d5659aa867e26e29cac0d56df0a14b5cd91b6eff20801bd5587ab2e2cd5b09354ea117023beba593a490f8e6ada18f6174f05834f21808308c6f88d23b4e7b7d07d806832607c5902f2d0fa43f70c2d0d181d11c9f00df6b2eaf0b4d833df28ace3372fbcb48f9c1d6da2f014a3da8e68833140b39ff475bf306bc8ea6d7671b269df88eaca11c5bd7b0d2301cf785434e0de59b2981b54523ad0ca85b310a23e287272a0e5bfe2d6b72ab8fa73b0c8b09af5e71d1efd578623f097127b611abf3dcb46bcf37c50c0a3cee7270629bfb9df6e6bbdc81150014bf302913d9ad76cae184dfe2fcc8e72562dd685879ddec3c6c856a16168a7f5a0cda2169b727e11e610cb11721ecb8afa366ceefcca3fc457ede3b8b81d3179a1b6039344fcdb76553675faa46aa534a229b97384ce0a07acc22bd409f6e4e122d53e3e7f28a2f2d3af4e3e4901517a7fbb2aae19f0b09f48f233ca5b567b2a5f05cb1780e8508e9536d602a1006e4ee85e7d9a192b30d02f32069514da7c5727e38ebf0ef6d7275f310c0480c375e1fe742b4b5752845145537641cf0f205c65ef4544fd1c3a42dd868de04ffb4fbcd159e26f3a26a9b3379fa7af33f71738520810879ff090b652aad2ab3471fa468ad243a9c2842b31719ab77014e6df184a97373f6ce2e33884d9d049639941cef395de01d057612889818f8ab73821089a344fc468a544ca26e2cd93ac681b3e3d799c4535b08afcb3007b6e887f303938580c6475ff355de986ca329877f9c9c6b20fe1d650cc1f3594c99607cc54307427903531584cd210805e4668042b22ddc1f39375983133d27325c24f3cb6c328e1a04644515e16e8e388b1e13de31727a5e4c52c46b5f2357538de046e65f5fa067b535aac701af19f65b54f7e04b556b65e68c7f50e263ce2803d8513dc4cea8ba7d0230f32f1e1ad85e6be2812232d60233c512a29525fff507dee46ae3abd9632263e52c39cfa575c5c3ec00484db522cc4522e6923f7935e72afaa312aa243cca120444695110a858191eaa44a256da906a7c127d406ee8c6854c7eb8cafbe2b8122729599aafc32754aaa1ee823532eb3753155efc00e0fdc8103fe4f3ec49c17a6407fb8b809bd7eeae94fe4081f7f029e25a904cc45448243f87935ccc9434d7cbdcd7a278382f952863eaa6e4aad17c3102c13aa7731bfaf1009cbf07fe89f15f3ba2744ad8497d10ac7a10985d0ad008425b604dc9c30cf22a794dd2b3929c1f7cd0b38ab7fdd48b993181fa379f01154b41ced1d636fbc346f378a94e4cd817ae7e1c58b10d93ee68e4bf81529b1d0e3ae7be41567d13d29426128f877b424b1a8be9925f2018e5"}, 0x418, 0x7}) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f00000024c0)={0x2, 0x0, 0x0, 0x0, 0x0, 0x0}) openat$zero(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/zero\x00', 0x100, 0x0) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r1, 0x8000000) r2 = syz_open_dev$sndctrl(&(0x7f0000000580)='/dev/snd/controlC#\x00', 0x1ff, 0x323080) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r1, 0x40182103, &(0x7f00000005c0)={0x0, 0x1, r2, 0x3, 0x80000}) ioctl$IOCTL_VMCI_QUEUEPAIR_SETVA(0xffffffffffffffff, 0x7a4, &(0x7f0000000640)={{@host, 0xfffffff9}, 0xf7, 0xdc27, 0xfffffffd, 0x58}) [ 1387.415811][T13511] binder: 13509:13511 unknown command 28 [ 1387.445711][T13511] binder: 13509:13511 ioctl c0306201 20000100 returned -22 01:06:28 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x600, 0x0, 0x0}) 01:06:28 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f00000024c0)={0x2, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r1, 0x8000000) ioctl$UDMABUF_CREATE_LIST(0xffffffffffffffff, 0x40087543, &(0x7f0000000100)={0x0, 0x1, [{r1, 0x0, 0x1bf4bed36aea7ba1, 0x100000000}]}) syz_emit_vhci(&(0x7f0000000080)=@HCI_ACLDATA_PKT={0x2, {0xc9, 0x1, 0x1, 0x12}, @l2cap_cid_le_signaling={{0xe}, @l2cap_le_conn_rsp={{0x15, 0x38, 0xa}, {0x3, 0x4d4, 0x1, 0x2, 0x2}}}}, 0x17) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r2, 0x8000000) write$eventfd(r2, &(0x7f00000000c0)=0x8, 0x8) socket$bt_cmtp(0x1f, 0x3, 0x5) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000140)='/dev/zero\x00', 0x101000, 0x0) r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r4, 0x8000000) setsockopt$bt_BT_FLUSHABLE(r4, 0x112, 0x8, &(0x7f00000001c0)=0x5, 0x4) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r3, 0x40182103, &(0x7f0000000180)={0x0, 0x0, r0, 0x1}) write$RDMA_USER_CM_CMD_GET_EVENT(r2, &(0x7f0000000040)={0xc, 0x8, 0xfa00, {&(0x7f0000000240)}}, 0x10) 01:06:28 executing program 2: socketpair(0x22, 0x0, 0x167, &(0x7f0000000100)) 01:06:28 executing program 5: ioctl$IOCTL_VMCI_DATAGRAM_SEND(0xffffffffffffffff, 0x7ab, &(0x7f0000000480)={&(0x7f0000000040)={{@any, 0x6}, {@host, 0x2}, 0x400, "fbfec985d0059ee431bcf43bf3f93200d27e98b4f75667bcdd38ed818e38c2a940a244dec9f2e5537191880df9f867410e3a571ae71f51ba6476d5659aa867e26e29cac0d56df0a14b5cd91b6eff20801bd5587ab2e2cd5b09354ea117023beba593a490f8e6ada18f6174f05834f21808308c6f88d23b4e7b7d07d806832607c5902f2d0fa43f70c2d0d181d11c9f00df6b2eaf0b4d833df28ace3372fbcb48f9c1d6da2f014a3da8e68833140b39ff475bf306bc8ea6d7671b269df88eaca11c5bd7b0d2301cf785434e0de59b2981b54523ad0ca85b310a23e287272a0e5bfe2d6b72ab8fa73b0c8b09af5e71d1efd578623f097127b611abf3dcb46bcf37c50c0a3cee7270629bfb9df6e6bbdc81150014bf302913d9ad76cae184dfe2fcc8e72562dd685879ddec3c6c856a16168a7f5a0cda2169b727e11e610cb11721ecb8afa366ceefcca3fc457ede3b8b81d3179a1b6039344fcdb76553675faa46aa534a229b97384ce0a07acc22bd409f6e4e122d53e3e7f28a2f2d3af4e3e4901517a7fbb2aae19f0b09f48f233ca5b567b2a5f05cb1780e8508e9536d602a1006e4ee85e7d9a192b30d02f32069514da7c5727e38ebf0ef6d7275f310c0480c375e1fe742b4b5752845145537641cf0f205c65ef4544fd1c3a42dd868de04ffb4fbcd159e26f3a26a9b3379fa7af33f71738520810879ff090b652aad2ab3471fa468ad243a9c2842b31719ab77014e6df184a97373f6ce2e33884d9d049639941cef395de01d057612889818f8ab73821089a344fc468a544ca26e2cd93ac681b3e3d799c4535b08afcb3007b6e887f303938580c6475ff355de986ca329877f9c9c6b20fe1d650cc1f3594c99607cc54307427903531584cd210805e4668042b22ddc1f39375983133d27325c24f3cb6c328e1a04644515e16e8e388b1e13de31727a5e4c52c46b5f2357538de046e65f5fa067b535aac701af19f65b54f7e04b556b65e68c7f50e263ce2803d8513dc4cea8ba7d0230f32f1e1ad85e6be2812232d60233c512a29525fff507dee46ae3abd9632263e52c39cfa575c5c3ec00484db522cc4522e6923f7935e72afaa312aa243cca120444695110a858191eaa44a256da906a7c127d406ee8c6854c7eb8cafbe2b8122729599aafc32754aaa1ee823532eb3753155efc00e0fdc8103fe4f3ec49c17a6407fb8b809bd7eeae94fe4081f7f029e25a904cc45448243f87935ccc9434d7cbdcd7a278382f952863eaa6e4aad17c3102c13aa7731bfaf1009cbf07fe89f15f3ba2744ad8497d10ac7a10985d0ad008425b604dc9c30cf22a794dd2b3929c1f7cd0b38ab7fdd48b993181fa379f01154b41ced1d636fbc346f378a94e4cd817ae7e1c58b10d93ee68e4bf81529b1d0e3ae7be41567d13d29426128f877b424b1a8be9925f2018e5"}, 0x418, 0x7}) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f00000024c0)={0x2, 0x0, 0x0, 0x0, 0x0, 0x0}) openat$zero(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/zero\x00', 0x100, 0x0) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r1, 0x8000000) r2 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000600)='/dev/vmci\x00', 0x2, 0x0) ioctl$IOCTL_VMCI_QUEUEPAIR_SETVA(r2, 0x7a4, &(0x7f0000000640)={{@host, 0xfffffff9}, 0xf7, 0xdc27, 0xfffffffd, 0x58}) 01:06:28 executing program 4: socketpair(0x2c, 0x0, 0x44, &(0x7f0000000100)) 01:06:28 executing program 3: socketpair(0x2c, 0x0, 0x34, &(0x7f0000000100)) [ 1387.646440][T13524] binder: 13522:13524 unknown command 28 [ 1387.665443][T13524] binder: 13522:13524 ioctl c0306201 20000100 returned -22 01:06:28 executing program 2: socketpair(0x22, 0x0, 0x168, &(0x7f0000000100)) 01:06:28 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x700, 0x0, 0x0}) 01:06:28 executing program 0: syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x5, 0x24280) fanotify_mark(0xffffffffffffffff, 0x0, 0x1022, 0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00') r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ubi_ctrl\x00', 0x18000, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_LIST(r0, 0xc0505510, &(0x7f0000000280)={0x72, 0x0, 0x0, 0xbb3, &(0x7f0000000100)}) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(0xffffffffffffffff, 0x7, &(0x7f0000000000), 0x1) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0x5421, &(0x7f00000024c0)={0x2, 0x0, 0x0, 0x0, 0x0, 0x0}) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000140), 0x2, 0x2}}, 0x20) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) sendmsg$SMC_PNETID_DEL(r0, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000340)={&(0x7f0000000240)={0x2c, 0x0, 0x20, 0x70bd2c, 0x25dfdbfe, {}, [@SMC_PNETID_NAME={0x9, 0x1, 'syz2\x00'}, @SMC_PNETID_IBNAME={0x9, 0x3, 'syz0\x00'}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000000}, 0x1) r2 = eventfd2(0x7, 0x80800) ioctl$KVM_HYPERV_EVENTFD(r1, 0x4018aebd, &(0x7f0000000300)={0x0, r2}) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r1, 0x8000000) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0)={0xaa, 0x40}) ioctl$KVM_HYPERV_EVENTFD(r1, 0x4018aebd, &(0x7f0000000080)={0x0, 0xffffffffffffffff, 0x1}) 01:06:28 executing program 5: ioctl$IOCTL_VMCI_DATAGRAM_SEND(0xffffffffffffffff, 0x7ab, &(0x7f0000000480)={&(0x7f0000000040)={{@any, 0x6}, {@host, 0x2}, 0x400, "fbfec985d0059ee431bcf43bf3f93200d27e98b4f75667bcdd38ed818e38c2a940a244dec9f2e5537191880df9f867410e3a571ae71f51ba6476d5659aa867e26e29cac0d56df0a14b5cd91b6eff20801bd5587ab2e2cd5b09354ea117023beba593a490f8e6ada18f6174f05834f21808308c6f88d23b4e7b7d07d806832607c5902f2d0fa43f70c2d0d181d11c9f00df6b2eaf0b4d833df28ace3372fbcb48f9c1d6da2f014a3da8e68833140b39ff475bf306bc8ea6d7671b269df88eaca11c5bd7b0d2301cf785434e0de59b2981b54523ad0ca85b310a23e287272a0e5bfe2d6b72ab8fa73b0c8b09af5e71d1efd578623f097127b611abf3dcb46bcf37c50c0a3cee7270629bfb9df6e6bbdc81150014bf302913d9ad76cae184dfe2fcc8e72562dd685879ddec3c6c856a16168a7f5a0cda2169b727e11e610cb11721ecb8afa366ceefcca3fc457ede3b8b81d3179a1b6039344fcdb76553675faa46aa534a229b97384ce0a07acc22bd409f6e4e122d53e3e7f28a2f2d3af4e3e4901517a7fbb2aae19f0b09f48f233ca5b567b2a5f05cb1780e8508e9536d602a1006e4ee85e7d9a192b30d02f32069514da7c5727e38ebf0ef6d7275f310c0480c375e1fe742b4b5752845145537641cf0f205c65ef4544fd1c3a42dd868de04ffb4fbcd159e26f3a26a9b3379fa7af33f71738520810879ff090b652aad2ab3471fa468ad243a9c2842b31719ab77014e6df184a97373f6ce2e33884d9d049639941cef395de01d057612889818f8ab73821089a344fc468a544ca26e2cd93ac681b3e3d799c4535b08afcb3007b6e887f303938580c6475ff355de986ca329877f9c9c6b20fe1d650cc1f3594c99607cc54307427903531584cd210805e4668042b22ddc1f39375983133d27325c24f3cb6c328e1a04644515e16e8e388b1e13de31727a5e4c52c46b5f2357538de046e65f5fa067b535aac701af19f65b54f7e04b556b65e68c7f50e263ce2803d8513dc4cea8ba7d0230f32f1e1ad85e6be2812232d60233c512a29525fff507dee46ae3abd9632263e52c39cfa575c5c3ec00484db522cc4522e6923f7935e72afaa312aa243cca120444695110a858191eaa44a256da906a7c127d406ee8c6854c7eb8cafbe2b8122729599aafc32754aaa1ee823532eb3753155efc00e0fdc8103fe4f3ec49c17a6407fb8b809bd7eeae94fe4081f7f029e25a904cc45448243f87935ccc9434d7cbdcd7a278382f952863eaa6e4aad17c3102c13aa7731bfaf1009cbf07fe89f15f3ba2744ad8497d10ac7a10985d0ad008425b604dc9c30cf22a794dd2b3929c1f7cd0b38ab7fdd48b993181fa379f01154b41ced1d636fbc346f378a94e4cd817ae7e1c58b10d93ee68e4bf81529b1d0e3ae7be41567d13d29426128f877b424b1a8be9925f2018e5"}, 0x418, 0x7}) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f00000024c0)={0x2, 0x0, 0x0, 0x0, 0x0, 0x0}) openat$zero(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/zero\x00', 0x100, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) r1 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000600)='/dev/vmci\x00', 0x2, 0x0) ioctl$IOCTL_VMCI_QUEUEPAIR_SETVA(r1, 0x7a4, &(0x7f0000000640)={{@host, 0xfffffff9}, 0xf7, 0xdc27, 0xfffffffd, 0x58}) 01:06:28 executing program 4: socketpair(0x2c, 0x0, 0x45, &(0x7f0000000100)) 01:06:29 executing program 2: socketpair(0x22, 0x0, 0x169, &(0x7f0000000100)) 01:06:29 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x600, 0x0, 0x0}) 01:06:29 executing program 0: ioctl$SNDRV_CTL_IOCTL_ELEM_LIST(0xffffffffffffffff, 0xc0505510, &(0x7f0000000100)={0x4fb, 0x3, 0x8, 0x2, &(0x7f0000000040)=[{}, {}, {}]}) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f00000024c0)={0x2, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000740)='/dev/ubi_ctrl\x00', 0x503000, 0x0) getsockopt$XDP_STATISTICS(r1, 0x11b, 0x7, &(0x7f0000000780), &(0x7f00000007c0)=0x30) [ 1387.932596][T13540] binder: 13538:13540 unknown command 28 [ 1387.963293][T13540] binder: 13538:13540 ioctl c0306201 20000100 returned -22 01:06:29 executing program 4: socketpair(0x2c, 0x0, 0x46, &(0x7f0000000100)) 01:06:29 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x1557, 0x0, 0x0}) 01:06:29 executing program 5: ioctl$IOCTL_VMCI_DATAGRAM_SEND(0xffffffffffffffff, 0x7ab, &(0x7f0000000480)={&(0x7f0000000040)={{@any, 0x6}, {@host, 0x2}, 0x400, "fbfec985d0059ee431bcf43bf3f93200d27e98b4f75667bcdd38ed818e38c2a940a244dec9f2e5537191880df9f867410e3a571ae71f51ba6476d5659aa867e26e29cac0d56df0a14b5cd91b6eff20801bd5587ab2e2cd5b09354ea117023beba593a490f8e6ada18f6174f05834f21808308c6f88d23b4e7b7d07d806832607c5902f2d0fa43f70c2d0d181d11c9f00df6b2eaf0b4d833df28ace3372fbcb48f9c1d6da2f014a3da8e68833140b39ff475bf306bc8ea6d7671b269df88eaca11c5bd7b0d2301cf785434e0de59b2981b54523ad0ca85b310a23e287272a0e5bfe2d6b72ab8fa73b0c8b09af5e71d1efd578623f097127b611abf3dcb46bcf37c50c0a3cee7270629bfb9df6e6bbdc81150014bf302913d9ad76cae184dfe2fcc8e72562dd685879ddec3c6c856a16168a7f5a0cda2169b727e11e610cb11721ecb8afa366ceefcca3fc457ede3b8b81d3179a1b6039344fcdb76553675faa46aa534a229b97384ce0a07acc22bd409f6e4e122d53e3e7f28a2f2d3af4e3e4901517a7fbb2aae19f0b09f48f233ca5b567b2a5f05cb1780e8508e9536d602a1006e4ee85e7d9a192b30d02f32069514da7c5727e38ebf0ef6d7275f310c0480c375e1fe742b4b5752845145537641cf0f205c65ef4544fd1c3a42dd868de04ffb4fbcd159e26f3a26a9b3379fa7af33f71738520810879ff090b652aad2ab3471fa468ad243a9c2842b31719ab77014e6df184a97373f6ce2e33884d9d049639941cef395de01d057612889818f8ab73821089a344fc468a544ca26e2cd93ac681b3e3d799c4535b08afcb3007b6e887f303938580c6475ff355de986ca329877f9c9c6b20fe1d650cc1f3594c99607cc54307427903531584cd210805e4668042b22ddc1f39375983133d27325c24f3cb6c328e1a04644515e16e8e388b1e13de31727a5e4c52c46b5f2357538de046e65f5fa067b535aac701af19f65b54f7e04b556b65e68c7f50e263ce2803d8513dc4cea8ba7d0230f32f1e1ad85e6be2812232d60233c512a29525fff507dee46ae3abd9632263e52c39cfa575c5c3ec00484db522cc4522e6923f7935e72afaa312aa243cca120444695110a858191eaa44a256da906a7c127d406ee8c6854c7eb8cafbe2b8122729599aafc32754aaa1ee823532eb3753155efc00e0fdc8103fe4f3ec49c17a6407fb8b809bd7eeae94fe4081f7f029e25a904cc45448243f87935ccc9434d7cbdcd7a278382f952863eaa6e4aad17c3102c13aa7731bfaf1009cbf07fe89f15f3ba2744ad8497d10ac7a10985d0ad008425b604dc9c30cf22a794dd2b3929c1f7cd0b38ab7fdd48b993181fa379f01154b41ced1d636fbc346f378a94e4cd817ae7e1c58b10d93ee68e4bf81529b1d0e3ae7be41567d13d29426128f877b424b1a8be9925f2018e5"}, 0x418, 0x7}) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f00000024c0)={0x2, 0x0, 0x0, 0x0, 0x0, 0x0}) openat$zero(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/zero\x00', 0x100, 0x0) r1 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000600)='/dev/vmci\x00', 0x2, 0x0) ioctl$IOCTL_VMCI_QUEUEPAIR_SETVA(r1, 0x7a4, &(0x7f0000000640)={{@host, 0xfffffff9}, 0xf7, 0xdc27, 0xfffffffd, 0x58}) [ 1388.022944][T13549] binder: 13547:13549 unknown command 28 [ 1388.044441][T13549] binder: 13547:13549 ioctl c0306201 20000100 returned -22 01:06:29 executing program 2: socketpair(0x22, 0x0, 0x16a, &(0x7f0000000100)) 01:06:29 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f00000024c0)={0x2, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r1, 0x8000000) io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000040)=r1, 0x1) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r2, 0x8000000) sendmsg$AUDIT_SIGNAL_INFO(r2, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x10, 0x3f2, 0x200, 0x70bd2a, 0x25dfdbfd, "", ["", "", "", "", "", "", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x4}, 0x48811) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000180)='net/psched\x00') renameat(r3, &(0x7f00000001c0)='./file0\x00', r2, &(0x7f0000000200)='./file0\x00') 01:06:29 executing program 3: ioctl$SNDRV_CTL_IOCTL_ELEM_LIST(0xffffffffffffffff, 0xc0505510, &(0x7f0000000100)={0x4fb, 0x3, 0x8, 0x2, &(0x7f0000000040)=[{}, {}, {}]}) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f00000024c0)={0x2, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000740)='/dev/ubi_ctrl\x00', 0x503000, 0x0) getsockopt$XDP_STATISTICS(r1, 0x11b, 0x7, &(0x7f0000000780), &(0x7f00000007c0)=0x30) 01:06:29 executing program 4: socketpair(0x2c, 0x0, 0x47, &(0x7f0000000100)) [ 1388.182995][T13559] binder: 13556:13559 unknown command 28 [ 1388.211756][T13559] binder: 13556:13559 ioctl c0306201 20000100 returned -22 01:06:29 executing program 5: ioctl$IOCTL_VMCI_DATAGRAM_SEND(0xffffffffffffffff, 0x7ab, &(0x7f0000000480)={&(0x7f0000000040)={{@any, 0x6}, {@host, 0x2}, 0x400, "fbfec985d0059ee431bcf43bf3f93200d27e98b4f75667bcdd38ed818e38c2a940a244dec9f2e5537191880df9f867410e3a571ae71f51ba6476d5659aa867e26e29cac0d56df0a14b5cd91b6eff20801bd5587ab2e2cd5b09354ea117023beba593a490f8e6ada18f6174f05834f21808308c6f88d23b4e7b7d07d806832607c5902f2d0fa43f70c2d0d181d11c9f00df6b2eaf0b4d833df28ace3372fbcb48f9c1d6da2f014a3da8e68833140b39ff475bf306bc8ea6d7671b269df88eaca11c5bd7b0d2301cf785434e0de59b2981b54523ad0ca85b310a23e287272a0e5bfe2d6b72ab8fa73b0c8b09af5e71d1efd578623f097127b611abf3dcb46bcf37c50c0a3cee7270629bfb9df6e6bbdc81150014bf302913d9ad76cae184dfe2fcc8e72562dd685879ddec3c6c856a16168a7f5a0cda2169b727e11e610cb11721ecb8afa366ceefcca3fc457ede3b8b81d3179a1b6039344fcdb76553675faa46aa534a229b97384ce0a07acc22bd409f6e4e122d53e3e7f28a2f2d3af4e3e4901517a7fbb2aae19f0b09f48f233ca5b567b2a5f05cb1780e8508e9536d602a1006e4ee85e7d9a192b30d02f32069514da7c5727e38ebf0ef6d7275f310c0480c375e1fe742b4b5752845145537641cf0f205c65ef4544fd1c3a42dd868de04ffb4fbcd159e26f3a26a9b3379fa7af33f71738520810879ff090b652aad2ab3471fa468ad243a9c2842b31719ab77014e6df184a97373f6ce2e33884d9d049639941cef395de01d057612889818f8ab73821089a344fc468a544ca26e2cd93ac681b3e3d799c4535b08afcb3007b6e887f303938580c6475ff355de986ca329877f9c9c6b20fe1d650cc1f3594c99607cc54307427903531584cd210805e4668042b22ddc1f39375983133d27325c24f3cb6c328e1a04644515e16e8e388b1e13de31727a5e4c52c46b5f2357538de046e65f5fa067b535aac701af19f65b54f7e04b556b65e68c7f50e263ce2803d8513dc4cea8ba7d0230f32f1e1ad85e6be2812232d60233c512a29525fff507dee46ae3abd9632263e52c39cfa575c5c3ec00484db522cc4522e6923f7935e72afaa312aa243cca120444695110a858191eaa44a256da906a7c127d406ee8c6854c7eb8cafbe2b8122729599aafc32754aaa1ee823532eb3753155efc00e0fdc8103fe4f3ec49c17a6407fb8b809bd7eeae94fe4081f7f029e25a904cc45448243f87935ccc9434d7cbdcd7a278382f952863eaa6e4aad17c3102c13aa7731bfaf1009cbf07fe89f15f3ba2744ad8497d10ac7a10985d0ad008425b604dc9c30cf22a794dd2b3929c1f7cd0b38ab7fdd48b993181fa379f01154b41ced1d636fbc346f378a94e4cd817ae7e1c58b10d93ee68e4bf81529b1d0e3ae7be41567d13d29426128f877b424b1a8be9925f2018e5"}, 0x418, 0x7}) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f00000024c0)={0x2, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000600)='/dev/vmci\x00', 0x2, 0x0) ioctl$IOCTL_VMCI_QUEUEPAIR_SETVA(r1, 0x7a4, &(0x7f0000000640)={{@host, 0xfffffff9}, 0xf7, 0xdc27, 0xfffffffd, 0x58}) 01:06:29 executing program 2: socketpair(0x22, 0x0, 0x16b, &(0x7f0000000100)) 01:06:29 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x1558, 0x0, 0x0}) 01:06:29 executing program 4: socketpair(0x2c, 0x0, 0x48, &(0x7f0000000100)) 01:06:29 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f00000024c0)={0x2, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000080)={0x5, &(0x7f0000000000)=[{0x6000, 0x1, 0x1f, 0x4}, {0x100, 0x4f, 0x0, 0x8000}, {0x800, 0x59, 0x2, 0x2008}, {0x9, 0x6, 0x48, 0x400}, {0x1, 0x80, 0x3, 0x8}]}) ioctl$SECCOMP_IOCTL_NOTIF_ID_VALID(r1, 0x40082102, &(0x7f00000000c0)) 01:06:29 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x5, 0x0, 0x0}) 01:06:29 executing program 5: ioctl$IOCTL_VMCI_DATAGRAM_SEND(0xffffffffffffffff, 0x7ab, &(0x7f0000000480)={&(0x7f0000000040)={{@any, 0x6}, {@host, 0x2}, 0x400, "fbfec985d0059ee431bcf43bf3f93200d27e98b4f75667bcdd38ed818e38c2a940a244dec9f2e5537191880df9f867410e3a571ae71f51ba6476d5659aa867e26e29cac0d56df0a14b5cd91b6eff20801bd5587ab2e2cd5b09354ea117023beba593a490f8e6ada18f6174f05834f21808308c6f88d23b4e7b7d07d806832607c5902f2d0fa43f70c2d0d181d11c9f00df6b2eaf0b4d833df28ace3372fbcb48f9c1d6da2f014a3da8e68833140b39ff475bf306bc8ea6d7671b269df88eaca11c5bd7b0d2301cf785434e0de59b2981b54523ad0ca85b310a23e287272a0e5bfe2d6b72ab8fa73b0c8b09af5e71d1efd578623f097127b611abf3dcb46bcf37c50c0a3cee7270629bfb9df6e6bbdc81150014bf302913d9ad76cae184dfe2fcc8e72562dd685879ddec3c6c856a16168a7f5a0cda2169b727e11e610cb11721ecb8afa366ceefcca3fc457ede3b8b81d3179a1b6039344fcdb76553675faa46aa534a229b97384ce0a07acc22bd409f6e4e122d53e3e7f28a2f2d3af4e3e4901517a7fbb2aae19f0b09f48f233ca5b567b2a5f05cb1780e8508e9536d602a1006e4ee85e7d9a192b30d02f32069514da7c5727e38ebf0ef6d7275f310c0480c375e1fe742b4b5752845145537641cf0f205c65ef4544fd1c3a42dd868de04ffb4fbcd159e26f3a26a9b3379fa7af33f71738520810879ff090b652aad2ab3471fa468ad243a9c2842b31719ab77014e6df184a97373f6ce2e33884d9d049639941cef395de01d057612889818f8ab73821089a344fc468a544ca26e2cd93ac681b3e3d799c4535b08afcb3007b6e887f303938580c6475ff355de986ca329877f9c9c6b20fe1d650cc1f3594c99607cc54307427903531584cd210805e4668042b22ddc1f39375983133d27325c24f3cb6c328e1a04644515e16e8e388b1e13de31727a5e4c52c46b5f2357538de046e65f5fa067b535aac701af19f65b54f7e04b556b65e68c7f50e263ce2803d8513dc4cea8ba7d0230f32f1e1ad85e6be2812232d60233c512a29525fff507dee46ae3abd9632263e52c39cfa575c5c3ec00484db522cc4522e6923f7935e72afaa312aa243cca120444695110a858191eaa44a256da906a7c127d406ee8c6854c7eb8cafbe2b8122729599aafc32754aaa1ee823532eb3753155efc00e0fdc8103fe4f3ec49c17a6407fb8b809bd7eeae94fe4081f7f029e25a904cc45448243f87935ccc9434d7cbdcd7a278382f952863eaa6e4aad17c3102c13aa7731bfaf1009cbf07fe89f15f3ba2744ad8497d10ac7a10985d0ad008425b604dc9c30cf22a794dd2b3929c1f7cd0b38ab7fdd48b993181fa379f01154b41ced1d636fbc346f378a94e4cd817ae7e1c58b10d93ee68e4bf81529b1d0e3ae7be41567d13d29426128f877b424b1a8be9925f2018e5"}, 0x418, 0x7}) syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000600)='/dev/vmci\x00', 0x2, 0x0) ioctl$IOCTL_VMCI_QUEUEPAIR_SETVA(r0, 0x7a4, &(0x7f0000000640)={{@host, 0xfffffff9}, 0xf7, 0xdc27, 0xfffffffd, 0x58}) [ 1388.455291][T13574] binder: 13571:13574 unknown command 28 [ 1388.469246][T13574] binder: 13571:13574 ioctl c0306201 20000100 returned -22 01:06:29 executing program 2: socketpair(0x22, 0x0, 0x16c, &(0x7f0000000100)) 01:06:29 executing program 4: socketpair(0x2c, 0x0, 0x49, &(0x7f0000000100)) [ 1388.504269][T13578] binder: 13576:13578 unknown command 28 [ 1388.543288][T13578] binder: 13576:13578 ioctl c0306201 20000100 returned -22 01:06:29 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x1f00, 0x0, 0x0}) 01:06:29 executing program 3: syz_io_uring_setup(0x6787, &(0x7f00000002c0)={0x0, 0x10066d5, 0x0, 0x2, 0x42}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) 01:06:29 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r1, 0x8000000) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(0xffffffffffffffff, 0x7, &(0x7f0000000040)=r1, 0x1) ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f00000024c0)={0x2, 0x0, 0x0, 0x0, 0x0, 0x0}) 01:06:29 executing program 5: ioctl$IOCTL_VMCI_DATAGRAM_SEND(0xffffffffffffffff, 0x7ab, &(0x7f0000000480)={&(0x7f0000000040)={{@any, 0x6}, {@host, 0x2}, 0x400, "fbfec985d0059ee431bcf43bf3f93200d27e98b4f75667bcdd38ed818e38c2a940a244dec9f2e5537191880df9f867410e3a571ae71f51ba6476d5659aa867e26e29cac0d56df0a14b5cd91b6eff20801bd5587ab2e2cd5b09354ea117023beba593a490f8e6ada18f6174f05834f21808308c6f88d23b4e7b7d07d806832607c5902f2d0fa43f70c2d0d181d11c9f00df6b2eaf0b4d833df28ace3372fbcb48f9c1d6da2f014a3da8e68833140b39ff475bf306bc8ea6d7671b269df88eaca11c5bd7b0d2301cf785434e0de59b2981b54523ad0ca85b310a23e287272a0e5bfe2d6b72ab8fa73b0c8b09af5e71d1efd578623f097127b611abf3dcb46bcf37c50c0a3cee7270629bfb9df6e6bbdc81150014bf302913d9ad76cae184dfe2fcc8e72562dd685879ddec3c6c856a16168a7f5a0cda2169b727e11e610cb11721ecb8afa366ceefcca3fc457ede3b8b81d3179a1b6039344fcdb76553675faa46aa534a229b97384ce0a07acc22bd409f6e4e122d53e3e7f28a2f2d3af4e3e4901517a7fbb2aae19f0b09f48f233ca5b567b2a5f05cb1780e8508e9536d602a1006e4ee85e7d9a192b30d02f32069514da7c5727e38ebf0ef6d7275f310c0480c375e1fe742b4b5752845145537641cf0f205c65ef4544fd1c3a42dd868de04ffb4fbcd159e26f3a26a9b3379fa7af33f71738520810879ff090b652aad2ab3471fa468ad243a9c2842b31719ab77014e6df184a97373f6ce2e33884d9d049639941cef395de01d057612889818f8ab73821089a344fc468a544ca26e2cd93ac681b3e3d799c4535b08afcb3007b6e887f303938580c6475ff355de986ca329877f9c9c6b20fe1d650cc1f3594c99607cc54307427903531584cd210805e4668042b22ddc1f39375983133d27325c24f3cb6c328e1a04644515e16e8e388b1e13de31727a5e4c52c46b5f2357538de046e65f5fa067b535aac701af19f65b54f7e04b556b65e68c7f50e263ce2803d8513dc4cea8ba7d0230f32f1e1ad85e6be2812232d60233c512a29525fff507dee46ae3abd9632263e52c39cfa575c5c3ec00484db522cc4522e6923f7935e72afaa312aa243cca120444695110a858191eaa44a256da906a7c127d406ee8c6854c7eb8cafbe2b8122729599aafc32754aaa1ee823532eb3753155efc00e0fdc8103fe4f3ec49c17a6407fb8b809bd7eeae94fe4081f7f029e25a904cc45448243f87935ccc9434d7cbdcd7a278382f952863eaa6e4aad17c3102c13aa7731bfaf1009cbf07fe89f15f3ba2744ad8497d10ac7a10985d0ad008425b604dc9c30cf22a794dd2b3929c1f7cd0b38ab7fdd48b993181fa379f01154b41ced1d636fbc346f378a94e4cd817ae7e1c58b10d93ee68e4bf81529b1d0e3ae7be41567d13d29426128f877b424b1a8be9925f2018e5"}, 0x418, 0x7}) r0 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000600)='/dev/vmci\x00', 0x2, 0x0) ioctl$IOCTL_VMCI_QUEUEPAIR_SETVA(r0, 0x7a4, &(0x7f0000000640)={{@host, 0xfffffff9}, 0xf7, 0xdc27, 0xfffffffd, 0x58}) 01:06:29 executing program 2: socketpair(0x22, 0x0, 0x16d, &(0x7f0000000100)) [ 1388.686425][T13588] binder: 13587:13588 unknown command 28 [ 1388.720879][T13588] binder: 13587:13588 ioctl c0306201 20000100 returned -22 01:06:29 executing program 4: socketpair(0x2c, 0x0, 0x4a, &(0x7f0000000100)) 01:06:29 executing program 5: r0 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000600)='/dev/vmci\x00', 0x2, 0x0) ioctl$IOCTL_VMCI_QUEUEPAIR_SETVA(r0, 0x7a4, &(0x7f0000000640)={{@host, 0xfffffff9}, 0xf7, 0xdc27, 0xfffffffd, 0x58}) 01:06:29 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x2000, 0x0, 0x0}) 01:06:29 executing program 3: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000040)='/dev/zero\x00', 0x1, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x2, &(0x7f00000000c0)={0xffffffffffffffff}, 0x106, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r0, &(0x7f0000000140)={0x10, 0x30, 0xfa00, {&(0x7f0000000080), 0x3, {0xa, 0x4e21, 0x400, @mcast1, 0x3}, r1}}, 0x38) 01:06:29 executing program 2: socketpair(0x22, 0x0, 0x16e, &(0x7f0000000100)) 01:06:30 executing program 0: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY_ALL_USERS(0xffffffffffffff9c, 0xc0406619, &(0x7f0000000040)={@id={0x2, 0x0, @b='\x91*\xe5\x10\xa4Xr:\x83\x9a\x9f\xadp\x158\xac'}}) 01:06:30 executing program 4: socketpair(0x2c, 0x0, 0x4b, &(0x7f0000000100)) [ 1388.931671][T13605] binder: 13602:13605 unknown command 28 [ 1388.962062][T13605] binder: 13602:13605 ioctl c0306201 20000100 returned -22 01:06:30 executing program 5: r0 = openat$vmci(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$IOCTL_VMCI_QUEUEPAIR_SETVA(r0, 0x7a4, &(0x7f0000000640)={{@host, 0xfffffff9}, 0xf7, 0xdc27, 0xfffffffd, 0x58}) 01:06:30 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) pipe(&(0x7f00000001c0)={0xffffffffffffffff}) getsockopt$bt_BT_SECURITY(r2, 0x112, 0x4, &(0x7f0000000200), 0x2) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r1, 0x8000000) r3 = syz_genetlink_get_family_id$smc(&(0x7f0000000080)='SMC_PNETID\x00', 0xffffffffffffffff) sendmsg$SMC_PNETID_FLUSH(r1, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000140)={&(0x7f0000000240)={0x7c, r3, 0x300, 0x70bd27, 0x25dfdbfb, {}, [@SMC_PNETID_IBPORT={0x0, 0x4, 0x2}, @SMC_PNETID_IBPORT={0x5, 0x4, 0x1}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'macsec0\x00'}, @SMC_PNETID_IBPORT={0x5, 0x4, 0x1}, @SMC_PNETID_ETHNAME={0x0, 0x2, 'veth1\x00'}, @SMC_PNETID_NAME={0x9, 0x1, 'syz0\x00'}, @SMC_PNETID_NAME={0x67, 0x1, 'syz2\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'macsec0\x00'}]}, 0x7c}, 0x1, 0x0, 0x0, 0x2004c014}, 0x8888) ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f00000024c0)={0x2, 0x0, 0x0, 0x0, 0x0, 0x0}) 01:06:30 executing program 2: socketpair(0x22, 0x0, 0x16f, &(0x7f0000000100)) 01:06:30 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x4800, 0x0, 0x0}) 01:06:30 executing program 3: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r0, 0x8000000) r1 = io_uring_setup(0xc42, &(0x7f0000000080)={0x0, 0x14a2, 0x1, 0x3, 0x4, 0x0, r0}) r2 = io_uring_setup(0x7e05, &(0x7f0000000100)={0x0, 0x2d53, 0x20, 0x3, 0x3f, 0x0, r1}) r3 = openat$zero(0xffffffffffffff9c, &(0x7f00000007c0)='/dev/zero\x00', 0x7f187f66c4f689d0, 0x0) setsockopt$XDP_UMEM_FILL_RING(r3, 0x11b, 0x5, &(0x7f0000000800)=0x200400, 0x4) r4 = syz_io_uring_setup(0x65ec, &(0x7f0000000600)={0x0, 0x36fd, 0x4, 0x3, 0x147, 0x0, r3}, &(0x7f0000ff9000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000540), &(0x7f0000000680)) syz_io_uring_setup(0x6787, &(0x7f00000002c0)={0x0, 0x10066d5, 0x2b, 0x2, 0x42, 0x0, r4}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) io_uring_setup(0x51d5, &(0x7f0000000180)={0x0, 0x6119, 0x10, 0x2, 0x251, 0x0, r2}) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='mounts\x00') 01:06:30 executing program 5: r0 = openat$vmci(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$IOCTL_VMCI_QUEUEPAIR_SETVA(r0, 0x7a4, &(0x7f0000000640)={{@host, 0xfffffff9}, 0xf7, 0xdc27, 0xfffffffd, 0x58}) 01:06:30 executing program 4: socketpair(0x2c, 0x0, 0x4c, &(0x7f0000000100)) [ 1389.167726][T13620] binder: 13616:13620 unknown command 28 [ 1389.193538][T13620] binder: 13616:13620 ioctl c0306201 20000100 returned -22 01:06:30 executing program 2: socketpair(0x22, 0x0, 0x170, &(0x7f0000000100)) 01:06:30 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x802) ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f00000024c0)={0x2, 0x0, 0x0, 0x0, 0x0, 0x0}) 01:06:30 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x4c00, 0x0, 0x0}) 01:06:30 executing program 5: r0 = openat$vmci(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$IOCTL_VMCI_QUEUEPAIR_SETVA(r0, 0x7a4, &(0x7f0000000640)={{@host, 0xfffffff9}, 0xf7, 0xdc27, 0xfffffffd, 0x58}) 01:06:30 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x4800, 0x0, 0x0}) 01:06:30 executing program 4: socketpair(0x2c, 0x0, 0x4d, &(0x7f0000000100)) [ 1389.386623][T13632] binder: 13630:13632 unknown command 28 [ 1389.394339][T13637] binder: 13633:13637 unknown command 28 [ 1389.406068][T13632] binder: 13630:13632 ioctl c0306201 20000100 returned -22 01:06:30 executing program 2: socketpair(0x22, 0x0, 0x171, &(0x7f0000000100)) 01:06:30 executing program 5: openat$vmci(0xffffffffffffff9c, &(0x7f0000000600)='/dev/vmci\x00', 0x2, 0x0) ioctl$IOCTL_VMCI_QUEUEPAIR_SETVA(0xffffffffffffffff, 0x7a4, &(0x7f0000000640)={{@host, 0xfffffff9}, 0xf7, 0xdc27, 0xfffffffd, 0x58}) [ 1389.441483][T13637] binder: 13633:13637 ioctl c0306201 20000100 returned -22 01:06:30 executing program 0: fanotify_init(0x0, 0x2000) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f00000024c0)={0x2, 0x0, 0x0, 0x0, 0x0, 0x0}) 01:06:30 executing program 3: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x2) r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x20401) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x3, 0xa2, 0x80000000, 'syz0\x00', 0x8}, 0x1, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8, 0x0, 0x2, 0x39, 0x6, 0x9, 0x1, 0x7, 0x7, 0x6]}) rseq(&(0x7f0000000040)={0x0, 0x0, 0x0, 0x1}, 0x20, 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_PREFER_SUBDEVICE(r0, 0x40045542, &(0x7f00000005c0)=0x2) 01:06:30 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x5715, 0x0, 0x0}) 01:06:30 executing program 4: socketpair(0x2c, 0x0, 0x4e, &(0x7f0000000100)) 01:06:30 executing program 2: socketpair(0x22, 0x0, 0x172, &(0x7f0000000100)) 01:06:30 executing program 3: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x2) r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x20401) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x3, 0xa2, 0x80000000, 'syz0\x00', 0x8}, 0x1, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8, 0x0, 0x2, 0x39, 0x6, 0x9, 0x1, 0x7, 0x7, 0x6]}) rseq(&(0x7f0000000040)={0x0, 0x0, 0x0, 0x1}, 0x20, 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_PREFER_SUBDEVICE(r0, 0x40045542, &(0x7f00000005c0)=0x2) 01:06:30 executing program 5: openat$vmci(0xffffffffffffff9c, &(0x7f0000000600)='/dev/vmci\x00', 0x2, 0x0) ioctl$IOCTL_VMCI_QUEUEPAIR_SETVA(0xffffffffffffffff, 0x7a4, &(0x7f0000000640)={{@host, 0xfffffff9}, 0xf7, 0xdc27, 0xfffffffd, 0x58}) 01:06:30 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x802) ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f00000024c0)={0x2, 0x0, 0x0, 0x0, 0x0, 0x0}) socket$bt_cmtp(0x1f, 0x3, 0x5) [ 1389.684559][T13651] binder: 13650:13651 unknown command 28 [ 1389.718542][T13651] binder: 13650:13651 ioctl c0306201 20000100 returned -22 01:06:30 executing program 4: socketpair(0x2c, 0x0, 0x4f, &(0x7f0000000100)) 01:06:30 executing program 5: openat$vmci(0xffffffffffffff9c, &(0x7f0000000600)='/dev/vmci\x00', 0x2, 0x0) ioctl$IOCTL_VMCI_QUEUEPAIR_SETVA(0xffffffffffffffff, 0x7a4, &(0x7f0000000640)={{@host, 0xfffffff9}, 0xf7, 0xdc27, 0xfffffffd, 0x58}) 01:06:30 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x5815, 0x0, 0x0}) 01:06:31 executing program 2: socketpair(0x22, 0x0, 0x173, &(0x7f0000000100)) 01:06:31 executing program 3: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x2) r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x20401) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x3, 0xa2, 0x80000000, 'syz0\x00', 0x8}, 0x1, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8, 0x0, 0x2, 0x39, 0x6, 0x9, 0x1, 0x7, 0x7, 0x6]}) rseq(&(0x7f0000000040)={0x0, 0x0, 0x0, 0x1}, 0x20, 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_PREFER_SUBDEVICE(r0, 0x40045542, &(0x7f00000005c0)=0x2) 01:06:31 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r1, 0x8000000) ioctl$SECCOMP_IOCTL_NOTIF_ID_VALID(r1, 0x40082102, &(0x7f0000000040)) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_PREFER_SUBDEVICE(r1, 0x40045542, &(0x7f00000002c0)=0x200) ioctl$SNDRV_CTL_IOCTL_TLV_COMMAND(r1, 0xc008551c, &(0x7f0000000300)={0x5, 0x8, [0x3, 0xfffffffe]}) ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f00000024c0)={0x2, 0x0, 0x0, 0x0, 0x0, 0x0}) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r1, &(0x7f0000000340)={0x5, 0x10, 0xfa00, {&(0x7f0000000080), 0xffffffffffffffff, 0x1}}, 0x18) 01:06:31 executing program 4: socketpair(0x2c, 0x0, 0x50, &(0x7f0000000100)) 01:06:31 executing program 2: socketpair(0x22, 0x0, 0x174, &(0x7f0000000100)) [ 1389.978216][T13671] binder: 13667:13671 unknown command 28 01:06:31 executing program 5: r0 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000600)='/dev/vmci\x00', 0x2, 0x0) ioctl$IOCTL_VMCI_QUEUEPAIR_SETVA(r0, 0x7a4, 0x0) 01:06:31 executing program 3: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x2) r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x20401) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x3, 0xa2, 0x80000000, 'syz0\x00', 0x8}, 0x1, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8, 0x0, 0x2, 0x39, 0x6, 0x9, 0x1, 0x7, 0x7, 0x6]}) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_PREFER_SUBDEVICE(r0, 0x40045542, &(0x7f00000005c0)=0x2) [ 1390.038409][T13671] binder: 13667:13671 ioctl c0306201 20000100 returned -22 01:06:31 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x6000, 0x0, 0x0}) 01:06:31 executing program 0: ioctl$IOCTL_VMCI_DATAGRAM_SEND(0xffffffffffffffff, 0x7ab, &(0x7f0000000680)={&(0x7f0000000240)={{@any, 0xffff}, {@host, 0x1}, 0x400, "bcdf106edfc3f9cc412452617506a369d810858bee7ce2661cc8e7df633b936448676ce94b6ebb356b89e112e721a6dace8e02f4a421221e4ded7132540836cd4a398362ca3fc601f259cf385c7cf93ce4b10a5e47d07f44531a9b353eea90fc4ac720c48c7d10bf3209033a822796a5cf7e956429079e8a4b928a664b7730387e2356eed1ce1ace2aea0514ad2dc2fc2a68a0cb9381f7a9af9dfd0d79562df465ff3daa14286c46c925b3ff55e2c940489e4efbb0f774b7cb41eadbb94ab17fd2d821d8ee9155dca63677e77b30b0f959713a5d93b613f4dcd85d918dda303914dd26d7fd7c6b22b4ea9557e6cb03ef8a3aee42dac1c158a5e543baf483e427b5b6fc2aa493e7052fd94dd4b684acf41d6ed1d06de92a3db90b2276f156944847773795103dc0bb97cf9dc0be79757b1e1143ed7d42cacf430176a34fb3c28e3843f54c8ed3957f96372388de46f68fb1cbc6fe8ebca8e52f3159897e579773bab102b962fb607956269acdfcda7fb5e30b87491cce886eb8b51a4df5a7bcf9b98259c61a8b7ac4e350844ac3090b2fdf82d787b869c5ee239b05c72d809ddeef906d0170c2247d8961df0994a51391c266bfc3cadd43189cd7a086a50ee799885d1a40a2a69ea0deb6f879411f78a66ba82e43f0dcf2659e635d320d2369e8653be8fcb2211773cf6b68e31655b4853586e6365c22a0e82548ba1ec464af35e27ec47ff27158efb3921cf75364135d1d9582800d00a7ddeb6db9895f70c075eb9bd197ef03a3d9a984662f40db4c5417c782138fdbac076ebf1d9bc5b9d7b681721b6ad3dd099341ec43d1c183b982d6147208028653b23bcb3fd9043494b26ec139a6c18789e9098293ce9021c17083403cf13645627d413e05fd08903fc71c50f5d3b8d803f4f89ac8016e9c828a87bb76fee73ca9c8b15483d852f9d7566862e4a1c77f6ab848f3d3624426bc828ffaefb4d1f007789724961ef424a15d58e22a4c40da9c75229f1223ae3bb4b7181dc143474130ea33691c43f17257f6c9c29700120aaa1d4fa3770b5fd01f945105067b7eaacac710cd78e13a434919847231fb5fc868690ed9470f008da4f7d4317a7476672824319e6ed54105e4e5353e6d701262dc4e13635535ba106a19e625f9644e03f780b20715f309711460323e9f7f8ffafe61f204160366c8a961f070b4f62c9435ae7984a63854a6aa6f39d23e179ce98b828b88a0f65db028b1214092a690ebc542f52cf98425256908e7bad54c2ff700fa4ddefec3777e0c5ed8603e731682a847f66f3d17b5302abacd7c0804d17dbc3fffd5dc611e488888212f61735e6f649ae9a17d51badb9a773392b351b032695d9e32f193f974da8569e02c471ac949552b3ced07cb6a356d3971e4dccec206143bb7b3e04dfda23679a1494f6ad8f9ceb8556ba58bfdae0e"}, 0x418, 0x4eb}) syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0xc02) r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r0, 0x8000000) r1 = openat$ocfs2_control(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ocfs2_control\x00', 0x80202, 0x0) ioctl$BINDER_WRITE_READ(r1, 0x5421, &(0x7f0000000080)={0x0, 0x0, 0x0, 0xffffffffffffffa9, 0x0, 0x0}) getrandom(&(0x7f00000000c0)=""/118, 0x76, 0x1) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r2, 0x8000000) mmap$usbfs(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x8, 0x10010, r2, 0x6c) r3 = socket$xdp(0x2c, 0x3, 0x0) ioctl$vim2m_VIDIOC_DQBUF(r2, 0xc0585611, &(0x7f00000001c0)={0xfff, 0x2, 0x4, 0x800, 0x6, {}, {0x0, 0x1, 0x1, 0x1, 0x7d, 0x1, "b4996f90"}, 0xe5, 0x3, @planes=&(0x7f0000000180)={0x1, 0xbcfe, @mem_offset=0x100, 0x8}, 0x3c, 0x0, r2}) setsockopt$XDP_UMEM_FILL_RING(r3, 0x11b, 0x5, &(0x7f0000000140)=0x100010, 0x4) 01:06:31 executing program 4: socketpair(0x2c, 0x0, 0x51, &(0x7f0000000100)) 01:06:31 executing program 2: socketpair(0x22, 0x0, 0x175, &(0x7f0000000100)) 01:06:31 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r1, 0x8000000) ioctl$SECCOMP_IOCTL_NOTIF_ID_VALID(r1, 0x40082102, &(0x7f0000000040)) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_PREFER_SUBDEVICE(r1, 0x40045542, &(0x7f00000002c0)=0x200) ioctl$SNDRV_CTL_IOCTL_TLV_COMMAND(r1, 0xc008551c, &(0x7f0000000300)={0x5, 0x8, [0x3, 0xfffffffe]}) ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f00000024c0)={0x2, 0x0, 0x0, 0x0, 0x0, 0x0}) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r1, &(0x7f0000000340)={0x5, 0x10, 0xfa00, {&(0x7f0000000080), 0xffffffffffffffff, 0x1}}, 0x18) 01:06:31 executing program 3: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x2) r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x20401) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_PREFER_SUBDEVICE(r0, 0x40045542, &(0x7f00000005c0)=0x2) [ 1390.236376][T13685] binder: 13684:13685 unknown command 28 [ 1390.263793][T13685] binder: 13684:13685 ioctl c0306201 20000100 returned -22 01:06:31 executing program 2: socketpair(0x22, 0x0, 0x176, &(0x7f0000000100)) 01:06:31 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x6800, 0x0, 0x0}) 01:06:31 executing program 4: socketpair(0x2c, 0x0, 0x52, &(0x7f0000000100)) 01:06:31 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r1, 0x8000000) ioctl$FS_IOC_ADD_ENCRYPTION_KEY(r1, 0xc0506617, &(0x7f0000000040)={@id={0x2, 0x0, @c}, 0x40, 0x0, [], @a='\x01\x02\x03\x04\x05\x06\a\b\t\n\v\f\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&\'()*+,-./0123456789:;<=>?@'}) ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f00000024c0)={0x2, 0x0, 0x0, 0x0, 0x0, 0x0}) 01:06:31 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r1, 0x8000000) ioctl$SECCOMP_IOCTL_NOTIF_ID_VALID(r1, 0x40082102, &(0x7f0000000040)) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_PREFER_SUBDEVICE(r1, 0x40045542, &(0x7f00000002c0)=0x200) ioctl$SNDRV_CTL_IOCTL_TLV_COMMAND(r1, 0xc008551c, &(0x7f0000000300)={0x5, 0x8, [0x3, 0xfffffffe]}) ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f00000024c0)={0x2, 0x0, 0x0, 0x0, 0x0, 0x0}) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r1, &(0x7f0000000340)={0x5, 0x10, 0xfa00, {&(0x7f0000000080), 0xffffffffffffffff, 0x1}}, 0x18) 01:06:31 executing program 3: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x2) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_PREFER_SUBDEVICE(0xffffffffffffffff, 0x40045542, &(0x7f00000005c0)=0x2) [ 1390.505203][T13703] binder: 13698:13703 unknown command 28 [ 1390.515455][T13703] binder: 13698:13703 ioctl c0306201 20000100 returned -22 01:06:31 executing program 2: socketpair(0x22, 0x0, 0x177, &(0x7f0000000100)) 01:06:31 executing program 4: socketpair(0x2c, 0x0, 0x53, &(0x7f0000000100)) 01:06:31 executing program 3: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x2) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_PREFER_SUBDEVICE(0xffffffffffffffff, 0x40045542, &(0x7f00000005c0)=0x2) 01:06:31 executing program 5: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x2) r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x20401) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_PREFER_SUBDEVICE(r0, 0x40045542, &(0x7f00000005c0)=0x2) 01:06:31 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) socket$packet(0x11, 0x2, 0x300) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x3000004, 0x100010, r1, 0x8000000) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe5000/0x18000)=nil, &(0x7f0000000000)=[@text32={0x20, &(0x7f0000000080)="360f07ea33780000760066baf80cb8c8c74882ef66bafc0c66b80c0066eff30fc735c6c00000b805000000b9c29900000f01d98fc9d0912c7266baf80cb8d0ccd68bef66bafc0cb800000000efc4c103c26d066966baf80cb820259586ef66bafc0c66b89b4966efc4e30d4c7e4100", 0x6f}], 0x1, 0x5, &(0x7f0000000100)=[@dstype3={0x7, 0x1}, @dstype0={0x6, 0x7}], 0x2) ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f00000024c0)={0x2, 0x0, 0x0, 0x0, 0x0, 0x0}) 01:06:31 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x6c00, 0x0, 0x0}) 01:06:31 executing program 2: socketpair(0x22, 0x0, 0x178, &(0x7f0000000100)) 01:06:31 executing program 3: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x2) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_PREFER_SUBDEVICE(0xffffffffffffffff, 0x40045542, &(0x7f00000005c0)=0x2) 01:06:31 executing program 4: socketpair(0x2c, 0x0, 0x54, &(0x7f0000000100)) 01:06:31 executing program 5: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x2) r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x20401) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_PREFER_SUBDEVICE(r0, 0x40045542, &(0x7f00000005c0)=0x2) [ 1390.782660][T13722] binder: 13719:13722 unknown command 28 [ 1390.803400][T13722] binder: 13719:13722 ioctl c0306201 20000100 returned -22 01:06:32 executing program 2: socketpair(0x22, 0x0, 0x179, &(0x7f0000000100)) 01:06:32 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x7400, 0x0, 0x0}) 01:06:32 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f00000024c0)={0x2, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$IOCTL_VMCI_CTX_GET_CPT_STATE(0xffffffffffffffff, 0x7b1, &(0x7f0000001040)={&(0x7f0000000040)=[0x3, 0x2, 0xffff, 0x101, 0x4, 0x6, 0x7, 0x4, 0xfffffff9, 0x6abd, 0xffffffff, 0x229d, 0xdc, 0x7fff, 0x2, 0x8, 0xfffffffc, 0xfffffffd, 0x2, 0x6b2, 0x8, 0x3, 0x3ff, 0x0, 0x7, 0x2c, 0x3ff, 0x7fff, 0x8, 0x7, 0x52, 0x791edb8d, 0x3480000, 0x8dab, 0x1, 0x0, 0x7, 0x89, 0x1b, 0x1f, 0x5, 0x7, 0x7, 0x1, 0x7ff, 0x9000000, 0x6, 0x313, 0x6, 0x4, 0x6, 0x4, 0x7fff, 0x8, 0x35, 0x9, 0x54, 0xec, 0x3f, 0x5ce, 0x3, 0x3, 0x0, 0x7, 0x9, 0x8, 0x1, 0x6cc, 0x0, 0x59e7, 0xe7, 0x6, 0x3ff, 0x1ff, 0xfff, 0x6, 0x8fd1, 0x2, 0x9, 0x81, 0x0, 0x4, 0xa3, 0x1, 0x2b, 0x3, 0x800, 0x1f, 0x0, 0x7, 0x6, 0x81, 0x64, 0xfffffe01, 0x0, 0xb, 0x7f, 0x5, 0x4646, 0x6, 0x3, 0x0, 0x10, 0xffffff00, 0x2, 0x1, 0x3, 0x421, 0x4, 0xfffffffa, 0x3f, 0x1c6, 0x4, 0x20, 0x101, 0x2, 0xffffff01, 0x6, 0x5, 0x1, 0x3f, 0x0, 0x0, 0x0, 0xec, 0x8, 0x101, 0x3, 0x3, 0x6, 0x200, 0x5, 0x8, 0x2, 0x8000, 0x1, 0x2, 0x3, 0x0, 0x6, 0x8, 0x1000, 0x1f, 0x3, 0x6439, 0x9, 0x8000, 0xfffffff8, 0x6, 0x5, 0x3ff, 0x0, 0x100, 0x9, 0x7f, 0x80000000, 0x7, 0x0, 0x0, 0x5, 0x40, 0x8, 0x48e5, 0x0, 0x3, 0x3, 0x5, 0x20, 0x0, 0x0, 0x0, 0x3, 0x3, 0x4, 0x6, 0x8, 0x1, 0x101, 0x1, 0x80, 0x40, 0x40, 0x5, 0x401, 0x1ff, 0xffff0000, 0x200, 0x8, 0x3, 0x7, 0x8, 0x400, 0xfa, 0x9bb0, 0x1, 0x0, 0xfffffe00, 0x68f, 0xfffffffb, 0x100, 0x3, 0x1, 0x9, 0x4, 0x2, 0x800, 0xe2cc, 0x0, 0x8, 0xc4, 0x7ff, 0x2, 0x1ff, 0x0, 0xfffeffff, 0x51, 0x2, 0xffff, 0x80, 0x7, 0x9, 0x2, 0x3f, 0x1464, 0xaa1, 0x17, 0x1d3, 0x1f, 0x8, 0xffffffff, 0x200000, 0xfc, 0xffff, 0x2, 0x2, 0x0, 0x1f, 0x8, 0x7fff, 0x7681, 0x4, 0x1, 0x7, 0x8, 0x4ce, 0x2, 0x93, 0xf8, 0x81, 0x1000, 0x0, 0x5, 0x7, 0x19, 0x3f, 0x3, 0x0, 0x4, 0x81, 0x5, 0x55b, 0x8, 0x1000, 0x4, 0xb3, 0x6a, 0x9, 0x1000, 0xbd1, 0xbdb8, 0x4f, 0xffffffff, 0x1, 0x7, 0x5, 0x7, 0x10b, 0xffff, 0x8001, 0x0, 0xe051, 0x2, 0x55, 0x81, 0x0, 0x9, 0x3ff, 0x4, 0x5, 0x400, 0x6, 0x5, 0x2b, 0x200, 0x40, 0x6, 0x7e, 0x0, 0xfffffffd, 0xe499, 0x8, 0x6, 0x2, 0x40, 0x1f, 0x20, 0x1, 0x1f, 0x2, 0x1, 0x80000000, 0x100, 0x8, 0x1, 0x4, 0x1ff, 0xf0, 0x7, 0x1, 0xffff, 0x7fffffff, 0x100, 0x3, 0x0, 0x8, 0xd4ab, 0xffffffff, 0xce, 0x80000001, 0x25e5e6eb, 0x1, 0x7, 0x9, 0x6, 0x1, 0xffffffe0, 0xffffffd9, 0x1000, 0xfffffffd, 0x8000000, 0x1, 0x8000, 0x4, 0x7d47, 0x8, 0x101, 0x7f, 0xff, 0x2, 0x1f, 0x5, 0x101, 0x8bab, 0x7, 0x8, 0xe2, 0x2, 0x4, 0xff, 0x1ff, 0x100, 0x1, 0x9d, 0x6, 0x2, 0x1000, 0xffffff7f, 0x4, 0x80000000, 0x7fffffff, 0x7, 0x1, 0xc, 0x4, 0x3, 0x6, 0x5, 0x7, 0x81, 0x80000000, 0x10040000, 0x4, 0x3f, 0x4, 0x2, 0x80, 0x8, 0x9, 0x0, 0xb0, 0x493, 0x3, 0x0, 0x6, 0x9, 0x6, 0x0, 0xfff, 0x2, 0x5, 0x6, 0x67, 0x200, 0x7fff, 0xffffffff, 0x2, 0x3, 0x5, 0x440000, 0xdae, 0x7a857681, 0x7, 0x1, 0x80000001, 0x7, 0x26, 0x1, 0xffffff00, 0x7, 0x1000, 0x2, 0x1, 0x8, 0x476c92ae, 0x924, 0x0, 0x3, 0x200, 0x8, 0x0, 0x9f41, 0x2, 0x1000, 0x2, 0x80, 0x1ff, 0xfffffffb, 0x8, 0xffffffff, 0x9, 0x5, 0x8001, 0xffffffff, 0x1ff, 0x7fff, 0x0, 0x9, 0x1, 0xb75938a, 0x800, 0x1, 0x3, 0x10000, 0x7, 0x3, 0x6, 0x400, 0x6, 0x5, 0x0, 0x2, 0x8, 0x800, 0x8, 0x2, 0x8, 0x9, 0x7fff, 0x80, 0x5, 0x4, 0x5, 0x200, 0xff, 0x3b, 0x1, 0x3, 0x4, 0x80000001, 0x7, 0x0, 0x1, 0xed, 0x8, 0xcfe, 0xffff, 0x3eb, 0x5, 0x6, 0x7, 0x0, 0x1, 0x0, 0x4, 0x40, 0x8000, 0xffffffff, 0x0, 0x1, 0x3f, 0x0, 0x101, 0x604c, 0x2, 0x3, 0x4, 0x6, 0x2, 0xc0000, 0x0, 0x6, 0x3, 0x3f, 0x0, 0x8, 0x8, 0x7fffffff, 0x1000, 0x3, 0x80000000, 0x8, 0x7fff, 0x25b, 0x1, 0x8001, 0x9, 0x800, 0x9, 0x5, 0xc, 0x80, 0x101, 0x94f2, 0x9b, 0x9443, 0x1a, 0x5, 0x4, 0x8, 0x3, 0x9, 0x7, 0x401, 0xfff, 0x4, 0x101, 0x2, 0x6, 0x1, 0x8, 0x7, 0x3e, 0x8001, 0x8000, 0x9, 0x8001, 0x6, 0x9, 0x5, 0x10001, 0xfffffff9, 0x5, 0xfffffffe, 0x400, 0x800, 0x1000, 0xd4, 0x9, 0xa9d9, 0x6d4fab21, 0x8, 0x81, 0x5, 0x6, 0x0, 0x3, 0x80000001, 0xf52a, 0x400, 0x7, 0x101, 0x7, 0xf75, 0x0, 0xff, 0x80000001, 0xbb4, 0x1f, 0x3, 0x401, 0xc9dd, 0x8, 0xfffffff7, 0x8000, 0x9, 0x597, 0x6, 0x20, 0x5, 0x2, 0x3ff, 0x8ef, 0x64a0, 0xe87, 0xffff, 0x1ff, 0x40, 0x630, 0x5, 0x6, 0xc128, 0x9, 0x8, 0x7, 0xffffffff, 0x2, 0x81, 0x0, 0x93, 0x4, 0x5, 0x3, 0x9, 0x24, 0x8, 0xff, 0x1, 0x7, 0x80000000, 0x6, 0x7, 0x80000000, 0x40, 0x2, 0x4, 0x5, 0x6, 0x0, 0x6, 0x4, 0x8001, 0x1000, 0xfffffffe, 0x20, 0x8, 0xfffffff8, 0x3, 0xb531, 0x401, 0x3, 0x5, 0x2, 0x6, 0x3161, 0x0, 0x3f, 0x1, 0xda0, 0x8001, 0x1f, 0x159, 0x9, 0xfffffffe, 0x80000000, 0x8, 0x6, 0xceff, 0x1, 0x10001, 0x3, 0x0, 0x7afc, 0x4, 0xfe1e, 0x1, 0x2, 0x9, 0x7, 0xfffff434, 0x8, 0x4dead5fb, 0x8, 0x2, 0x8001, 0x81, 0x5, 0x9, 0x5, 0xfffffff8, 0x401, 0x1, 0x1, 0x1, 0x8, 0xeb7, 0x9, 0x0, 0x1000, 0xa0, 0x40, 0xffffffff, 0xfffffffd, 0x3ca, 0x6, 0x7f, 0x800, 0xffffffff, 0x5, 0x7, 0xfff, 0x0, 0x10001, 0x10001, 0x6, 0x7fffffff, 0x800, 0x3, 0x1b, 0x3, 0x1, 0x7fffffff, 0x7, 0x1, 0x9, 0x977b, 0x9, 0x7, 0x7, 0xa, 0xb9e, 0x9, 0x50, 0x8, 0x4, 0x9, 0x5, 0xffffff52, 0x3f, 0x1, 0x101, 0xfff, 0xec, 0xffffffff, 0x80000000, 0x9, 0x40, 0xfffffff8, 0x9, 0x7, 0x81, 0x9, 0x8, 0xff, 0x7, 0x401, 0x4, 0x80000001, 0x9, 0x0, 0x7, 0xcf21, 0x6, 0x1ff, 0x401, 0x5d, 0x1000, 0xffffff81, 0x80000001, 0x9, 0x80000000, 0x5, 0xee3, 0xfde, 0xe63d, 0x80000001, 0x8, 0x5, 0x7f, 0x7f, 0xfffff001, 0x10000, 0xc0d, 0x1, 0x10001, 0x9, 0x0, 0x7e4, 0x800, 0x10000, 0x3, 0x5, 0x5, 0x0, 0x9, 0x6, 0xfffffffa, 0x6, 0x5, 0xfffffff9, 0xff, 0x9, 0x4, 0x1, 0x7, 0x8000, 0x43258d30, 0x0, 0x6, 0x400, 0xffff, 0x8, 0x3ff, 0xfff, 0x0, 0x1, 0x3, 0x2, 0x2, 0x0, 0x5b, 0x1, 0x7fff, 0x3, 0x3000000, 0x7, 0x631, 0x249, 0x5, 0x10000, 0x1, 0x100, 0x3, 0xffffffff, 0x1fffe00, 0x4, 0x8f3, 0x20, 0x1, 0x6, 0x100, 0x8, 0x4, 0x1, 0xa14a, 0xffffffff, 0x8, 0x7, 0xaf2, 0x7, 0x1f, 0x8, 0x1, 0x2be, 0x80000000, 0x4, 0x3, 0x9, 0x1, 0x5, 0xffff8000, 0x7, 0x1, 0x4, 0x100, 0x2, 0x7, 0x9, 0x4, 0x8, 0x2, 0x401, 0x9, 0x9f2, 0x0, 0x401, 0x6, 0xffffff53, 0xfff, 0x7fffffff, 0x9, 0x6, 0x9, 0x6, 0x0, 0x8, 0x0, 0x6, 0x4, 0xd42, 0x9, 0x10000, 0x8, 0x6, 0x5, 0x58, 0x2dc3, 0x4, 0x4, 0x2, 0x5, 0x3, 0x8001, 0x9, 0x1, 0x0, 0x3, 0x60, 0x9, 0x99e, 0x866e, 0x1, 0x9, 0x9, 0x6, 0xffffffff, 0x1a, 0xffff7fff, 0xcaf5, 0x8, 0x1000, 0x1, 0xec621cdf, 0x200, 0x0, 0x7f, 0x0, 0x7ff, 0x8, 0x2, 0x4, 0x0, 0x40, 0x40, 0x2de, 0x0, 0x8000, 0x5, 0xc20, 0x389b, 0x4, 0xaf10, 0x400, 0x40, 0x2b2e, 0x8001, 0x8001, 0x10000, 0x1, 0x3f, 0x6, 0x80000000, 0x7, 0xe53, 0x9ee, 0x1, 0xc8b, 0x0, 0x100, 0xdcd, 0x40, 0xfffffffe, 0x1, 0x20, 0x8, 0x2, 0x1000, 0x7fffffff, 0x54, 0x8, 0x9e, 0x7, 0x6, 0x7, 0x938f, 0x7, 0x3, 0x100, 0x7fffffff, 0x400, 0x9, 0x2, 0x3, 0x1, 0x0, 0x9, 0x1f, 0x1, 0x7f, 0x7, 0x8, 0x8, 0x2, 0x3ff, 0x1a8c, 0x9, 0x7, 0xfffffffe, 0x2, 0x9, 0x4, 0x10001, 0x7, 0x0, 0xffffffff, 0x2, 0x400, 0x40000, 0x0, 0xfffffab3, 0x2, 0x5, 0x0, 0x4, 0x3, 0x6, 0xd4, 0x4, 0x1, 0x800, 0x9, 0xfffffff9, 0x0, 0x7f, 0x1], 0x1, 0x400, 0x3}) 01:06:32 executing program 5: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x2) r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x20401) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_PREFER_SUBDEVICE(r0, 0x40045542, &(0x7f00000005c0)=0x2) 01:06:32 executing program 4: socketpair(0x2c, 0x0, 0x55, &(0x7f0000000100)) 01:06:32 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x20401) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_PREFER_SUBDEVICE(r0, 0x40045542, &(0x7f00000005c0)=0x2) [ 1391.060499][T13736] binder: 13734:13736 unknown command 28 [ 1391.066304][T13736] binder: 13734:13736 ioctl c0306201 20000100 returned -22 01:06:32 executing program 2: socketpair(0x22, 0x0, 0x17a, &(0x7f0000000100)) 01:06:32 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x7a00, 0x0, 0x0}) 01:06:32 executing program 0: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x1002) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='net/ip_mr_vif\x00') r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r2, 0x8000000) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000580)={0x70, 0x0, &(0x7f0000000480)=[@request_death={0x400c630e, 0x2}, @transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f00000003c0)={@flat=@weak_binder={0x77622a85, 0x100a, 0x1}, @ptr={0x70742a85, 0x0, &(0x7f0000000340)=""/122, 0x7a, 0x0, 0x3f}, @flat=@binder={0x73622a85, 0xa}}, &(0x7f0000000440)={0x0, 0x18, 0x40}}, 0x400}, @clear_death={0x400c630f, 0x3}, @enter_looper], 0x5e, 0x0, &(0x7f0000000500)="853f337670a0ef55a61b4a6a100507030c0f57f607d5a37e84d8db22e1f60a754b14f020e527cf84193993175bd8b848fee0005d2c3f8fd6a03d9062dee3c12c942fd83e0802a003806be8c3166397ed7e0c9910b9ff2c597a4778ca71ad"}) ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f00000024c0)={0x0, 0x0, 0x0, 0xfffe, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) getpeername(r1, &(0x7f0000000140)=@pptp={0x18, 0x2, {0x0, @private}}, &(0x7f0000000300)=0x80) r4 = syz_genetlink_get_family_id$smc(&(0x7f0000000100)='SMC_PNETID\x00', r1) sendmsg$SMC_PNETID_FLUSH(r3, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f00000001c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="b23ce6179adf3921ce9745c1556e1d693a5b381ead5238c87945e3b8c75d0e0d000094747057ea41d1aba69a", @ANYRES16=r4, @ANYBLOB="10002dbd7000fcdbdf25040000000500040001000000140002006261746164765f736c6176655f3100001400020073797a6b616c6c6572300000000000000500040001000000"], 0x4c}, 0x1, 0x0, 0x0, 0x40004}, 0x80) socketpair(0x18, 0xa, 0x6, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$XDP_UMEM_REG(r5, 0x11b, 0x4, &(0x7f0000000640)={&(0x7f0000000600)=""/45, 0x8000, 0x0, 0xcd, 0xdb2be6c2734d59e7}, 0x20) syz_open_dev$binderN(&(0x7f0000000240)='/dev/binder#\x00', 0x0, 0x0) r6 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000680)='/dev/ubi_ctrl\x00', 0x189781, 0x0) getpeername(r1, &(0x7f00000006c0)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, &(0x7f0000000740)=0x80) ioctl$sock_bt_hidp_HIDPCONNADD(r6, 0x400448c8, &(0x7f0000000840)={r3, r7, 0x8, 0xbb, &(0x7f0000000780)="1bdced035997c210a28b7c0892482b2775045bfa823617e8d8d10eb1395d6e6a70dc2cc11ac00a55b8362a889bbe1cd4a52e94f40eb57fc4fadb29e527316bb8046c835debeea15ce473670459d2b15e054108728d64e473bc7c059a7ef3eb85b49ef71da5fe197e7cd7f429908ef70f78f6d06723dfc5595791a146954491a0a86646e3ef8dbbd1f3b443a85126a21532700191d4ed86d9c247bf916dff72a94bc0aa1d61a41f1fd287ed5be3c2b8c8d3b53254f5899958ca00cd", 0x9, 0x1, 0xcd, 0x207, 0x1f, 0x0, 0x2, 'syz0\x00'}) 01:06:32 executing program 5: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x2) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_PREFER_SUBDEVICE(0xffffffffffffffff, 0x40045542, &(0x7f00000005c0)=0x2) 01:06:32 executing program 4: socketpair(0x2c, 0x0, 0x56, &(0x7f0000000100)) 01:06:32 executing program 3: r0 = syz_open_dev$sndctrl(0x0, 0x2, 0x20401) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_PREFER_SUBDEVICE(r0, 0x40045542, &(0x7f00000005c0)=0x2) [ 1391.279456][T13751] binder: 13748:13751 unknown command 28 [ 1391.292462][T13751] binder: 13748:13751 ioctl c0306201 20000100 returned -22 01:06:32 executing program 2: socketpair(0x22, 0x0, 0x17b, &(0x7f0000000100)) 01:06:32 executing program 5: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x2) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_PREFER_SUBDEVICE(0xffffffffffffffff, 0x40045542, &(0x7f00000005c0)=0x2) 01:06:32 executing program 4: socketpair(0x2c, 0x0, 0x57, &(0x7f0000000100)) 01:06:32 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0xff00, 0x0, 0x0}) 01:06:32 executing program 3: r0 = syz_open_dev$sndctrl(0x0, 0x2, 0x20401) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_PREFER_SUBDEVICE(r0, 0x40045542, &(0x7f00000005c0)=0x2) 01:06:32 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x1, 0x48100) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(r0, 0xc1205531, &(0x7f0000000080)={0x1, 0x3, 0xfcf, 0x8, [], [], [], 0x401, 0x80000000, 0x4, 0x3, "989df9a5985bb3d432e8bc62db5372bc"}) r1 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0x5421, &(0x7f00000024c0)={0x2, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat$ocfs2_control(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ocfs2_control\x00', 0x4801, 0x0) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_PREFER_SUBDEVICE(r2, 0x40045542, &(0x7f0000000200)=0x3) 01:06:32 executing program 5: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x2) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_PREFER_SUBDEVICE(0xffffffffffffffff, 0x40045542, &(0x7f00000005c0)=0x2) 01:06:32 executing program 2: socketpair(0x22, 0x0, 0x17c, &(0x7f0000000100)) 01:06:32 executing program 4: socketpair(0x2c, 0x0, 0x58, &(0x7f0000000100)) [ 1391.541048][T13767] binder: 13765:13767 unknown command 28 [ 1391.561866][T13767] binder: 13765:13767 ioctl c0306201 20000100 returned -22 01:06:32 executing program 3: r0 = syz_open_dev$sndctrl(0x0, 0x2, 0x20401) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_PREFER_SUBDEVICE(r0, 0x40045542, &(0x7f00000005c0)=0x2) 01:06:32 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0xe0ffff, 0x0, 0x0}) 01:06:32 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x20401) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_PREFER_SUBDEVICE(r0, 0x40045542, &(0x7f00000005c0)=0x2) 01:06:32 executing program 2: socketpair(0x22, 0x0, 0x17d, &(0x7f0000000100)) 01:06:32 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x802) ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0xffffffffffffff80, 0x400) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ubi_ctrl\x00', 0x210000, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r1, 0x40045532, &(0x7f0000000140)=0x101) sendmsg$SMC_PNETID_FLUSH(r1, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x14, 0x0, 0x800, 0x70bd28, 0x25dfdbfc}, 0x14}, 0x1, 0x0, 0x0, 0x4004080}, 0x4854) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000240)='/dev/zero\x00', 0x400000, 0x0) getsockname$packet(r1, &(0x7f00000003c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000000400)=0x14) bpf$MAP_CREATE(0x0, &(0x7f0000000440)={0x1d, 0x9, 0x5, 0x1, 0x4, r2, 0x0, [], r3, r1, 0x2, 0x2, 0x5}, 0x40) 01:06:32 executing program 4: socketpair(0x2c, 0x0, 0x59, &(0x7f0000000100)) 01:06:32 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x20401) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_PREFER_SUBDEVICE(r0, 0x40045542, &(0x7f00000005c0)=0x2) [ 1391.786989][T13782] binder: 13781:13782 unknown command 28 [ 1391.811109][T13782] binder: 13781:13782 ioctl c0306201 20000100 returned -22 01:06:33 executing program 2: socketpair(0x22, 0x0, 0x17e, &(0x7f0000000100)) 01:06:33 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x1000000, 0x0, 0x0}) 01:06:33 executing program 5: r0 = syz_open_dev$sndctrl(0x0, 0x2, 0x20401) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_PREFER_SUBDEVICE(r0, 0x40045542, &(0x7f00000005c0)=0x2) 01:06:33 executing program 4: socketpair(0x2c, 0x0, 0x5a, &(0x7f0000000100)) 01:06:33 executing program 0: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0x5421, &(0x7f00000024c0)={0x2, 0x0, 0x0, 0x0, 0x0, 0x0}) openat$vmci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vmci\x00', 0x2, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000040)='oom_score_adj\x00') ioctl$vim2m_VIDIOC_PREPARE_BUF(r0, 0xc058565d, &(0x7f0000000080)={0x87, 0x1, 0x4, 0x4000, 0x2, {}, {0x4, 0x8, 0xab, 0x3, 0x9, 0x6, "33bc1352"}, 0x5, 0x2, @userptr}) 01:06:33 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_PREFER_SUBDEVICE(r0, 0x40045542, &(0x7f00000005c0)=0x2) 01:06:33 executing program 5: r0 = syz_open_dev$sndctrl(0x0, 0x2, 0x20401) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_PREFER_SUBDEVICE(r0, 0x40045542, &(0x7f00000005c0)=0x2) 01:06:33 executing program 2: socketpair(0x22, 0x0, 0x17f, &(0x7f0000000100)) 01:06:33 executing program 4: socketpair(0x2c, 0x0, 0x5b, &(0x7f0000000100)) [ 1392.066524][T13801] binder: 13798:13801 unknown command 28 [ 1392.076327][T13801] binder: 13798:13801 ioctl c0306201 20000100 returned -22 01:06:33 executing program 3: syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_PREFER_SUBDEVICE(0xffffffffffffffff, 0x40045542, &(0x7f00000005c0)=0x2) 01:06:33 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x2000000, 0x0, 0x0}) 01:06:33 executing program 4: socketpair(0x2c, 0x0, 0x5c, &(0x7f0000000100)) 01:06:33 executing program 5: r0 = syz_open_dev$sndctrl(0x0, 0x2, 0x20401) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_PREFER_SUBDEVICE(r0, 0x40045542, &(0x7f00000005c0)=0x2) 01:06:33 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x800) ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f00000024c0)={0x2, 0x0, 0x0, 0x0, 0x0, 0x0}) 01:06:33 executing program 2: socketpair(0x22, 0x0, 0x180, &(0x7f0000000100)) 01:06:33 executing program 3: syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_PREFER_SUBDEVICE(0xffffffffffffffff, 0x40045542, &(0x7f00000005c0)=0x2) 01:06:33 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x20401) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_PREFER_SUBDEVICE(r0, 0x40045542, &(0x7f00000005c0)=0x2) [ 1392.338597][T13819] binder: 13814:13819 unknown command 28 [ 1392.367098][T13819] binder: 13814:13819 ioctl c0306201 20000100 returned -22 01:06:33 executing program 4: socketpair(0x2c, 0x0, 0x5d, &(0x7f0000000100)) 01:06:33 executing program 0: r0 = open$dir(&(0x7f0000000100)='./file0\x00', 0x24800, 0x8) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x101000, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r1, 0x8000000) io_uring_setup(0x6aa3, &(0x7f0000000080)={0x0, 0xf4cb, 0x1, 0x0, 0x21a, 0x0, r1}) ioctl$IOCTL_VMCI_DATAGRAM_SEND(r1, 0x7ab, &(0x7f0000000580)={&(0x7f0000000140)={{@any, 0x6}, {@my=0x1, 0x2}, 0x400, "a44231b42c23cb8e72107382cd798e47acea9a34890ad25938649a529e763d94bef877c5787af7ea4b881ed8e23c78973be653f1a7d6ccfd58ec1283137da979b95373435b5dc4c76b3de0031771e539ab7ab9450dbec65456e8983cf19aff28acfba8170914f360edb98cb69e9ed429622c8401cb1d085c1096f06edfa0f621e032da5a52345ce52675a723c83eb276b74eb8d51b0077363e8fa148bd3606fe2de3200cd8fee430dc3fb9ffb8a0bdd598fb11bd57d03aa6e7271763b5f2f586b08723c87c9c0fb97e6f418f94f81a6eb3c918b834c2511347e703c8ae52bd37b50acbe42175bf667e4e0e30e849214afaaad108869d62314f922ec6d50265eb9d237fc35464923a4e6e944e48177d5711352bf8898b487d6da75f2a59bb78b50162e8ebd3d968c4c537be7c8a3a1a87e17c44ff60c7c4336af7fe6de6c64416c8643c4adf0997d0bee8cc80a62050218a88afb22bed971a0a13b069cafbb81ceb264032876a7179ced9dc534907e837d4bbe644a531033b6ebabd2724bd16fd4ba69e0d46c91d5ed41d6bb0c940627d0e0fd7328b7c382859209598e56c98ee534cd35840717395711718fc861b07d1da1f412a25d55c93be9ab9d56e21cf1c0311dc81a9c00048cf9284f36da4bd7e1bcb3984a298622dabafecdaa0cc7baf60f03914a1433dba7de5c199cda832cc1116f7ddd5ce3fc5edd09b7a330bf3a893d9f3e9c7d6a03a8904095a8c350ca0900e3ca94da7bbfa6e0b27d191083fcf9ba84e6e4e95cab7ff917588b81cd44e4efe3caf09a1a9132394169ff7b31e4a703236d0b0f451df909a2a8e95dbfdaf421dc808433bfe0ce2791a9eefb504f464bb3ddcd6f77b092b7e957de358436406855ac93c59c3aade692c7ac9879ba62f4c805fbe9d1c4fc48c939f639d5552e49e9846e412c6764ae7a07f2e72b91cd1815233904f43a3663923ad0acba643680c91e11706c5ca7d0a5309978543b4cd83374a3e1836494d4b505773434a31488813a79fb21c11dfbf01639463c59eb0f6268bb9fe7e89a252d2b419524333fd18c65515187a7b491e2d7fcfd4a75faf3123d0dcb9fe1c05a6d0531bf1e08ca3a4964aba017c8762a167bf4c82bcbc27b4d7b9455c603a69b09abcc9ac77f398b46082319fa9129f035a24da765389591ae25e25c807276131c4ffe919fe19f4413bbd6e1325a072bf600091fac69ad2c1e11c6dd5764d7b76c763b66d0c152990b4c6671f74e9b08ba9ef395b0d44c7ef702ea2a41e89e29de5b6b5e40e7c23744ce12683d18747c3fa7966a8b31db721e9774f7be3855f176847a07e9444a580347e20276a4db616a3eea9c2e79169a83f184b898094a45a5d9c107fbc186fb4c7dd7c4254a5040b7275148a4196d8e7965970bd10f12e4a70caa3f7e1d3ad8729b108f227d7a938ebb821b24096"}, 0x418}) r2 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) syz_open_dev$binderN(&(0x7f0000000a80)='/dev/binder#\x00', 0x0, 0x802) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(0xffffffffffffffff, 0x7, &(0x7f0000000ac0)=r1, 0x1) r3 = openat$dir(0xffffffffffffff9c, &(0x7f00000005c0)='./file0\x00', 0x400240, 0x0) name_to_handle_at(r0, &(0x7f0000000900)='./file0\x00', &(0x7f0000000940)={0xf6, 0x4, "031b139364a5d87bc71c8914c8e20e26bf6c042d0aa6d43c2ec49e8254ee4b083e4f0ea0e2b6803d2c9abbbd74028e31797042190ca5e1aa2e134e62bc0ac1231c2de9b56f9ec514efeb85e9167f32b8d059583a794decd56a1dc969ade39778e4691565400865740a636f562b695db2661c1d4e8695093263916df51b39982810ca22d45a2bd3a035f45ecb4243db0e4b4cc14000fd56b11ce4a70721c2b3f9d83956005c6c21c34245c08b2a46e9ba6327cb0ab091d89c97d7a612dcffa3f6eab3f4d94757f9caf3b8c9bf90898e74cb46a5cb3e600ba76654d8babbd08f45d0e64434bd7ed6f08e139feca7b5"}, &(0x7f0000000a40), 0x1000) r4 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_RX_RING(r4, 0x11b, 0x2, &(0x7f0000001e40)=0x100080, 0x4) name_to_handle_at(r3, &(0x7f0000000840)='./file0\x00', &(0x7f0000000800)=ANY=[@ANYRESOCT=r4], &(0x7f0000000700), 0x0) linkat(0xffffffffffffffff, &(0x7f00000007c0)='./file0\x00', r1, &(0x7f0000000740)='./file0\x00', 0x400) r5 = syz_open_dev$sndctrl(&(0x7f0000000600)='/dev/snd/controlC#\x00', 0x8, 0x40) ioctl$FS_IOC_GET_ENCRYPTION_PWSALT(r1, 0x40106614, &(0x7f00000008c0)) ioctl$SNDRV_CTL_IOCTL_ELEM_LOCK(r5, 0x40405514, &(0x7f0000000880)={0x3, 0x0, 0x89a, 0x8, 'syz1\x00', 0xf04f}) sendmsg$AUDIT_GET_FEATURE(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000b00)={&(0x7f0000000680)={0x10, 0x3fb, 0x4, 0x70bd2c, 0x25dfdbfb, "", ["", "", "", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x4000450}, 0x20040080) ioctl$IOCTL_VMCI_SET_NOTIFY(0xffffffffffffffff, 0x7cb, &(0x7f0000000040)={0x8001, 0x3, 0x3}) ioctl$BINDER_WRITE_READ(r2, 0x5421, &(0x7f00000024c0)={0x2, 0x0, 0x0, 0x0, 0x0, 0x0}) 01:06:33 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x3000000, 0x0, 0x0}) 01:06:33 executing program 2: socketpair(0x22, 0x0, 0x181, &(0x7f0000000100)) 01:06:33 executing program 3: syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_PREFER_SUBDEVICE(0xffffffffffffffff, 0x40045542, &(0x7f00000005c0)=0x2) 01:06:33 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_PREFER_SUBDEVICE(r0, 0x40045542, &(0x7f00000005c0)=0x2) 01:06:33 executing program 4: socketpair(0x2c, 0x0, 0x5e, &(0x7f0000000100)) [ 1392.603323][T13834] binder: 13832:13834 unknown command 28 [ 1392.622823][T13834] binder: 13832:13834 ioctl c0306201 20000100 returned -22 01:06:33 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x4000000, 0x0, 0x0}) 01:06:33 executing program 5: syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_PREFER_SUBDEVICE(0xffffffffffffffff, 0x40045542, &(0x7f00000005c0)=0x2) 01:06:33 executing program 0: openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x24, 0x0, &(0x7f0000000040)=[@request_death, @exit_looper, @clear_death={0x400c630f, 0x1e0d}], 0x65, 0x0, &(0x7f0000000080)="2ddbbfbcb39e8e825f73ba2f051de7bc2a1450a1f2de8297ea30af6145de82bffeae9555f17e8a5ce8dd095387b8fe5c3816d5d93dd673bb4c15aca104123e7593120ffba081aa70a416a513d273f23025941f907f75cec40bd30add7d572b082d4d7c1274"}) ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f00000024c0)={0x2, 0x0, 0x0, 0x0, 0x0, 0x0}) 01:06:33 executing program 2: socketpair(0x22, 0x0, 0x182, &(0x7f0000000100)) 01:06:33 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_PREFER_SUBDEVICE(r0, 0x40045542, 0x0) 01:06:33 executing program 4: socketpair(0x2c, 0x0, 0x5f, &(0x7f0000000100)) [ 1392.833224][T13848] binder: 13846:13848 unknown command 28 [ 1392.861619][T13848] binder: 13846:13848 ioctl c0306201 20000100 returned -22 01:06:34 executing program 5: syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_PREFER_SUBDEVICE(0xffffffffffffffff, 0x40045542, &(0x7f00000005c0)=0x2) 01:06:34 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x800) write$RDMA_USER_CM_CMD_BIND(0xffffffffffffffff, &(0x7f0000000100)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x1c, 0x0, @ib={0x1b, 0xf85, 0x1f, {"b83333b59a2145017bb6f619edd4368e"}, 0x1000, 0x8000, 0x8}}}, 0x90) r1 = openat$ocfs2_control(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ocfs2_control\x00', 0x30040, 0x0) ioctl$sock_SIOCADDRT(r1, 0x890b, &(0x7f0000000240)={0x0, @sco={0x1f, @fixed={[], 0x10}}, @vsock={0x28, 0x0, 0x0, @my=0x1}, @nfc={0x27, 0x1, 0x1, 0x3}, 0x2, 0x0, 0x0, 0x0, 0xf6, &(0x7f0000000200)='veth1_to_bond\x00', 0xe2, 0x8, 0x1ad7}) mmap$binder(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x4) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f00000000c0)={0xffffffffffffffff}) syz_genetlink_get_family_id$smc(&(0x7f0000000080)='SMC_PNETID\x00', r2) ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 01:06:34 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x5000000, 0x0, 0x0}) 01:06:34 executing program 2: socketpair(0x22, 0x0, 0x183, &(0x7f0000000100)) 01:06:34 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_PREFER_SUBDEVICE(r0, 0x40045542, 0x0) 01:06:34 executing program 4: socketpair(0x2c, 0x0, 0x60, &(0x7f0000000100)) 01:06:34 executing program 5: syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_PREFER_SUBDEVICE(0xffffffffffffffff, 0x40045542, &(0x7f00000005c0)=0x2) 01:06:34 executing program 2: socketpair(0x22, 0x0, 0x184, &(0x7f0000000100)) 01:06:34 executing program 4: socketpair(0x2c, 0x0, 0x61, &(0x7f0000000100)) [ 1393.115992][T13871] binder: 13866:13871 unknown command 28 [ 1393.136636][T13871] binder: 13866:13871 ioctl c0306201 20000100 returned -22 01:06:34 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_PREFER_SUBDEVICE(r0, 0x40045542, 0x0) 01:06:34 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='attr/exec\x00') write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000080), 0x106, 0xa}}, 0x20) ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f00000024c0)={0x2, 0x0, 0x0, 0x0, 0x0, 0x0}) 01:06:34 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x6000000, 0x0, 0x0}) 01:06:34 executing program 2: socketpair(0x22, 0x0, 0x185, &(0x7f0000000100)) 01:06:34 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_PREFER_SUBDEVICE(r0, 0x40045542, 0x0) [ 1393.288257][T13881] binder: 13877:13881 unknown command 28 [ 1393.309450][T13881] binder: 13877:13881 ioctl c0306201 20000100 returned -22 01:06:34 executing program 4: socketpair(0x2c, 0x0, 0x62, &(0x7f0000000100)) 01:06:34 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_PREFER_SUBDEVICE(r0, 0x40045542, &(0x7f00000005c0)) 01:06:34 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x800) ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f00000024c0)={0x2, 0x0, 0x0, 0x0, 0x0, 0x0}) 01:06:34 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x7000000, 0x0, 0x0}) 01:06:34 executing program 2: socketpair(0x22, 0x0, 0x186, &(0x7f0000000100)) 01:06:34 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_PREFER_SUBDEVICE(r0, 0x40045542, 0x0) 01:06:34 executing program 4: socketpair(0x2c, 0x0, 0x63, &(0x7f0000000100)) 01:06:34 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='attr/exec\x00') write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000080), 0x106, 0xa}}, 0x20) ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f00000024c0)={0x2, 0x0, 0x0, 0x0, 0x0, 0x0}) [ 1393.546968][T13898] binder: 13895:13898 unknown command 28 [ 1393.565994][T13898] binder: 13895:13898 ioctl c0306201 20000100 returned -22 01:06:34 executing program 2: socketpair(0x22, 0x0, 0x187, &(0x7f0000000100)) 01:06:34 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_PREFER_SUBDEVICE(r0, 0x40045542, 0x0) 01:06:34 executing program 4: socketpair(0x2c, 0x0, 0x64, &(0x7f0000000100)) 01:06:34 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x8000000, 0x0, 0x0}) 01:06:34 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_PREFER_SUBDEVICE(r0, 0x40045542, 0x0) 01:06:34 executing program 2: socketpair(0x22, 0x0, 0x188, &(0x7f0000000100)) 01:06:34 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='attr/exec\x00') write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000080), 0x106, 0xa}}, 0x20) ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f00000024c0)={0x2, 0x0, 0x0, 0x0, 0x0, 0x0}) 01:06:34 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_PREFER_SUBDEVICE(r0, 0x40045542, 0x0) 01:06:35 executing program 4: socketpair(0x2c, 0x0, 0x65, &(0x7f0000000100)) [ 1393.817063][T13913] binder: 13910:13913 unknown command 28 [ 1393.845290][T13913] binder: 13910:13913 ioctl c0306201 20000100 returned -22 01:06:35 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_PREFER_SUBDEVICE(r0, 0x40045542, &(0x7f00000005c0)) 01:06:35 executing program 2: socketpair(0x22, 0x0, 0x189, &(0x7f0000000100)) 01:06:35 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x1f000000, 0x0, 0x0}) 01:06:35 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='attr/exec\x00') write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000080), 0x106, 0xa}}, 0x20) ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f00000024c0)={0x2, 0x0, 0x0, 0x0, 0x0, 0x0}) 01:06:35 executing program 4: socketpair(0x2c, 0x0, 0x66, &(0x7f0000000100)) 01:06:35 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_PREFER_SUBDEVICE(r0, 0x40045542, 0x0) 01:06:35 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_PREFER_SUBDEVICE(r0, 0x40045542, 0x0) [ 1394.086991][T13927] binder: 13925:13927 unknown command 28 [ 1394.111735][T13927] binder: 13925:13927 ioctl c0306201 20000100 returned -22 01:06:35 executing program 2: socketpair(0x22, 0x0, 0x18a, &(0x7f0000000100)) 01:06:35 executing program 0: ioctl$SNDRV_CTL_IOCTL_RAWMIDI_PREFER_SUBDEVICE(0xffffffffffffffff, 0x40045542, 0x0) 01:06:35 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x20000000, 0x0, 0x0}) 01:06:35 executing program 3: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='attr/exec\x00') write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000080), 0x106, 0xa}}, 0x20) 01:06:35 executing program 4: socketpair(0x2c, 0x0, 0x67, &(0x7f0000000100)) 01:06:35 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_PREFER_SUBDEVICE(r0, 0x40045542, 0x0) 01:06:35 executing program 2: socketpair(0x22, 0x0, 0x18b, &(0x7f0000000100)) 01:06:35 executing program 4: socketpair(0x2c, 0x0, 0x68, &(0x7f0000000100)) [ 1394.340106][T13946] binder: 13939:13946 unknown command 28 [ 1394.368426][T13946] binder: 13939:13946 ioctl c0306201 20000100 returned -22 01:06:35 executing program 0: ioctl$SNDRV_CTL_IOCTL_RAWMIDI_PREFER_SUBDEVICE(0xffffffffffffffff, 0x40045542, 0x0) 01:06:35 executing program 3: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='attr/exec\x00') write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000080), 0x106, 0xa}}, 0x20) 01:06:35 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_PREFER_SUBDEVICE(r0, 0x40045542, 0x0) 01:06:35 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x48000000, 0x0, 0x0}) 01:06:35 executing program 2: socketpair(0x22, 0x0, 0x18c, &(0x7f0000000100)) 01:06:35 executing program 4: socketpair(0x2c, 0x0, 0x69, &(0x7f0000000100)) 01:06:35 executing program 0: ioctl$SNDRV_CTL_IOCTL_RAWMIDI_PREFER_SUBDEVICE(0xffffffffffffffff, 0x40045542, 0x0) 01:06:35 executing program 3: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000080), 0x106, 0xa}}, 0x20) 01:06:35 executing program 5: ioctl$SNDRV_CTL_IOCTL_RAWMIDI_PREFER_SUBDEVICE(0xffffffffffffffff, 0x40045542, 0x0) [ 1394.603920][T13962] binder: 13960:13962 unknown command 28 [ 1394.626149][T13962] binder: 13960:13962 ioctl c0306201 20000100 returned -22 01:06:35 executing program 2: socketpair(0x22, 0x0, 0x18d, &(0x7f0000000100)) 01:06:35 executing program 4: socketpair(0x2c, 0x0, 0x6a, &(0x7f0000000100)) 01:06:35 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x4c000000, 0x0, 0x0}) 01:06:35 executing program 5: ioctl$SNDRV_CTL_IOCTL_RAWMIDI_PREFER_SUBDEVICE(0xffffffffffffffff, 0x40045542, 0x0) 01:06:35 executing program 0: r0 = syz_open_dev$sndctrl(0x0, 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_PREFER_SUBDEVICE(r0, 0x40045542, 0x0) 01:06:35 executing program 3: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000080), 0x106, 0xa}}, 0x20) 01:06:35 executing program 2: socketpair(0x22, 0x0, 0x18e, &(0x7f0000000100)) [ 1394.873800][T13975] binder: 13974:13975 unknown command 28 [ 1394.892647][T13975] binder: 13974:13975 ioctl c0306201 20000100 returned -22 01:06:36 executing program 4: socketpair(0x2c, 0x0, 0x6b, &(0x7f0000000100)) 01:06:36 executing program 5: ioctl$SNDRV_CTL_IOCTL_RAWMIDI_PREFER_SUBDEVICE(0xffffffffffffffff, 0x40045542, 0x0) 01:06:36 executing program 0: r0 = syz_open_dev$sndctrl(0x0, 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_PREFER_SUBDEVICE(r0, 0x40045542, 0x0) 01:06:36 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x57150000, 0x0, 0x0}) 01:06:36 executing program 3: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000080), 0x106, 0xa}}, 0x20) 01:06:36 executing program 2: socketpair(0x22, 0x0, 0x18f, &(0x7f0000000100)) 01:06:36 executing program 5: r0 = syz_open_dev$sndctrl(0x0, 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_PREFER_SUBDEVICE(r0, 0x40045542, 0x0) 01:06:36 executing program 4: socketpair(0x2c, 0x0, 0x6c, &(0x7f0000000100)) 01:06:36 executing program 0: r0 = syz_open_dev$sndctrl(0x0, 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_PREFER_SUBDEVICE(r0, 0x40045542, 0x0) [ 1395.151209][T13993] binder: 13989:13993 unknown command 28 [ 1395.184030][T13993] binder: 13989:13993 ioctl c0306201 20000100 returned -22 01:06:36 executing program 4: socketpair(0x2c, 0x0, 0x6d, &(0x7f0000000100)) 01:06:36 executing program 3: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='attr/exec\x00') write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000080), 0x106, 0xa}}, 0x20) 01:06:36 executing program 2: socketpair(0x22, 0x0, 0x190, &(0x7f0000000100)) 01:06:36 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x58150000, 0x0, 0x0}) 01:06:36 executing program 5: r0 = syz_open_dev$sndctrl(0x0, 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_PREFER_SUBDEVICE(r0, 0x40045542, 0x0) 01:06:36 executing program 0: syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_PREFER_SUBDEVICE(0xffffffffffffffff, 0x40045542, 0x0) 01:06:36 executing program 2: socketpair(0x22, 0x0, 0x191, &(0x7f0000000100)) 01:06:36 executing program 3: r0 = syz_open_procfs(0xffffffffffffffff, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000080), 0x106, 0xa}}, 0x20) 01:06:36 executing program 4: socketpair(0x2c, 0x0, 0x6e, &(0x7f0000000100)) [ 1395.401539][T14012] binder: 14007:14012 unknown command 28 [ 1395.430057][T14012] binder: 14007:14012 ioctl c0306201 20000100 returned -22 01:06:36 executing program 0: syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_PREFER_SUBDEVICE(0xffffffffffffffff, 0x40045542, 0x0) 01:06:36 executing program 5: r0 = syz_open_dev$sndctrl(0x0, 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_PREFER_SUBDEVICE(r0, 0x40045542, 0x0) 01:06:36 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x60000000, 0x0, 0x0}) 01:06:36 executing program 4: socketpair(0x2c, 0x0, 0x6f, &(0x7f0000000100)) 01:06:36 executing program 2: socketpair(0x22, 0x0, 0x192, &(0x7f0000000100)) 01:06:36 executing program 5: syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_PREFER_SUBDEVICE(0xffffffffffffffff, 0x40045542, 0x0) 01:06:36 executing program 3: r0 = syz_open_procfs(0xffffffffffffffff, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000080), 0x106, 0xa}}, 0x20) 01:06:36 executing program 0: syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_PREFER_SUBDEVICE(0xffffffffffffffff, 0x40045542, 0x0) [ 1395.650168][T14026] binder: 14025:14026 unknown command 28 [ 1395.668527][T14026] binder: 14025:14026 ioctl c0306201 20000100 returned -22 01:06:36 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x68000000, 0x0, 0x0}) 01:06:36 executing program 4: socketpair(0x2c, 0x0, 0x70, &(0x7f0000000100)) 01:06:36 executing program 5: syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_PREFER_SUBDEVICE(0xffffffffffffffff, 0x40045542, 0x0) 01:06:36 executing program 3: r0 = syz_open_procfs(0xffffffffffffffff, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000080), 0x106, 0xa}}, 0x20) 01:06:36 executing program 2: socketpair(0x22, 0x0, 0x193, &(0x7f0000000100)) 01:06:37 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x57150000, 0x0, 0x0}) [ 1395.874972][T14038] binder: 14036:14038 unknown command 28 [ 1395.896457][T14038] binder: 14036:14038 ioctl c0306201 20000100 returned -22 01:06:37 executing program 4: socketpair(0x2c, 0x0, 0x71, &(0x7f0000000100)) 01:06:37 executing program 5: syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_PREFER_SUBDEVICE(0xffffffffffffffff, 0x40045542, 0x0) 01:06:37 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x6c000000, 0x0, 0x0}) 01:06:37 executing program 2: socketpair(0x22, 0x0, 0x194, &(0x7f0000000100)) 01:06:37 executing program 3: syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='attr/exec\x00') write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000080), 0x106, 0xa}}, 0x20) [ 1396.042120][T14048] binder: 14046:14048 unknown command 28 [ 1396.047840][T14048] binder: 14046:14048 ioctl c0306201 20000100 returned -22 [ 1396.095992][T14052] binder: 14050:14052 unknown command 28 [ 1396.112275][T14052] binder: 14050:14052 ioctl c0306201 20000100 returned -22 01:06:37 executing program 0: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='attr/exec\x00') write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000080), 0x106, 0xa}}, 0x20) 01:06:37 executing program 4: socketpair(0x2c, 0x0, 0x72, &(0x7f0000000100)) 01:06:37 executing program 2: socketpair(0x22, 0x0, 0x195, &(0x7f0000000100)) 01:06:37 executing program 5: r0 = open$dir(&(0x7f0000000100)='./file0\x00', 0x24800, 0x8) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x101000, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r1, 0x8000000) io_uring_setup(0x6aa3, &(0x7f0000000080)={0x0, 0xf4cb, 0x1, 0x0, 0x21a, 0x0, r1}) ioctl$IOCTL_VMCI_DATAGRAM_SEND(r1, 0x7ab, &(0x7f0000000580)={&(0x7f0000000140)={{@any, 0x6}, {@my=0x1, 0x2}, 0x400, "a44231b42c23cb8e72107382cd798e47acea9a34890ad25938649a529e763d94bef877c5787af7ea4b881ed8e23c78973be653f1a7d6ccfd58ec1283137da979b95373435b5dc4c76b3de0031771e539ab7ab9450dbec65456e8983cf19aff28acfba8170914f360edb98cb69e9ed429622c8401cb1d085c1096f06edfa0f621e032da5a52345ce52675a723c83eb276b74eb8d51b0077363e8fa148bd3606fe2de3200cd8fee430dc3fb9ffb8a0bdd598fb11bd57d03aa6e7271763b5f2f586b08723c87c9c0fb97e6f418f94f81a6eb3c918b834c2511347e703c8ae52bd37b50acbe42175bf667e4e0e30e849214afaaad108869d62314f922ec6d50265eb9d237fc35464923a4e6e944e48177d5711352bf8898b487d6da75f2a59bb78b50162e8ebd3d968c4c537be7c8a3a1a87e17c44ff60c7c4336af7fe6de6c64416c8643c4adf0997d0bee8cc80a62050218a88afb22bed971a0a13b069cafbb81ceb264032876a7179ced9dc534907e837d4bbe644a531033b6ebabd2724bd16fd4ba69e0d46c91d5ed41d6bb0c940627d0e0fd7328b7c382859209598e56c98ee534cd35840717395711718fc861b07d1da1f412a25d55c93be9ab9d56e21cf1c0311dc81a9c00048cf9284f36da4bd7e1bcb3984a298622dabafecdaa0cc7baf60f03914a1433dba7de5c199cda832cc1116f7ddd5ce3fc5edd09b7a330bf3a893d9f3e9c7d6a03a8904095a8c350ca0900e3ca94da7bbfa6e0b27d191083fcf9ba84e6e4e95cab7ff917588b81cd44e4efe3caf09a1a9132394169ff7b31e4a703236d0b0f451df909a2a8e95dbfdaf421dc808433bfe0ce2791a9eefb504f464bb3ddcd6f77b092b7e957de358436406855ac93c59c3aade692c7ac9879ba62f4c805fbe9d1c4fc48c939f639d5552e49e9846e412c6764ae7a07f2e72b91cd1815233904f43a3663923ad0acba643680c91e11706c5ca7d0a5309978543b4cd83374a3e1836494d4b505773434a31488813a79fb21c11dfbf01639463c59eb0f6268bb9fe7e89a252d2b419524333fd18c65515187a7b491e2d7fcfd4a75faf3123d0dcb9fe1c05a6d0531bf1e08ca3a4964aba017c8762a167bf4c82bcbc27b4d7b9455c603a69b09abcc9ac77f398b46082319fa9129f035a24da765389591ae25e25c807276131c4ffe919fe19f4413bbd6e1325a072bf600091fac69ad2c1e11c6dd5764d7b76c763b66d0c152990b4c6671f74e9b08ba9ef395b0d44c7ef702ea2a41e89e29de5b6b5e40e7c23744ce12683d18747c3fa7966a8b31db721e9774f7be3855f176847a07e9444a580347e20276a4db616a3eea9c2e79169a83f184b898094a45a5d9c107fbc186fb4c7dd7c4254a5040b7275148a4196d8e7965970bd10f12e4a70caa3f7e1d3ad8729b108f227d7a938ebb821b24096"}, 0x418}) r2 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) syz_open_dev$binderN(&(0x7f0000000a80)='/dev/binder#\x00', 0x0, 0x802) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(0xffffffffffffffff, 0x7, &(0x7f0000000ac0)=r1, 0x1) r3 = openat$dir(0xffffffffffffff9c, &(0x7f00000005c0)='./file0\x00', 0x400240, 0x0) name_to_handle_at(r0, &(0x7f0000000900)='./file0\x00', &(0x7f0000000940)={0xf6, 0x4, "031b139364a5d87bc71c8914c8e20e26bf6c042d0aa6d43c2ec49e8254ee4b083e4f0ea0e2b6803d2c9abbbd74028e31797042190ca5e1aa2e134e62bc0ac1231c2de9b56f9ec514efeb85e9167f32b8d059583a794decd56a1dc969ade39778e4691565400865740a636f562b695db2661c1d4e8695093263916df51b39982810ca22d45a2bd3a035f45ecb4243db0e4b4cc14000fd56b11ce4a70721c2b3f9d83956005c6c21c34245c08b2a46e9ba6327cb0ab091d89c97d7a612dcffa3f6eab3f4d94757f9caf3b8c9bf90898e74cb46a5cb3e600ba76654d8babbd08f45d0e64434bd7ed6f08e139feca7b5"}, &(0x7f0000000a40), 0x1000) r4 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_RX_RING(r4, 0x11b, 0x2, &(0x7f0000001e40)=0x100080, 0x4) name_to_handle_at(r3, &(0x7f0000000840)='./file0\x00', &(0x7f0000000800)=ANY=[@ANYRESOCT=r4], &(0x7f0000000700), 0x0) linkat(0xffffffffffffffff, &(0x7f00000007c0)='./file0\x00', r1, &(0x7f0000000740)='./file0\x00', 0x400) r5 = syz_open_dev$sndctrl(&(0x7f0000000600)='/dev/snd/controlC#\x00', 0x8, 0x40) ioctl$FS_IOC_GET_ENCRYPTION_PWSALT(r1, 0x40106614, &(0x7f00000008c0)) ioctl$SNDRV_CTL_IOCTL_ELEM_LOCK(r5, 0x40405514, &(0x7f0000000880)={0x3, 0x0, 0x89a, 0x8, 'syz1\x00', 0xf04f}) sendmsg$AUDIT_GET_FEATURE(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000b00)={&(0x7f0000000680)={0x10, 0x3fb, 0x4, 0x70bd2c, 0x25dfdbfb, "", ["", "", "", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x4000450}, 0x20040080) ioctl$IOCTL_VMCI_SET_NOTIFY(0xffffffffffffffff, 0x7cb, &(0x7f0000000040)={0x8001, 0x3, 0x3}) ioctl$BINDER_WRITE_READ(r2, 0x5421, &(0x7f00000024c0)={0x2, 0x0, 0x0, 0x0, 0x0, 0x0}) 01:06:37 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x74000000, 0x0, 0x0}) 01:06:37 executing program 3: syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='attr/exec\x00') write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000080), 0x106, 0xa}}, 0x20) 01:06:37 executing program 2: socketpair(0x22, 0x0, 0x196, &(0x7f0000000100)) 01:06:37 executing program 4: socketpair(0x2c, 0x0, 0x73, &(0x7f0000000100)) 01:06:37 executing program 0: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='attr/exec\x00') write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000080), 0x106, 0xa}}, 0x20) [ 1396.363410][T14070] binder: 14067:14070 unknown command 28 01:06:37 executing program 3: syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='attr/exec\x00') write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000080), 0x106, 0xa}}, 0x20) [ 1396.406267][T14070] binder: 14067:14070 ioctl c0306201 20000100 returned -22 01:06:37 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x20401) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_PREFER_SUBDEVICE(r0, 0x40045542, &(0x7f00000005c0)=0x2) 01:06:37 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x7a000000, 0x0, 0x0}) 01:06:37 executing program 2: socketpair(0x22, 0x0, 0x197, &(0x7f0000000100)) 01:06:37 executing program 0: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='attr/exec\x00') write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000080), 0x106, 0xa}}, 0x20) 01:06:37 executing program 4: socketpair(0x2c, 0x0, 0x74, &(0x7f0000000100)) 01:06:37 executing program 3: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='attr/exec\x00') write$RDMA_USER_CM_CMD_CREATE_ID(r0, 0x0, 0x0) 01:06:37 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x20401) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_PREFER_SUBDEVICE(r0, 0x40045542, &(0x7f00000005c0)=0x2) 01:06:37 executing program 2: socketpair(0x22, 0x0, 0x198, &(0x7f0000000100)) [ 1396.646786][T14085] binder: 14081:14085 unknown command 28 [ 1396.672898][T14085] binder: 14081:14085 ioctl c0306201 20000100 returned -22 01:06:37 executing program 4: socketpair(0x2c, 0x0, 0x75, &(0x7f0000000100)) 01:06:37 executing program 0: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000080), 0x106, 0xa}}, 0x20) 01:06:37 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0xff000000, 0x0, 0x0}) 01:06:37 executing program 3: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='attr/exec\x00') write$RDMA_USER_CM_CMD_CREATE_ID(r0, 0x0, 0x0) 01:06:38 executing program 2: socketpair(0x22, 0x0, 0x199, &(0x7f0000000100)) 01:06:38 executing program 0: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000080), 0x106, 0xa}}, 0x20) 01:06:38 executing program 5: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='attr/exec\x00') write$RDMA_USER_CM_CMD_CREATE_ID(r0, 0x0, 0x0) [ 1396.914934][T14100] binder: 14099:14100 unknown command 28 [ 1396.951612][T14100] binder: 14099:14100 ioctl c0306201 20000100 returned -22 01:06:38 executing program 4: socketpair(0x2c, 0x0, 0x76, &(0x7f0000000100)) 01:06:38 executing program 3: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='attr/exec\x00') write$RDMA_USER_CM_CMD_CREATE_ID(r0, 0x0, 0x0) 01:06:38 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0xffffe000, 0x0, 0x0}) 01:06:38 executing program 2: socketpair(0x22, 0x0, 0x19a, &(0x7f0000000100)) 01:06:38 executing program 5: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='attr/exec\x00') write$RDMA_USER_CM_CMD_CREATE_ID(r0, 0x0, 0x0) 01:06:38 executing program 0: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000080), 0x106, 0xa}}, 0x20) 01:06:38 executing program 4: socketpair(0x2c, 0x0, 0x77, &(0x7f0000000100)) 01:06:38 executing program 3: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='attr/exec\x00') write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080), 0x106, 0xa}}, 0x20) 01:06:38 executing program 2: socketpair(0x22, 0x0, 0x19b, &(0x7f0000000100)) [ 1397.200995][T14118] binder: 14115:14118 unknown command 28 [ 1397.228694][T14118] binder: 14115:14118 ioctl c0306201 20000100 returned -22 01:06:38 executing program 5: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='attr/exec\x00') write$RDMA_USER_CM_CMD_CREATE_ID(r0, 0x0, 0x0) 01:06:38 executing program 0: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='attr/exec\x00') write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000080), 0x106, 0xa}}, 0x20) 01:06:38 executing program 4: socketpair(0x2c, 0x0, 0x78, &(0x7f0000000100)) 01:06:38 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0xe0ffff00000000, 0x0, 0x0}) 01:06:38 executing program 2: socketpair(0x22, 0x0, 0x19c, &(0x7f0000000100)) 01:06:38 executing program 3: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='attr/exec\x00') write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x0, 0x0, 0x106, 0xa}}, 0x20) 01:06:38 executing program 0: r0 = syz_open_procfs(0xffffffffffffffff, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000080), 0x106, 0xa}}, 0x20) 01:06:38 executing program 4: socketpair(0x2c, 0x0, 0x79, &(0x7f0000000100)) [ 1397.478806][T14136] binder: 14134:14136 unknown command 28 [ 1397.500878][T14136] binder: 14134:14136 ioctl c0306201 20000100 returned -22 01:06:38 executing program 5: write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, 0x0, 0x0) 01:06:38 executing program 2: socketpair(0x22, 0x0, 0x19d, &(0x7f0000000100)) 01:06:38 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x100000000000000, 0x0, 0x0}) 01:06:38 executing program 3: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='attr/exec\x00') write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x0, 0x0, 0x0, 0xa}}, 0x20) 01:06:38 executing program 0: r0 = syz_open_procfs(0xffffffffffffffff, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000080), 0x106, 0xa}}, 0x20) 01:06:38 executing program 5: write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, 0x0, 0x0) 01:06:38 executing program 4: socketpair(0x2c, 0x0, 0x7a, &(0x7f0000000100)) [ 1397.714486][T14149] binder: 14147:14149 unknown command 28 [ 1397.745284][T14149] binder: 14147:14149 ioctl c0306201 20000100 returned -22 01:06:38 executing program 2: socketpair(0x22, 0x0, 0x19e, &(0x7f0000000100)) 01:06:38 executing program 3: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='attr/exec\x00') write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x0, 0x0}}, 0x20) 01:06:38 executing program 0: r0 = syz_open_procfs(0xffffffffffffffff, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000080), 0x106, 0xa}}, 0x20) 01:06:39 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x200000000000000, 0x0, 0x0}) 01:06:39 executing program 5: write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, 0x0, 0x0) 01:06:39 executing program 4: socketpair(0x2c, 0x0, 0x7b, &(0x7f0000000100)) 01:06:39 executing program 2: socketpair(0x22, 0x0, 0x19f, &(0x7f0000000100)) 01:06:39 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x1, 0x48100) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(r0, 0xc1205531, &(0x7f0000000080)={0x1, 0x3, 0xfcf, 0x8, [], [], [], 0x401, 0x80000000, 0x4, 0x3, "989df9a5985bb3d432e8bc62db5372bc"}) r1 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0x5421, &(0x7f00000024c0)={0x2, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat$ocfs2_control(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ocfs2_control\x00', 0x4801, 0x0) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_PREFER_SUBDEVICE(r2, 0x40045542, &(0x7f0000000200)=0x3) [ 1397.981776][T14166] binder: 14163:14166 unknown command 28 [ 1397.993633][T14166] binder: 14163:14166 ioctl c0306201 20000100 returned -22 01:06:39 executing program 0: syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='attr/exec\x00') write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000080), 0x106, 0xa}}, 0x20) 01:06:39 executing program 4: socketpair(0x2c, 0x0, 0x7c, &(0x7f0000000100)) 01:06:39 executing program 5: r0 = syz_open_procfs(0xffffffffffffffff, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, 0x0, 0x0) 01:06:39 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x300000000000000, 0x0, 0x0}) 01:06:39 executing program 2: socketpair(0x22, 0x0, 0x1a0, &(0x7f0000000100)) 01:06:39 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x1, 0x48100) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(r0, 0xc1205531, &(0x7f0000000080)={0x1, 0x3, 0xfcf, 0x8, [], [], [], 0x401, 0x80000000, 0x4, 0x3, "989df9a5985bb3d432e8bc62db5372bc"}) r1 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0x5421, &(0x7f00000024c0)={0x2, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat$ocfs2_control(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ocfs2_control\x00', 0x4801, 0x0) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_PREFER_SUBDEVICE(r2, 0x40045542, &(0x7f0000000200)=0x3) 01:06:39 executing program 4: socketpair(0x2c, 0x0, 0x7d, &(0x7f0000000100)) 01:06:39 executing program 0: syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='attr/exec\x00') write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000080), 0x106, 0xa}}, 0x20) [ 1398.235820][T14181] binder: 14180:14181 unknown command 28 [ 1398.260931][T14181] binder: 14180:14181 ioctl c0306201 20000100 returned -22 01:06:39 executing program 5: r0 = syz_open_procfs(0xffffffffffffffff, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, 0x0, 0x0) 01:06:39 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x400000000000000, 0x0, 0x0}) 01:06:39 executing program 0: syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='attr/exec\x00') write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000080), 0x106, 0xa}}, 0x20) 01:06:39 executing program 4: socketpair(0x2c, 0x0, 0x7e, &(0x7f0000000100)) 01:06:39 executing program 2: socketpair(0x22, 0x0, 0x1a1, &(0x7f0000000100)) 01:06:39 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x1, 0x48100) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(r0, 0xc1205531, &(0x7f0000000080)={0x1, 0x3, 0xfcf, 0x8, [], [], [], 0x401, 0x80000000, 0x4, 0x3, "989df9a5985bb3d432e8bc62db5372bc"}) r1 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0x5421, &(0x7f00000024c0)={0x2, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat$ocfs2_control(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ocfs2_control\x00', 0x4801, 0x0) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_PREFER_SUBDEVICE(r2, 0x40045542, &(0x7f0000000200)=0x3) 01:06:39 executing program 5: r0 = syz_open_procfs(0xffffffffffffffff, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, 0x0, 0x0) [ 1398.468605][T14195] binder: 14192:14195 unknown command 28 [ 1398.495830][T14195] binder: 14192:14195 ioctl c0306201 20000100 returned -22 01:06:39 executing program 0: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='attr/exec\x00') write$RDMA_USER_CM_CMD_CREATE_ID(r0, 0x0, 0x0) 01:06:39 executing program 4: socketpair(0x2c, 0x0, 0x82, &(0x7f0000000100)) 01:06:39 executing program 2: socketpair(0x22, 0x0, 0x1a2, &(0x7f0000000100)) 01:06:39 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x500000000000000, 0x0, 0x0}) 01:06:39 executing program 5: syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='attr/exec\x00') write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, 0x0, 0x0) 01:06:39 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x1, 0x48100) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(r0, 0xc1205531, &(0x7f0000000080)={0x1, 0x3, 0xfcf, 0x8, [], [], [], 0x401, 0x80000000, 0x4, 0x3, "989df9a5985bb3d432e8bc62db5372bc"}) r1 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0x5421, &(0x7f00000024c0)={0x2, 0x0, 0x0, 0x0, 0x0, 0x0}) openat$ocfs2_control(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ocfs2_control\x00', 0x4801, 0x0) 01:06:39 executing program 2: socketpair(0x22, 0x0, 0x1a3, &(0x7f0000000100)) 01:06:39 executing program 4: socketpair(0x2c, 0x0, 0x83, &(0x7f0000000100)) [ 1398.731974][T14212] binder: 14209:14212 unknown command 28 [ 1398.751643][T14212] binder: 14209:14212 ioctl c0306201 20000100 returned -22 01:06:39 executing program 5: syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='attr/exec\x00') write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, 0x0, 0x0) 01:06:39 executing program 0: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='attr/exec\x00') write$RDMA_USER_CM_CMD_CREATE_ID(r0, 0x0, 0x0) 01:06:39 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x600000000000000, 0x0, 0x0}) 01:06:40 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x1, 0x48100) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(r0, 0xc1205531, &(0x7f0000000080)={0x1, 0x3, 0xfcf, 0x8, [], [], [], 0x401, 0x80000000, 0x4, 0x3, "989df9a5985bb3d432e8bc62db5372bc"}) r1 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0x5421, &(0x7f00000024c0)={0x2, 0x0, 0x0, 0x0, 0x0, 0x0}) 01:06:40 executing program 4: socketpair(0x2c, 0x0, 0x84, &(0x7f0000000100)) [ 1398.907840][T14221] binder: 14218:14221 unknown command 28 [ 1398.937357][T14221] binder: 14218:14221 ioctl c0306201 20000100 returned -22 01:06:40 executing program 2: socketpair(0x22, 0x0, 0x1a4, &(0x7f0000000100)) 01:06:40 executing program 5: syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='attr/exec\x00') write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, 0x0, 0x0) 01:06:40 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x1, 0x48100) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(r0, 0xc1205531, &(0x7f0000000080)={0x1, 0x3, 0xfcf, 0x8, [], [], [], 0x401, 0x80000000, 0x4, 0x3, "989df9a5985bb3d432e8bc62db5372bc"}) syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) 01:06:40 executing program 0: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='attr/exec\x00') write$RDMA_USER_CM_CMD_CREATE_ID(r0, 0x0, 0x0) 01:06:40 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x700000000000000, 0x0, 0x0}) 01:06:40 executing program 2: socketpair(0x22, 0x0, 0x1a5, &(0x7f0000000100)) 01:06:40 executing program 5: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='attr/exec\x00') write$RDMA_USER_CM_CMD_CREATE_ID(r0, 0x0, 0x0) 01:06:40 executing program 4: socketpair(0x2c, 0x0, 0x85, &(0x7f0000000100)) 01:06:40 executing program 0: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='attr/exec\x00') write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080), 0x106, 0xa}}, 0x20) 01:06:40 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x1, 0x48100) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(r0, 0xc1205531, &(0x7f0000000080)={0x1, 0x3, 0xfcf, 0x8, [], [], [], 0x401, 0x80000000, 0x4, 0x3, "989df9a5985bb3d432e8bc62db5372bc"}) [ 1399.182151][T14239] binder: 14238:14239 unknown command 28 [ 1399.208730][T14239] binder: 14238:14239 ioctl c0306201 20000100 returned -22 01:06:40 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x800000000000000, 0x0, 0x0}) 01:06:40 executing program 4: socketpair(0x2c, 0x0, 0x86, &(0x7f0000000100)) 01:06:40 executing program 2: socketpair(0x22, 0x0, 0x1a6, &(0x7f0000000100)) 01:06:40 executing program 5: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='attr/exec\x00') write$RDMA_USER_CM_CMD_CREATE_ID(r0, 0x0, 0x0) 01:06:40 executing program 0: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='attr/exec\x00') write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x0, 0x0, 0x106, 0xa}}, 0x20) 01:06:40 executing program 3: ioctl$SNDRV_CTL_IOCTL_PCM_INFO(0xffffffffffffffff, 0xc1205531, &(0x7f0000000080)={0x1, 0x3, 0xfcf, 0x8, [], [], [], 0x401, 0x80000000, 0x4, 0x3, "989df9a5985bb3d432e8bc62db5372bc"}) [ 1399.446089][T14251] binder: 14250:14251 unknown command 28 [ 1399.460356][T14251] binder: 14250:14251 ioctl c0306201 20000100 returned -22 01:06:40 executing program 4: socketpair(0x2c, 0x0, 0x87, &(0x7f0000000100)) 01:06:40 executing program 2: socketpair(0x22, 0x0, 0x1a7, &(0x7f0000000100)) 01:06:40 executing program 3: ioctl$SNDRV_CTL_IOCTL_PCM_INFO(0xffffffffffffffff, 0xc1205531, &(0x7f0000000080)={0x1, 0x3, 0xfcf, 0x8, [], [], [], 0x401, 0x80000000, 0x4, 0x3, "989df9a5985bb3d432e8bc62db5372bc"}) 01:06:40 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x1f00000000000000, 0x0, 0x0}) 01:06:40 executing program 0: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='attr/exec\x00') write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x0, 0x0, 0x0, 0xa}}, 0x20) 01:06:40 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x800000000000000, 0x0, 0x0}) 01:06:40 executing program 4: socketpair(0x2c, 0x0, 0x88, &(0x7f0000000100)) [ 1399.653100][T14267] binder: 14263:14267 unknown command 28 [ 1399.672099][T14267] binder: 14263:14267 ioctl c0306201 20000100 returned -22 01:06:40 executing program 2: socketpair(0x22, 0x0, 0x1a8, &(0x7f0000000100)) 01:06:40 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x2000000000000000, 0x0, 0x0}) 01:06:40 executing program 3: ioctl$SNDRV_CTL_IOCTL_PCM_INFO(0xffffffffffffffff, 0xc1205531, &(0x7f0000000080)={0x1, 0x3, 0xfcf, 0x8, [], [], [], 0x401, 0x80000000, 0x4, 0x3, "989df9a5985bb3d432e8bc62db5372bc"}) [ 1399.738178][T14273] binder: 14270:14273 unknown command 28 [ 1399.776823][T14273] binder: 14270:14273 ioctl c0306201 20000100 returned -22 01:06:40 executing program 0: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='attr/exec\x00') write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x0, 0x0}}, 0x20) 01:06:41 executing program 4: socketpair(0x2c, 0x0, 0x89, &(0x7f0000000100)) 01:06:41 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x1f00000000000000, 0x0, 0x0}) 01:06:41 executing program 3: r0 = syz_open_dev$sndctrl(0x0, 0x1, 0x48100) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(r0, 0xc1205531, &(0x7f0000000080)={0x1, 0x3, 0xfcf, 0x8, [], [], [], 0x401, 0x80000000, 0x4, 0x3, "989df9a5985bb3d432e8bc62db5372bc"}) 01:06:41 executing program 2: socketpair(0x22, 0x0, 0x1a9, &(0x7f0000000100)) [ 1399.905824][T14282] binder: 14278:14282 unknown command 28 [ 1399.929036][T14282] binder: 14278:14282 ioctl c0306201 20000100 returned -22 01:06:41 executing program 0: socketpair(0x2c, 0x0, 0x87, &(0x7f0000000100)) 01:06:41 executing program 4: socketpair(0x2c, 0x0, 0x8a, &(0x7f0000000100)) [ 1400.014589][T14287] binder: 14284:14287 unknown command 28 [ 1400.029216][T14287] binder: 14284:14287 ioctl c0306201 20000100 returned -22 01:06:41 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x4800000000000000, 0x0, 0x0}) 01:06:41 executing program 3: r0 = syz_open_dev$sndctrl(0x0, 0x1, 0x48100) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(r0, 0xc1205531, &(0x7f0000000080)={0x1, 0x3, 0xfcf, 0x8, [], [], [], 0x401, 0x80000000, 0x4, 0x3, "989df9a5985bb3d432e8bc62db5372bc"}) 01:06:41 executing program 5: r0 = syz_open_procfs(0xffffffffffffffff, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, 0x0, 0x0) 01:06:41 executing program 2: socketpair(0x22, 0x0, 0x1aa, &(0x7f0000000100)) 01:06:41 executing program 4: socketpair(0x2c, 0x0, 0x8b, &(0x7f0000000100)) 01:06:41 executing program 0: socketpair(0x2c, 0x0, 0x7d, &(0x7f0000000100)) [ 1400.202184][T14297] binder: 14296:14297 unknown command 28 [ 1400.218313][T14297] binder: 14296:14297 ioctl c0306201 20000100 returned -22 01:06:41 executing program 3: r0 = syz_open_dev$sndctrl(0x0, 0x1, 0x48100) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(r0, 0xc1205531, &(0x7f0000000080)={0x1, 0x3, 0xfcf, 0x8, [], [], [], 0x401, 0x80000000, 0x4, 0x3, "989df9a5985bb3d432e8bc62db5372bc"}) 01:06:41 executing program 0: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x1002) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='net/ip_mr_vif\x00') r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r2, 0x8000000) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000580)={0x70, 0x0, &(0x7f0000000480)=[@request_death={0x400c630e, 0x2}, @transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f00000003c0)={@flat=@weak_binder={0x77622a85, 0x100a, 0x1}, @ptr={0x70742a85, 0x0, &(0x7f0000000340)=""/122, 0x7a, 0x0, 0x3f}, @flat=@binder={0x73622a85, 0xa}}, &(0x7f0000000440)={0x0, 0x18, 0x40}}, 0x400}, @clear_death={0x400c630f, 0x3}, @enter_looper], 0x5e, 0x0, &(0x7f0000000500)="853f337670a0ef55a61b4a6a100507030c0f57f607d5a37e84d8db22e1f60a754b14f020e527cf84193993175bd8b848fee0005d2c3f8fd6a03d9062dee3c12c942fd83e0802a003806be8c3166397ed7e0c9910b9ff2c597a4778ca71ad"}) ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f00000024c0)={0x0, 0x0, 0x0, 0xfffe, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) getpeername(r1, &(0x7f0000000140)=@pptp={0x18, 0x2, {0x0, @private}}, &(0x7f0000000300)=0x80) r4 = syz_genetlink_get_family_id$smc(&(0x7f0000000100)='SMC_PNETID\x00', r1) sendmsg$SMC_PNETID_FLUSH(r3, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f00000001c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="b23ce6179adf3921ce9745c1556e1d693a5b381ead5238c87945e3b8c75d0e0d000094747057ea41d1aba69a", @ANYRES16=r4, @ANYBLOB="10002dbd7000fcdbdf25040000000500040001000000140002006261746164765f736c6176655f3100001400020073797a6b616c6c6572300000000000000500040001000000"], 0x4c}, 0x1, 0x0, 0x0, 0x40004}, 0x80) socketpair(0x18, 0xa, 0x6, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$XDP_UMEM_REG(r5, 0x11b, 0x4, &(0x7f0000000640)={&(0x7f0000000600)=""/45, 0x8000, 0x0, 0xcd, 0xdb2be6c2734d59e7}, 0x20) syz_open_dev$binderN(&(0x7f0000000240)='/dev/binder#\x00', 0x0, 0x0) r6 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000680)='/dev/ubi_ctrl\x00', 0x189781, 0x0) getpeername(r1, &(0x7f00000006c0)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, &(0x7f0000000740)=0x80) ioctl$sock_bt_hidp_HIDPCONNADD(r6, 0x400448c8, &(0x7f0000000840)={r3, r7, 0x8, 0xbb, &(0x7f0000000780)="1bdced035997c210a28b7c0892482b2775045bfa823617e8d8d10eb1395d6e6a70dc2cc11ac00a55b8362a889bbe1cd4a52e94f40eb57fc4fadb29e527316bb8046c835debeea15ce473670459d2b15e054108728d64e473bc7c059a7ef3eb85b49ef71da5fe197e7cd7f429908ef70f78f6d06723dfc5595791a146954491a0a86646e3ef8dbbd1f3b443a85126a21532700191d4ed86d9c247bf916dff72a94bc0aa1d61a41f1fd287ed5be3c2b8c8d3b53254f5899958ca00cd", 0x9, 0x1, 0xcd, 0x207, 0x1f, 0x0, 0x2, 'syz0\x00'}) 01:06:41 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x4c00000000000000, 0x0, 0x0}) 01:06:41 executing program 5: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x2) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_PREFER_SUBDEVICE(0xffffffffffffffff, 0x40045542, &(0x7f00000005c0)=0x2) 01:06:41 executing program 2: socketpair(0x22, 0x0, 0x1ab, &(0x7f0000000100)) 01:06:41 executing program 4: socketpair(0x2c, 0x0, 0x8c, &(0x7f0000000100)) 01:06:41 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x0, 0x48100) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(r0, 0xc1205531, &(0x7f0000000080)={0x1, 0x3, 0xfcf, 0x8, [], [], [], 0x401, 0x80000000, 0x4, 0x3, "989df9a5985bb3d432e8bc62db5372bc"}) [ 1400.444561][T14312] binder: 14310:14312 unknown command 28 [ 1400.468451][T14312] binder: 14310:14312 ioctl c0306201 20000100 returned -22 01:06:41 executing program 2: socketpair(0x22, 0x0, 0x1ac, &(0x7f0000000100)) 01:06:41 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x5715000000000000, 0x0, 0x0}) 01:06:41 executing program 5: ioctl$IOCTL_VMCI_DATAGRAM_SEND(0xffffffffffffffff, 0x7ab, &(0x7f0000000680)={&(0x7f0000000240)={{@any, 0xffff}, {@host, 0x1}, 0x400, "bcdf106edfc3f9cc412452617506a369d810858bee7ce2661cc8e7df633b936448676ce94b6ebb356b89e112e721a6dace8e02f4a421221e4ded7132540836cd4a398362ca3fc601f259cf385c7cf93ce4b10a5e47d07f44531a9b353eea90fc4ac720c48c7d10bf3209033a822796a5cf7e956429079e8a4b928a664b7730387e2356eed1ce1ace2aea0514ad2dc2fc2a68a0cb9381f7a9af9dfd0d79562df465ff3daa14286c46c925b3ff55e2c940489e4efbb0f774b7cb41eadbb94ab17fd2d821d8ee9155dca63677e77b30b0f959713a5d93b613f4dcd85d918dda303914dd26d7fd7c6b22b4ea9557e6cb03ef8a3aee42dac1c158a5e543baf483e427b5b6fc2aa493e7052fd94dd4b684acf41d6ed1d06de92a3db90b2276f156944847773795103dc0bb97cf9dc0be79757b1e1143ed7d42cacf430176a34fb3c28e3843f54c8ed3957f96372388de46f68fb1cbc6fe8ebca8e52f3159897e579773bab102b962fb607956269acdfcda7fb5e30b87491cce886eb8b51a4df5a7bcf9b98259c61a8b7ac4e350844ac3090b2fdf82d787b869c5ee239b05c72d809ddeef906d0170c2247d8961df0994a51391c266bfc3cadd43189cd7a086a50ee799885d1a40a2a69ea0deb6f879411f78a66ba82e43f0dcf2659e635d320d2369e8653be8fcb2211773cf6b68e31655b4853586e6365c22a0e82548ba1ec464af35e27ec47ff27158efb3921cf75364135d1d9582800d00a7ddeb6db9895f70c075eb9bd197ef03a3d9a984662f40db4c5417c782138fdbac076ebf1d9bc5b9d7b681721b6ad3dd099341ec43d1c183b982d6147208028653b23bcb3fd9043494b26ec139a6c18789e9098293ce9021c17083403cf13645627d413e05fd08903fc71c50f5d3b8d803f4f89ac8016e9c828a87bb76fee73ca9c8b15483d852f9d7566862e4a1c77f6ab848f3d3624426bc828ffaefb4d1f007789724961ef424a15d58e22a4c40da9c75229f1223ae3bb4b7181dc143474130ea33691c43f17257f6c9c29700120aaa1d4fa3770b5fd01f945105067b7eaacac710cd78e13a434919847231fb5fc868690ed9470f008da4f7d4317a7476672824319e6ed54105e4e5353e6d701262dc4e13635535ba106a19e625f9644e03f780b20715f309711460323e9f7f8ffafe61f204160366c8a961f070b4f62c9435ae7984a63854a6aa6f39d23e179ce98b828b88a0f65db028b1214092a690ebc542f52cf98425256908e7bad54c2ff700fa4ddefec3777e0c5ed8603e731682a847f66f3d17b5302abacd7c0804d17dbc3fffd5dc611e488888212f61735e6f649ae9a17d51badb9a773392b351b032695d9e32f193f974da8569e02c471ac949552b3ced07cb6a356d3971e4dccec206143bb7b3e04dfda23679a1494f6ad8f9ceb8556ba58bfdae0e"}, 0x418, 0x4eb}) syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0xc02) r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r0, 0x8000000) r1 = openat$ocfs2_control(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ocfs2_control\x00', 0x80202, 0x0) ioctl$BINDER_WRITE_READ(r1, 0x5421, &(0x7f0000000080)={0x0, 0x0, 0x0, 0xffffffffffffffa9, 0x0, 0x0}) getrandom(&(0x7f00000000c0)=""/118, 0x76, 0x1) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r2, 0x8000000) mmap$usbfs(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x8, 0x10010, r2, 0x6c) r3 = socket$xdp(0x2c, 0x3, 0x0) ioctl$vim2m_VIDIOC_DQBUF(r2, 0xc0585611, &(0x7f00000001c0)={0xfff, 0x2, 0x4, 0x800, 0x6, {}, {0x0, 0x1, 0x1, 0x1, 0x7d, 0x1, "b4996f90"}, 0xe5, 0x3, @planes=&(0x7f0000000180)={0x1, 0xbcfe, @mem_offset=0x100, 0x8}, 0x3c, 0x0, r2}) setsockopt$XDP_UMEM_FILL_RING(r3, 0x11b, 0x5, &(0x7f0000000140)=0x100010, 0x4) 01:06:41 executing program 0: ioctl$IOCTL_VMCI_DATAGRAM_SEND(0xffffffffffffffff, 0x7ab, &(0x7f0000000680)={&(0x7f0000000240)={{@any, 0xffff}, {@host, 0x1}, 0x400, "bcdf106edfc3f9cc412452617506a369d810858bee7ce2661cc8e7df633b936448676ce94b6ebb356b89e112e721a6dace8e02f4a421221e4ded7132540836cd4a398362ca3fc601f259cf385c7cf93ce4b10a5e47d07f44531a9b353eea90fc4ac720c48c7d10bf3209033a822796a5cf7e956429079e8a4b928a664b7730387e2356eed1ce1ace2aea0514ad2dc2fc2a68a0cb9381f7a9af9dfd0d79562df465ff3daa14286c46c925b3ff55e2c940489e4efbb0f774b7cb41eadbb94ab17fd2d821d8ee9155dca63677e77b30b0f959713a5d93b613f4dcd85d918dda303914dd26d7fd7c6b22b4ea9557e6cb03ef8a3aee42dac1c158a5e543baf483e427b5b6fc2aa493e7052fd94dd4b684acf41d6ed1d06de92a3db90b2276f156944847773795103dc0bb97cf9dc0be79757b1e1143ed7d42cacf430176a34fb3c28e3843f54c8ed3957f96372388de46f68fb1cbc6fe8ebca8e52f3159897e579773bab102b962fb607956269acdfcda7fb5e30b87491cce886eb8b51a4df5a7bcf9b98259c61a8b7ac4e350844ac3090b2fdf82d787b869c5ee239b05c72d809ddeef906d0170c2247d8961df0994a51391c266bfc3cadd43189cd7a086a50ee799885d1a40a2a69ea0deb6f879411f78a66ba82e43f0dcf2659e635d320d2369e8653be8fcb2211773cf6b68e31655b4853586e6365c22a0e82548ba1ec464af35e27ec47ff27158efb3921cf75364135d1d9582800d00a7ddeb6db9895f70c075eb9bd197ef03a3d9a984662f40db4c5417c782138fdbac076ebf1d9bc5b9d7b681721b6ad3dd099341ec43d1c183b982d6147208028653b23bcb3fd9043494b26ec139a6c18789e9098293ce9021c17083403cf13645627d413e05fd08903fc71c50f5d3b8d803f4f89ac8016e9c828a87bb76fee73ca9c8b15483d852f9d7566862e4a1c77f6ab848f3d3624426bc828ffaefb4d1f007789724961ef424a15d58e22a4c40da9c75229f1223ae3bb4b7181dc143474130ea33691c43f17257f6c9c29700120aaa1d4fa3770b5fd01f945105067b7eaacac710cd78e13a434919847231fb5fc868690ed9470f008da4f7d4317a7476672824319e6ed54105e4e5353e6d701262dc4e13635535ba106a19e625f9644e03f780b20715f309711460323e9f7f8ffafe61f204160366c8a961f070b4f62c9435ae7984a63854a6aa6f39d23e179ce98b828b88a0f65db028b1214092a690ebc542f52cf98425256908e7bad54c2ff700fa4ddefec3777e0c5ed8603e731682a847f66f3d17b5302abacd7c0804d17dbc3fffd5dc611e488888212f61735e6f649ae9a17d51badb9a773392b351b032695d9e32f193f974da8569e02c471ac949552b3ced07cb6a356d3971e4dccec206143bb7b3e04dfda23679a1494f6ad8f9ceb8556ba58bfdae0e"}, 0x418, 0x4eb}) syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0xc02) r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r0, 0x8000000) r1 = openat$ocfs2_control(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ocfs2_control\x00', 0x80202, 0x0) ioctl$BINDER_WRITE_READ(r1, 0x5421, &(0x7f0000000080)={0x0, 0x0, 0x0, 0xffffffffffffffa9, 0x0, 0x0}) getrandom(&(0x7f00000000c0)=""/118, 0x76, 0x1) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r2, 0x8000000) mmap$usbfs(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x8, 0x10010, r2, 0x6c) r3 = socket$xdp(0x2c, 0x3, 0x0) ioctl$vim2m_VIDIOC_DQBUF(r2, 0xc0585611, &(0x7f00000001c0)={0xfff, 0x2, 0x4, 0x800, 0x6, {}, {0x0, 0x1, 0x1, 0x1, 0x7d, 0x1, "b4996f90"}, 0xe5, 0x3, @planes=&(0x7f0000000180)={0x1, 0xbcfe, @mem_offset=0x100, 0x8}, 0x3c, 0x0, r2}) setsockopt$XDP_UMEM_FILL_RING(r3, 0x11b, 0x5, &(0x7f0000000140)=0x100010, 0x4) 01:06:41 executing program 4: socketpair(0x2c, 0x0, 0x8d, &(0x7f0000000100)) 01:06:41 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(r0, 0xc1205531, &(0x7f0000000080)={0x1, 0x3, 0xfcf, 0x8, [], [], [], 0x401, 0x80000000, 0x4, 0x3, "989df9a5985bb3d432e8bc62db5372bc"}) 01:06:41 executing program 2: socketpair(0x22, 0x0, 0x1ad, &(0x7f0000000100)) [ 1400.657270][T14324] binder: 14322:14324 unknown command 28 [ 1400.677358][T14324] binder: 14322:14324 ioctl c0306201 20000100 returned -22 01:06:41 executing program 4: socketpair(0x2c, 0x0, 0x8e, &(0x7f0000000100)) 01:06:41 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x5815000000000000, 0x0, 0x0}) 01:06:41 executing program 5: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x2) r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x20401) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x3, 0xa2, 0x80000000, 'syz0\x00', 0x8}, 0x1, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8, 0x0, 0x2, 0x39, 0x6, 0x9, 0x1, 0x7, 0x7, 0x6]}) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_PREFER_SUBDEVICE(r0, 0x40045542, &(0x7f00000005c0)=0x2) 01:06:41 executing program 2: socketpair(0x22, 0x0, 0x1ae, &(0x7f0000000100)) 01:06:42 executing program 0: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x2) r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x20401) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x3, 0xa2, 0x80000000, 'syz0\x00', 0x8}, 0x1, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8, 0x0, 0x2, 0x39, 0x6, 0x9, 0x1, 0x7, 0x7, 0x6]}) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_PREFER_SUBDEVICE(r0, 0x40045542, &(0x7f00000005c0)=0x2) 01:06:42 executing program 3: syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(0xffffffffffffffff, 0xc1205531, &(0x7f0000000080)={0x1, 0x3, 0xfcf, 0x8, [], [], [], 0x401, 0x80000000, 0x4, 0x3, "989df9a5985bb3d432e8bc62db5372bc"}) 01:06:42 executing program 4: socketpair(0x2c, 0x0, 0x8f, &(0x7f0000000100)) 01:06:42 executing program 2: socketpair(0x22, 0x0, 0x1af, &(0x7f0000000100)) [ 1400.974032][T14343] binder: 14339:14343 unknown command 28 [ 1401.004861][T14343] binder: 14339:14343 ioctl c0306201 20000100 returned -22 01:06:42 executing program 4: socketpair(0x2c, 0x0, 0x90, &(0x7f0000000100)) 01:06:42 executing program 5: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x2) r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x20401) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x3, 0xa2, 0x80000000, 'syz0\x00', 0x8}, 0x1, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8, 0x0, 0x2, 0x39, 0x6, 0x9, 0x1, 0x7, 0x7, 0x6]}) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_PREFER_SUBDEVICE(r0, 0x40045542, &(0x7f00000005c0)=0x2) 01:06:42 executing program 3: syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(0xffffffffffffffff, 0xc1205531, &(0x7f0000000080)={0x1, 0x3, 0xfcf, 0x8, [], [], [], 0x401, 0x80000000, 0x4, 0x3, "989df9a5985bb3d432e8bc62db5372bc"}) 01:06:42 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r1, 0x8000000) ioctl$SECCOMP_IOCTL_NOTIF_ID_VALID(r1, 0x40082102, &(0x7f0000000040)) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_PREFER_SUBDEVICE(r1, 0x40045542, &(0x7f00000002c0)=0x200) ioctl$SNDRV_CTL_IOCTL_TLV_COMMAND(r1, 0xc008551c, &(0x7f0000000300)={0x5, 0x8, [0x3, 0xfffffffe]}) ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f00000024c0)={0x2, 0x0, 0x0, 0x0, 0x0, 0x0}) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r1, &(0x7f0000000340)={0x5, 0x10, 0xfa00, {&(0x7f0000000080), 0xffffffffffffffff, 0x1}}, 0x18) 01:06:42 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x6000000000000000, 0x0, 0x0}) 01:06:42 executing program 2: socketpair(0x22, 0x0, 0x1b0, &(0x7f0000000100)) [ 1401.216259][T14359] binder: 14356:14359 unknown command 28 [ 1401.247114][T14359] binder: 14356:14359 ioctl c0306201 20000100 returned -22 01:06:42 executing program 3: syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(0xffffffffffffffff, 0xc1205531, &(0x7f0000000080)={0x1, 0x3, 0xfcf, 0x8, [], [], [], 0x401, 0x80000000, 0x4, 0x3, "989df9a5985bb3d432e8bc62db5372bc"}) 01:06:42 executing program 0: openat$vmci(0xffffffffffffff9c, &(0x7f0000000600)='/dev/vmci\x00', 0x2, 0x0) ioctl$IOCTL_VMCI_QUEUEPAIR_SETVA(0xffffffffffffffff, 0x7a4, &(0x7f0000000640)={{@host, 0xfffffff9}, 0xf7, 0xdc27, 0xfffffffd, 0x58}) 01:06:42 executing program 5: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x2) r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x20401) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x3, 0xa2, 0x80000000, 'syz0\x00', 0x8}, 0x1, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8, 0x0, 0x2, 0x39, 0x6, 0x9, 0x1, 0x7, 0x7, 0x6]}) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_PREFER_SUBDEVICE(r0, 0x40045542, &(0x7f00000005c0)=0x2) 01:06:42 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x6800000000000000, 0x0, 0x0}) 01:06:42 executing program 2: socketpair(0x22, 0x0, 0x1b1, &(0x7f0000000100)) 01:06:42 executing program 4: socketpair(0x2c, 0x0, 0x91, &(0x7f0000000100)) 01:06:42 executing program 2: socketpair(0x22, 0x0, 0x1b2, &(0x7f0000000100)) 01:06:42 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(r0, 0xc1205531, 0x0) 01:06:42 executing program 0: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x2) r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x20401) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x3, 0xa2, 0x80000000, 'syz0\x00', 0x8}, 0x1, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8, 0x0, 0x2, 0x39, 0x6, 0x9, 0x1, 0x7, 0x7, 0x6]}) rseq(&(0x7f0000000040)={0x0, 0x0, 0x0, 0x1}, 0x20, 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_PREFER_SUBDEVICE(r0, 0x40045542, &(0x7f00000005c0)=0x2) [ 1401.447834][T14374] binder: 14372:14374 unknown command 28 [ 1401.469321][T14374] binder: 14372:14374 ioctl c0306201 20000100 returned -22 01:06:42 executing program 5: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x2) r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x20401) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x3, 0xa2, 0x80000000, 'syz0\x00', 0x8}, 0x1, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8, 0x0, 0x2, 0x39, 0x6, 0x9, 0x1, 0x7, 0x7, 0x6]}) 01:06:42 executing program 4: socketpair(0x2c, 0x0, 0x92, &(0x7f0000000100)) 01:06:42 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x6c00000000000000, 0x0, 0x0}) 01:06:42 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(r0, 0xc1205531, 0x0) 01:06:42 executing program 2: socketpair(0x22, 0x0, 0x1b3, &(0x7f0000000100)) 01:06:42 executing program 0: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x2) r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x20401) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x3, 0xa2, 0x80000000, 'syz0\x00', 0x8}, 0x1, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8, 0x0, 0x2, 0x39, 0x6, 0x9, 0x1, 0x7, 0x7, 0x6]}) rseq(&(0x7f0000000040)={0x0, 0x0, 0x0, 0x1}, 0x20, 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_PREFER_SUBDEVICE(r0, 0x40045542, &(0x7f00000005c0)=0x2) 01:06:42 executing program 5: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x2) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(0xffffffffffffffff, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x3, 0xa2, 0x80000000, 'syz0\x00', 0x8}, 0x1, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8, 0x0, 0x2, 0x39, 0x6, 0x9, 0x1, 0x7, 0x7, 0x6]}) [ 1401.699297][T14387] binder: 14385:14387 unknown command 28 [ 1401.723744][T14387] binder: 14385:14387 ioctl c0306201 20000100 returned -22 01:06:42 executing program 4: socketpair(0x2c, 0x0, 0x93, &(0x7f0000000100)) 01:06:42 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x7400000000000000, 0x0, 0x0}) 01:06:42 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(r0, 0xc1205531, 0x0) 01:06:43 executing program 2: socketpair(0x22, 0x0, 0x1b4, &(0x7f0000000100)) 01:06:43 executing program 5: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x2) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(0xffffffffffffffff, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x3, 0xa2, 0x80000000, 'syz0\x00', 0x8}, 0x1, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8, 0x0, 0x2, 0x39, 0x6, 0x9, 0x1, 0x7, 0x7, 0x6]}) 01:06:43 executing program 0: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x2) r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x20401) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x3, 0xa2, 0x80000000, 'syz0\x00', 0x8}, 0x1, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8, 0x0, 0x2, 0x39, 0x6, 0x9, 0x1, 0x7, 0x7, 0x6]}) rseq(&(0x7f0000000040)={0x0, 0x0, 0x0, 0x1}, 0x20, 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_PREFER_SUBDEVICE(r0, 0x40045542, &(0x7f00000005c0)=0x2) 01:06:43 executing program 4: socketpair(0x2c, 0x0, 0x94, &(0x7f0000000100)) 01:06:43 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(r0, 0xc1205531, &(0x7f0000000080)={0x0, 0x3, 0xfcf, 0x8, [], [], [], 0x401, 0x80000000, 0x4, 0x3, "989df9a5985bb3d432e8bc62db5372bc"}) [ 1401.948627][T14402] binder: 14399:14402 unknown command 28 [ 1401.983882][T14402] binder: 14399:14402 ioctl c0306201 20000100 returned -22 01:06:43 executing program 2: socketpair(0x22, 0x0, 0x1b5, &(0x7f0000000100)) 01:06:43 executing program 5: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x2) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(0xffffffffffffffff, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x3, 0xa2, 0x80000000, 'syz0\x00', 0x8}, 0x1, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8, 0x0, 0x2, 0x39, 0x6, 0x9, 0x1, 0x7, 0x7, 0x6]}) 01:06:43 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x7a00000000000000, 0x0, 0x0}) 01:06:43 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(r0, 0xc1205531, &(0x7f0000000080)={0x0, 0x0, 0xfcf, 0x8, [], [], [], 0x401, 0x80000000, 0x4, 0x3, "989df9a5985bb3d432e8bc62db5372bc"}) 01:06:43 executing program 4: socketpair(0x2c, 0x0, 0x95, &(0x7f0000000100)) 01:06:43 executing program 0: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x2) r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x20401) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x3, 0xa2, 0x80000000, 'syz0\x00', 0x8}, 0x1, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8, 0x0, 0x2, 0x39, 0x6, 0x9, 0x1, 0x7, 0x7, 0x6]}) rseq(&(0x7f0000000040)={0x0, 0x0, 0x0, 0x1}, 0x20, 0x0, 0x0) 01:06:43 executing program 2: socketpair(0x22, 0x0, 0x1b6, &(0x7f0000000100)) 01:06:43 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x20401) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x3, 0xa2, 0x80000000, 'syz0\x00', 0x8}, 0x1, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8, 0x0, 0x2, 0x39, 0x6, 0x9, 0x1, 0x7, 0x7, 0x6]}) [ 1402.251019][T14417] binder: 14416:14417 unknown command 28 [ 1402.280368][T14417] binder: 14416:14417 ioctl c0306201 20000100 returned -22 01:06:43 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(r0, 0xc1205531, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x8, [], [], [], 0x401, 0x80000000, 0x4, 0x3, "989df9a5985bb3d432e8bc62db5372bc"}) 01:06:43 executing program 4: socketpair(0x2c, 0x0, 0x96, &(0x7f0000000100)) 01:06:43 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0xff00000000000000, 0x0, 0x0}) 01:06:43 executing program 2: socketpair(0x22, 0x0, 0x1b7, &(0x7f0000000100)) 01:06:43 executing program 0: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x2) r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x20401) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x3, 0xa2, 0x80000000, 'syz0\x00', 0x8}, 0x1, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8, 0x0, 0x2, 0x39, 0x6, 0x9, 0x1, 0x7, 0x7, 0x6]}) 01:06:43 executing program 5: r0 = syz_open_dev$sndctrl(0x0, 0x2, 0x20401) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x3, 0xa2, 0x80000000, 'syz0\x00', 0x8}, 0x1, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8, 0x0, 0x2, 0x39, 0x6, 0x9, 0x1, 0x7, 0x7, 0x6]}) 01:06:43 executing program 4: socketpair(0x2c, 0x0, 0x97, &(0x7f0000000100)) [ 1402.537003][T14434] binder: 14432:14434 unknown command 28 [ 1402.557076][T14434] binder: 14432:14434 ioctl c0306201 20000100 returned -22 01:06:43 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(r0, 0xc1205531, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x8, [], [], [], 0x401, 0x80000000, 0x4, 0x3, "989df9a5985bb3d432e8bc62db5372bc"}) 01:06:43 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x2, 0x0}) 01:06:43 executing program 5: r0 = syz_open_dev$sndctrl(0x0, 0x2, 0x20401) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x3, 0xa2, 0x80000000, 'syz0\x00', 0x8}, 0x1, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8, 0x0, 0x2, 0x39, 0x6, 0x9, 0x1, 0x7, 0x7, 0x6]}) 01:06:43 executing program 2: socketpair(0x22, 0x0, 0x1b8, &(0x7f0000000100)) 01:06:43 executing program 0: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x2) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(0xffffffffffffffff, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x3, 0xa2, 0x80000000, 'syz0\x00', 0x8}, 0x1, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8, 0x0, 0x2, 0x39, 0x6, 0x9, 0x1, 0x7, 0x7, 0x6]}) 01:06:43 executing program 4: socketpair(0x2c, 0x0, 0x98, &(0x7f0000000100)) 01:06:43 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(r0, 0xc1205531, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x8, [], [], [], 0x401, 0x80000000, 0x4, 0x3, "989df9a5985bb3d432e8bc62db5372bc"}) [ 1402.762432][T14448] binder: 14444:14448 unknown command 28 [ 1402.784926][T14448] binder: 14444:14448 ioctl c0306201 20000100 returned -22 01:06:44 executing program 5: r0 = syz_open_dev$sndctrl(0x0, 0x2, 0x20401) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x3, 0xa2, 0x80000000, 'syz0\x00', 0x8}, 0x1, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8, 0x0, 0x2, 0x39, 0x6, 0x9, 0x1, 0x7, 0x7, 0x6]}) 01:06:44 executing program 2: socketpair(0x22, 0x0, 0x1b9, &(0x7f0000000100)) 01:06:44 executing program 0: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x2) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(0xffffffffffffffff, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x3, 0xa2, 0x80000000, 'syz0\x00', 0x8}, 0x1, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8, 0x0, 0x2, 0x39, 0x6, 0x9, 0x1, 0x7, 0x7, 0x6]}) 01:06:44 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x3, 0x0}) 01:06:44 executing program 4: socketpair(0x2c, 0x0, 0x99, &(0x7f0000000100)) 01:06:44 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(r0, 0xc1205531, &(0x7f0000000080)={0x0, 0x0, 0xfcf, 0x0, [], [], [], 0x401, 0x80000000, 0x4, 0x3, "989df9a5985bb3d432e8bc62db5372bc"}) 01:06:44 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x20401) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x3, 0xa2, 0x80000000, 'syz0\x00', 0x8}, 0x1, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8, 0x0, 0x2, 0x39, 0x6, 0x9, 0x1, 0x7, 0x7, 0x6]}) 01:06:44 executing program 0: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x2) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(0xffffffffffffffff, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x3, 0xa2, 0x80000000, 'syz0\x00', 0x8}, 0x1, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8, 0x0, 0x2, 0x39, 0x6, 0x9, 0x1, 0x7, 0x7, 0x6]}) 01:06:44 executing program 2: socketpair(0x22, 0x0, 0x1ba, &(0x7f0000000100)) 01:06:44 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(r0, 0xc1205531, &(0x7f0000000080)={0x0, 0x0, 0xfcf, 0x0, [], [], [], 0x0, 0x80000000, 0x4, 0x3, "989df9a5985bb3d432e8bc62db5372bc"}) 01:06:44 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x20401) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x3, 0xa2, 0x80000000, 'syz0\x00', 0x8}, 0x1, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8, 0x0, 0x2, 0x39, 0x6, 0x9, 0x1, 0x7, 0x7, 0x6]}) 01:06:44 executing program 4: socketpair(0x2c, 0x0, 0x9a, &(0x7f0000000100)) [ 1403.154661][T14470] binder: 14468:14470 unknown command 28 [ 1403.181430][T14470] binder: 14468:14470 ioctl c0306201 20000100 returned -22 01:06:44 executing program 2: socketpair(0x22, 0x0, 0x1bb, &(0x7f0000000100)) 01:06:44 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x20401) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x3, 0xa2, 0x80000000, 'syz0\x00', 0x8}, 0x1, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8, 0x0, 0x2, 0x39, 0x6, 0x9, 0x1, 0x7, 0x7, 0x6]}) 01:06:44 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x4, 0x0}) 01:06:44 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(r0, 0xc1205531, &(0x7f0000000080)={0x0, 0x0, 0xfcf, 0x0, [], [], [], 0x0, 0x0, 0x4, 0x3, "989df9a5985bb3d432e8bc62db5372bc"}) 01:06:44 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x20401) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x3, 0xa2, 0x80000000, 'syz0\x00', 0x8}, 0x1, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8, 0x0, 0x2, 0x39, 0x6, 0x9, 0x1, 0x7, 0x7, 0x6]}) 01:06:44 executing program 4: socketpair(0x2c, 0x0, 0x9b, &(0x7f0000000100)) 01:06:44 executing program 0: r0 = syz_open_dev$sndctrl(0x0, 0x2, 0x20401) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x3, 0xa2, 0x80000000, 'syz0\x00', 0x8}, 0x1, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8, 0x0, 0x2, 0x39, 0x6, 0x9, 0x1, 0x7, 0x7, 0x6]}) 01:06:44 executing program 2: socketpair(0x22, 0x0, 0x1bc, &(0x7f0000000100)) [ 1403.431029][T14485] binder: 14484:14485 unknown command 28 [ 1403.457979][T14485] binder: 14484:14485 ioctl c0306201 20000100 returned -22 01:06:44 executing program 4: socketpair(0x2c, 0x0, 0x9c, &(0x7f0000000100)) 01:06:44 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(r0, 0xc1205531, &(0x7f0000000080)={0x0, 0x0, 0xfcf, 0x0, [], [], [], 0x0, 0x0, 0x0, 0x3, "989df9a5985bb3d432e8bc62db5372bc"}) 01:06:44 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x3, 0xa2, 0x80000000, 'syz0\x00', 0x8}, 0x1, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8, 0x0, 0x2, 0x39, 0x6, 0x9, 0x1, 0x7, 0x7, 0x6]}) 01:06:44 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x5, 0x0}) 01:06:44 executing program 4: socketpair(0x2c, 0x0, 0x9d, &(0x7f0000000100)) 01:06:44 executing program 0: r0 = syz_open_dev$sndctrl(0x0, 0x2, 0x20401) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x3, 0xa2, 0x80000000, 'syz0\x00', 0x8}, 0x1, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8, 0x0, 0x2, 0x39, 0x6, 0x9, 0x1, 0x7, 0x7, 0x6]}) 01:06:44 executing program 2: socketpair(0x22, 0x0, 0x1bd, &(0x7f0000000100)) 01:06:44 executing program 5: syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(0xffffffffffffffff, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x3, 0xa2, 0x80000000, 'syz0\x00', 0x8}, 0x1, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8, 0x0, 0x2, 0x39, 0x6, 0x9, 0x1, 0x7, 0x7, 0x6]}) 01:06:44 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(r0, 0xc1205531, &(0x7f0000000080)={0x0, 0x0, 0xfcf, 0x0, [], [], [], 0x0, 0x0, 0x0, 0x0, "989df9a5985bb3d432e8bc62db5372bc"}) [ 1403.717424][T14503] binder: 14501:14503 unknown command 28 [ 1403.746084][T14503] binder: 14501:14503 ioctl c0306201 20000100 returned -22 01:06:44 executing program 4: socketpair(0x2c, 0x0, 0x9e, &(0x7f0000000100)) 01:06:44 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x6, 0x0}) 01:06:44 executing program 0: r0 = syz_open_dev$sndctrl(0x0, 0x2, 0x20401) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x3, 0xa2, 0x80000000, 'syz0\x00', 0x8}, 0x1, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8, 0x0, 0x2, 0x39, 0x6, 0x9, 0x1, 0x7, 0x7, 0x6]}) 01:06:45 executing program 2: socketpair(0x22, 0x0, 0x1be, &(0x7f0000000100)) 01:06:45 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(r0, 0xc1205531, &(0x7f0000000080)={0x0, 0x0, 0xfcf, 0x0, [], [], [], 0x0, 0x0, 0x0, 0x0, "989df9a5985bb3d432e8bc62db5372bc"}) 01:06:45 executing program 5: syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(0xffffffffffffffff, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x3, 0xa2, 0x80000000, 'syz0\x00', 0x8}, 0x1, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8, 0x0, 0x2, 0x39, 0x6, 0x9, 0x1, 0x7, 0x7, 0x6]}) 01:06:45 executing program 4: socketpair(0x2c, 0x0, 0x9f, &(0x7f0000000100)) 01:06:45 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x20401) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x3, 0xa2, 0x80000000, 'syz0\x00', 0x8}, 0x1, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8, 0x0, 0x2, 0x39, 0x6, 0x9, 0x1, 0x7, 0x7, 0x6]}) 01:06:45 executing program 2: socketpair(0x22, 0x0, 0x1bf, &(0x7f0000000100)) [ 1403.993856][T14521] binder: 14519:14521 unknown command 28 [ 1404.021581][T14521] binder: 14519:14521 ioctl c0306201 20000100 returned -22 01:06:45 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x7, 0x0}) 01:06:45 executing program 5: syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(0xffffffffffffffff, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x3, 0xa2, 0x80000000, 'syz0\x00', 0x8}, 0x1, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8, 0x0, 0x2, 0x39, 0x6, 0x9, 0x1, 0x7, 0x7, 0x6]}) 01:06:45 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x20401) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x3, 0xa2, 0x80000000, 'syz0\x00', 0x8}, 0x1, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8, 0x0, 0x2, 0x39, 0x6, 0x9, 0x1, 0x7, 0x7, 0x6]}) 01:06:45 executing program 4: socketpair(0x2c, 0x0, 0xa0, &(0x7f0000000100)) 01:06:45 executing program 2: socketpair(0x22, 0x0, 0x1c0, &(0x7f0000000100)) 01:06:45 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x20401) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x3, 0xa2, 0x80000000, 'syz0\x00', 0x8}, 0x1, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8, 0x0, 0x2, 0x39, 0x6, 0x9, 0x1, 0x7, 0x7, 0x6]}) [ 1404.257343][T14535] binder: 14532:14535 unknown command 28 [ 1404.286764][T14535] binder: 14532:14535 ioctl c0306201 20000100 returned -22 01:06:45 executing program 2: socketpair(0x22, 0x0, 0x1c1, &(0x7f0000000100)) 01:06:45 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, 0x0) 01:06:45 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x20401) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x3, 0xa2, 0x80000000, 'syz0\x00', 0x8}, 0x1, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8, 0x0, 0x2, 0x39, 0x6, 0x9, 0x1, 0x7, 0x7, 0x6]}) 01:06:45 executing program 4: socketpair(0x2c, 0x0, 0xa1, &(0x7f0000000100)) 01:06:45 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x8, 0x0}) 01:06:45 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x20401) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x3, 0xa2, 0x80000000, 'syz0\x00', 0x8}, 0x1, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8, 0x0, 0x2, 0x39, 0x6, 0x9, 0x1, 0x7, 0x7, 0x6]}) 01:06:45 executing program 2: socketpair(0x22, 0x0, 0x1c2, &(0x7f0000000100)) 01:06:45 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x20401) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x3, 0xa2, 0x80000000, 'syz0\x00', 0x8}, 0x1, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8, 0x0, 0x2, 0x39, 0x6, 0x9, 0x1, 0x7, 0x7, 0x6]}) 01:06:45 executing program 4: socketpair(0x2c, 0x0, 0xa2, &(0x7f0000000100)) 01:06:45 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, 0x0) [ 1404.554923][T14554] binder: 14551:14554 unknown command 28 01:06:45 executing program 2: socketpair(0x22, 0x0, 0x1c3, &(0x7f0000000100)) [ 1404.610264][T14554] binder: 14551:14554 ioctl c0306201 20000100 returned -22 01:06:45 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x3, 0xa2, 0x80000000, 'syz0\x00', 0x8}, 0x1, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8, 0x0, 0x2, 0x39, 0x6, 0x9, 0x1, 0x7, 0x7, 0x6]}) 01:06:45 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x48, 0x0}) 01:06:45 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, 0x0) 01:06:45 executing program 4: socketpair(0x2c, 0x0, 0xa3, &(0x7f0000000100)) 01:06:45 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x20401) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x3, 0xa2, 0x80000000, 'syz0\x00', 0x8}, 0x1, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8, 0x0, 0x2, 0x39, 0x6, 0x9, 0x1, 0x7, 0x7, 0x6]}) 01:06:46 executing program 0: syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(0xffffffffffffffff, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x3, 0xa2, 0x80000000, 'syz0\x00', 0x8}, 0x1, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8, 0x0, 0x2, 0x39, 0x6, 0x9, 0x1, 0x7, 0x7, 0x6]}) [ 1404.802124][T14570] binder: 14566:14570 unknown command 28 [ 1404.821785][T14570] binder: 14566:14570 ioctl c0306201 20000100 returned -22 01:06:46 executing program 2: socketpair(0x22, 0x0, 0x1c4, &(0x7f0000000100)) 01:06:46 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x3, 0xa2, 0x80000000, 'syz0\x00', 0x8}, 0x1, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8, 0x0, 0x2, 0x39, 0x6, 0x9, 0x1, 0x7, 0x7, 0x6]}) 01:06:46 executing program 3: ioctl$SNDRV_CTL_IOCTL_ELEM_READ(0xffffffffffffffff, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x3, 0xa2, 0x80000000, 'syz0\x00', 0x8}, 0x1, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8, 0x0, 0x2, 0x39, 0x6, 0x9, 0x1, 0x7, 0x7, 0x6]}) 01:06:46 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x4c, 0x0}) 01:06:46 executing program 4: socketpair(0x2c, 0x0, 0xa4, &(0x7f0000000100)) 01:06:46 executing program 0: syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(0xffffffffffffffff, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x3, 0xa2, 0x80000000, 'syz0\x00', 0x8}, 0x1, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8, 0x0, 0x2, 0x39, 0x6, 0x9, 0x1, 0x7, 0x7, 0x6]}) 01:06:46 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x3, 0xa2, 0x80000000, 'syz0\x00', 0x8}, 0x1, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8, 0x0, 0x2, 0x39, 0x6, 0x9, 0x1, 0x7, 0x7, 0x6]}) 01:06:46 executing program 2: socketpair(0x22, 0x0, 0x1c5, &(0x7f0000000100)) [ 1405.024663][T14583] binder: 14582:14583 unknown command 28 [ 1405.045449][T14583] binder: 14582:14583 ioctl c0306201 20000100 returned -22 01:06:46 executing program 3: ioctl$SNDRV_CTL_IOCTL_ELEM_READ(0xffffffffffffffff, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x3, 0xa2, 0x80000000, 'syz0\x00', 0x8}, 0x1, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8, 0x0, 0x2, 0x39, 0x6, 0x9, 0x1, 0x7, 0x7, 0x6]}) 01:06:46 executing program 4: socketpair(0x2c, 0x0, 0xa5, &(0x7f0000000100)) 01:06:46 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x60, 0x0}) 01:06:46 executing program 2: socketpair(0x22, 0x0, 0x1c6, &(0x7f0000000100)) 01:06:46 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x3, 0xa2, 0x80000000, 'syz0\x00', 0x8}, 0x1, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8, 0x0, 0x2, 0x39, 0x6, 0x9, 0x1, 0x7, 0x7, 0x6]}) 01:06:46 executing program 0: syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(0xffffffffffffffff, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x3, 0xa2, 0x80000000, 'syz0\x00', 0x8}, 0x1, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8, 0x0, 0x2, 0x39, 0x6, 0x9, 0x1, 0x7, 0x7, 0x6]}) 01:06:46 executing program 3: ioctl$SNDRV_CTL_IOCTL_ELEM_READ(0xffffffffffffffff, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x3, 0xa2, 0x80000000, 'syz0\x00', 0x8}, 0x1, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8, 0x0, 0x2, 0x39, 0x6, 0x9, 0x1, 0x7, 0x7, 0x6]}) [ 1405.275812][T14599] binder: 14595:14599 unknown command 28 [ 1405.310294][T14599] binder: 14595:14599 ioctl c0306201 20000100 returned -22 01:06:46 executing program 4: socketpair(0x2c, 0x0, 0xa6, &(0x7f0000000100)) 01:06:46 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x68, 0x0}) 01:06:46 executing program 2: socketpair(0x22, 0x0, 0x1c7, &(0x7f0000000100)) 01:06:46 executing program 3: r0 = syz_open_dev$sndctrl(0x0, 0x0, 0x20401) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x3, 0xa2, 0x80000000, 'syz0\x00', 0x8}, 0x1, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8, 0x0, 0x2, 0x39, 0x6, 0x9, 0x1, 0x7, 0x7, 0x6]}) 01:06:46 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0xa2, 0x80000000, 'syz0\x00', 0x8}, 0x1, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8, 0x0, 0x2, 0x39, 0x6, 0x9, 0x1, 0x7, 0x7, 0x6]}) 01:06:46 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, 0x0) 01:06:46 executing program 4: socketpair(0x2c, 0x0, 0xa7, &(0x7f0000000100)) [ 1405.525474][T14612] binder: 14610:14612 unknown command 28 [ 1405.561795][T14612] binder: 14610:14612 ioctl c0306201 20000100 returned -22 01:06:46 executing program 3: r0 = syz_open_dev$sndctrl(0x0, 0x0, 0x20401) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x3, 0xa2, 0x80000000, 'syz0\x00', 0x8}, 0x1, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8, 0x0, 0x2, 0x39, 0x6, 0x9, 0x1, 0x7, 0x7, 0x6]}) 01:06:46 executing program 2: socketpair(0x22, 0x0, 0x1c8, &(0x7f0000000100)) 01:06:46 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x80000000, 'syz0\x00', 0x8}, 0x1, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8, 0x0, 0x2, 0x39, 0x6, 0x9, 0x1, 0x7, 0x7, 0x6]}) 01:06:46 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x6c, 0x0}) 01:06:46 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, 0x0) 01:06:46 executing program 4: socketpair(0x2c, 0x0, 0xa8, &(0x7f0000000100)) 01:06:46 executing program 2: socketpair(0x22, 0x0, 0x1c9, &(0x7f0000000100)) 01:06:46 executing program 3: r0 = syz_open_dev$sndctrl(0x0, 0x0, 0x20401) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x3, 0xa2, 0x80000000, 'syz0\x00', 0x8}, 0x1, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8, 0x0, 0x2, 0x39, 0x6, 0x9, 0x1, 0x7, 0x7, 0x6]}) [ 1405.780040][T14628] binder: 14626:14628 unknown command 28 [ 1405.792678][T14628] binder: 14626:14628 ioctl c0306201 20000100 returned -22 01:06:47 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00', 0x8}, 0x1, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8, 0x0, 0x2, 0x39, 0x6, 0x9, 0x1, 0x7, 0x7, 0x6]}) 01:06:47 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x74, 0x0}) 01:06:47 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, 0x0) 01:06:47 executing program 4: socketpair(0x2c, 0x0, 0xa9, &(0x7f0000000100)) 01:06:47 executing program 2: socketpair(0x22, 0x0, 0x1ca, &(0x7f0000000100)) 01:06:47 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x3, 0xa2, 0x80000000, 'syz0\x00', 0x8}, 0x1, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8, 0x0, 0x2, 0x39, 0x6, 0x9, 0x1, 0x7, 0x7, 0x6]}) [ 1406.006896][T14643] binder: 14639:14643 unknown command 28 [ 1406.032075][T14643] binder: 14639:14643 ioctl c0306201 20000100 returned -22 01:06:47 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x3, 0xa2, 0x80000000, 'syz0\x00', 0x8}, 0x1, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8, 0x0, 0x2, 0x39, 0x6, 0x9, 0x1, 0x7, 0x7, 0x6]}) 01:06:47 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x1, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8, 0x0, 0x2, 0x39, 0x6, 0x9, 0x1, 0x7, 0x7, 0x6]}) 01:06:47 executing program 4: socketpair(0x2c, 0x0, 0xaa, &(0x7f0000000100)) 01:06:47 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x7a, 0x0}) 01:06:47 executing program 2: socketpair(0x22, 0x0, 0x1cb, &(0x7f0000000100)) 01:06:47 executing program 3: syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(0xffffffffffffffff, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x3, 0xa2, 0x80000000, 'syz0\x00', 0x8}, 0x1, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8, 0x0, 0x2, 0x39, 0x6, 0x9, 0x1, 0x7, 0x7, 0x6]}) 01:06:47 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x3, 0xa2, 0x80000000, 'syz0\x00', 0x8}, 0x1, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8, 0x0, 0x2, 0x39, 0x6, 0x9, 0x1, 0x7, 0x7, 0x6]}) 01:06:47 executing program 4: socketpair(0x2c, 0x0, 0xab, &(0x7f0000000100)) 01:06:47 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8, 0x0, 0x2, 0x39, 0x6, 0x9, 0x1, 0x7, 0x7, 0x6]}) [ 1406.294531][T14660] binder: 14655:14660 unknown command 28 [ 1406.324514][T14660] binder: 14655:14660 ioctl c0306201 20000100 returned -22 01:06:47 executing program 2: socketpair(0x22, 0x0, 0x1cc, &(0x7f0000000100)) 01:06:47 executing program 3: syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(0xffffffffffffffff, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x3, 0xa2, 0x80000000, 'syz0\x00', 0x8}, 0x1, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8, 0x0, 0x2, 0x39, 0x6, 0x9, 0x1, 0x7, 0x7, 0x6]}) 01:06:47 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x300, 0x0}) 01:06:47 executing program 4: socketpair(0x2c, 0x0, 0xac, &(0x7f0000000100)) 01:06:47 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x3, 0xa2, 0x80000000, 'syz0\x00', 0x8}, 0x1, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8, 0x0, 0x2, 0x39, 0x6, 0x9, 0x1, 0x7, 0x7, 0x6]}) 01:06:47 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8, 0x0, 0x2, 0x39, 0x6, 0x9, 0x1, 0x7, 0x7]}) 01:06:47 executing program 2: socketpair(0x22, 0x0, 0x1cd, &(0x7f0000000100)) 01:06:47 executing program 3: syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(0xffffffffffffffff, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x3, 0xa2, 0x80000000, 'syz0\x00', 0x8}, 0x1, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8, 0x0, 0x2, 0x39, 0x6, 0x9, 0x1, 0x7, 0x7, 0x6]}) 01:06:47 executing program 4: socketpair(0x2c, 0x0, 0xad, &(0x7f0000000100)) [ 1406.561284][T14676] binder: 14673:14676 unknown command 28 [ 1406.588881][T14676] binder: 14673:14676 ioctl c0306201 20000100 returned -22 01:06:47 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0xa2, 0x80000000, 'syz0\x00', 0x8}, 0x1, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8, 0x0, 0x2, 0x39, 0x6, 0x9, 0x1, 0x7, 0x7, 0x6]}) 01:06:47 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8, 0x0, 0x2, 0x39, 0x6, 0x9, 0x1, 0x7]}) 01:06:47 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x500, 0x0}) 01:06:47 executing program 2: socketpair(0x22, 0x0, 0x1ce, &(0x7f0000000100)) 01:06:47 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, 0x0) 01:06:47 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x80000000, 'syz0\x00', 0x8}, 0x1, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8, 0x0, 0x2, 0x39, 0x6, 0x9, 0x1, 0x7, 0x7, 0x6]}) 01:06:47 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8, 0x0, 0x2, 0x39, 0x6, 0x9, 0x1]}) 01:06:47 executing program 4: socketpair(0x2c, 0x0, 0xae, &(0x7f0000000100)) [ 1406.823213][T14693] binder: 14689:14693 unknown command 28 01:06:48 executing program 2: socketpair(0x22, 0x0, 0x1cf, &(0x7f0000000100)) [ 1406.870314][T14693] binder: 14689:14693 ioctl c0306201 20000100 returned -22 01:06:48 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x600, 0x0}) 01:06:48 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, 0x0) 01:06:48 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00', 0x8}, 0x1, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8, 0x0, 0x2, 0x39, 0x6, 0x9, 0x1, 0x7, 0x7, 0x6]}) 01:06:48 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8, 0x0, 0x2, 0x39, 0x6, 0x9]}) 01:06:48 executing program 4: socketpair(0x2c, 0x0, 0xaf, &(0x7f0000000100)) 01:06:48 executing program 2: socketpair(0x22, 0x0, 0x1d0, &(0x7f0000000100)) [ 1407.097124][T14708] binder: 14704:14708 unknown command 28 [ 1407.128243][T14708] binder: 14704:14708 ioctl c0306201 20000100 returned -22 01:06:48 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, 0x0) 01:06:48 executing program 4: socketpair(0x2c, 0x0, 0xb0, &(0x7f0000000100)) 01:06:48 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x1, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8, 0x0, 0x2, 0x39, 0x6, 0x9, 0x1, 0x7, 0x7, 0x6]}) 01:06:48 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8, 0x0, 0x2, 0x39, 0x6]}) 01:06:48 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x700, 0x0}) 01:06:48 executing program 2: socketpair(0x22, 0x0, 0x1d1, &(0x7f0000000100)) 01:06:48 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x3, 0xa2, 0x80000000, 'syz0\x00', 0x8}, 0x1, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8, 0x0, 0x2, 0x39, 0x6, 0x9, 0x1, 0x7, 0x7, 0x6]}) 01:06:48 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8, 0x0, 0x2, 0x39, 0x6, 0x9, 0x1, 0x7, 0x7, 0x6]}) [ 1407.326494][T14724] binder: 14718:14724 unknown command 28 [ 1407.366579][T14724] binder: 14718:14724 ioctl c0306201 20000100 returned -22 01:06:48 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8, 0x0, 0x2, 0x39]}) 01:06:48 executing program 4: socketpair(0x2c, 0x0, 0xb1, &(0x7f0000000100)) 01:06:48 executing program 2: socketpair(0x22, 0x0, 0x1d2, &(0x7f0000000100)) 01:06:48 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x1557, 0x0}) 01:06:48 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x3, 0xa2, 0x80000000, 'syz0\x00', 0x8}, 0x1, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8, 0x0, 0x2, 0x39, 0x6, 0x9, 0x1, 0x7, 0x7, 0x6]}) 01:06:48 executing program 4: socketpair(0x2c, 0x0, 0xb2, &(0x7f0000000100)) 01:06:48 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8, 0x0, 0x2, 0x39, 0x6, 0x9, 0x1, 0x7, 0x7]}) 01:06:48 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8, 0x0, 0x2]}) 01:06:48 executing program 2: socketpair(0x22, 0x0, 0x1d3, &(0x7f0000000100)) [ 1407.654276][T14739] binder: 14738:14739 unknown command 28 [ 1407.693802][T14739] binder: 14738:14739 ioctl c0306201 20000100 returned -22 01:06:48 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x3, 0xa2, 0x80000000, 'syz0\x00', 0x8}, 0x1, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8, 0x0, 0x2, 0x39, 0x6, 0x9, 0x1, 0x7, 0x7, 0x6]}) 01:06:48 executing program 4: socketpair(0x2c, 0x0, 0xb3, &(0x7f0000000100)) 01:06:48 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x1558, 0x0}) 01:06:48 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8]}) 01:06:48 executing program 2: socketpair(0x22, 0x0, 0x1d4, &(0x7f0000000100)) 01:06:48 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8, 0x0, 0x2, 0x39, 0x6, 0x9, 0x1, 0x7]}) 01:06:49 executing program 4: socketpair(0x2c, 0x0, 0xb4, &(0x7f0000000100)) 01:06:49 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0xa2, 0x80000000, 'syz0\x00', 0x8}, 0x1, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8, 0x0, 0x2, 0x39, 0x6, 0x9, 0x1, 0x7, 0x7, 0x6]}) [ 1407.897931][T14756] binder: 14755:14756 unknown command 28 [ 1407.913921][T14756] binder: 14755:14756 ioctl c0306201 20000100 returned -22 01:06:49 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681]}) 01:06:49 executing program 2: socketpair(0x22, 0x0, 0x1d5, &(0x7f0000000100)) 01:06:49 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x1f00, 0x0}) 01:06:49 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8, 0x0, 0x2, 0x39, 0x6, 0x9, 0x1]}) 01:06:49 executing program 4: socketpair(0x2c, 0x0, 0xb5, &(0x7f0000000100)) 01:06:49 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x80000000, 'syz0\x00', 0x8}, 0x1, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8, 0x0, 0x2, 0x39, 0x6, 0x9, 0x1, 0x7, 0x7, 0x6]}) 01:06:49 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40]}) 01:06:49 executing program 2: socketpair(0x22, 0x0, 0x1d6, &(0x7f0000000100)) [ 1408.178344][T14773] binder: 14770:14773 unknown command 28 [ 1408.186304][T14773] binder: 14770:14773 ioctl c0306201 20000100 returned -22 01:06:49 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8, 0x0, 0x2, 0x39, 0x6, 0x9]}) 01:06:49 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x2000, 0x0}) 01:06:49 executing program 4: socketpair(0x2c, 0x0, 0xb6, &(0x7f0000000100)) 01:06:49 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7]}) 01:06:49 executing program 2: socketpair(0x22, 0x0, 0x1d7, &(0x7f0000000100)) [ 1408.373358][T14784] binder: 14781:14784 unknown command 28 01:06:49 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8, 0x0, 0x2, 0x39, 0x6]}) [ 1408.416602][T14784] binder: 14781:14784 ioctl c0306201 20000100 returned -22 01:06:49 executing program 4: socketpair(0x2c, 0x0, 0xb7, &(0x7f0000000100)) 01:06:49 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x4800, 0x0}) 01:06:49 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00', 0x8}, 0x1, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8, 0x0, 0x2, 0x39, 0x6, 0x9, 0x1, 0x7, 0x7, 0x6]}) 01:06:49 executing program 2: socketpair(0x22, 0x0, 0x1d8, &(0x7f0000000100)) 01:06:49 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8]}) 01:06:49 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8, 0x0, 0x2, 0x39]}) 01:06:49 executing program 4: socketpair(0x2c, 0x0, 0xb8, &(0x7f0000000100)) [ 1408.603114][T14798] binder: 14795:14798 unknown command 28 [ 1408.624404][T14798] binder: 14795:14798 ioctl c0306201 20000100 returned -22 01:06:49 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x1, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8, 0x0, 0x2, 0x39, 0x6, 0x9, 0x1, 0x7, 0x7, 0x6]}) 01:06:49 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000]}) 01:06:49 executing program 2: socketpair(0x22, 0x0, 0x1d9, &(0x7f0000000100)) 01:06:49 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x4c00, 0x0}) 01:06:49 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8, 0x0, 0x2]}) 01:06:49 executing program 4: socketpair(0x2c, 0x0, 0xb9, &(0x7f0000000100)) 01:06:50 executing program 2: socketpair(0x22, 0x0, 0x1da, &(0x7f0000000100)) [ 1408.856363][T14815] binder: 14811:14815 unknown command 28 [ 1408.890206][T14815] binder: 14811:14815 ioctl c0306201 20000100 returned -22 01:06:50 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8, 0x0, 0x2, 0x39, 0x6, 0x9, 0x1, 0x7, 0x7, 0x6]}) 01:06:50 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100]}) 01:06:50 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x5715, 0x0}) 01:06:50 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8]}) 01:06:50 executing program 4: socketpair(0x2c, 0x0, 0xba, &(0x7f0000000100)) 01:06:50 executing program 2: socketpair(0x22, 0x0, 0x1db, &(0x7f0000000100)) 01:06:50 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8, 0x0, 0x2, 0x39, 0x6, 0x9, 0x1, 0x7, 0x7]}) 01:06:50 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff]}) [ 1409.099118][T14829] binder: 14825:14829 unknown command 28 [ 1409.127287][T14829] binder: 14825:14829 ioctl c0306201 20000100 returned -22 01:06:50 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681]}) 01:06:50 executing program 4: socketpair(0x2c, 0x0, 0xbb, &(0x7f0000000100)) 01:06:50 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x5815, 0x0}) 01:06:50 executing program 2: socketpair(0x22, 0x0, 0x1dc, &(0x7f0000000100)) 01:06:50 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8, 0x0, 0x2, 0x39, 0x6, 0x9, 0x1, 0x7]}) 01:06:50 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5]}) 01:06:50 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40]}) 01:06:50 executing program 4: socketpair(0x2c, 0x0, 0xbc, &(0x7f0000000100)) [ 1409.357762][T14844] binder: 14842:14844 unknown command 28 [ 1409.391864][T14844] binder: 14842:14844 ioctl c0306201 20000100 returned -22 01:06:50 executing program 2: socketpair(0x22, 0x0, 0x1dd, &(0x7f0000000100)) 01:06:50 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8, 0x0, 0x2, 0x39, 0x6, 0x9, 0x1]}) 01:06:50 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1]}) 01:06:50 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x6000, 0x0}) 01:06:50 executing program 4: socketpair(0x2c, 0x0, 0xbd, &(0x7f0000000100)) 01:06:50 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7]}) 01:06:50 executing program 2: socketpair(0x22, 0x0, 0x1de, &(0x7f0000000100)) 01:06:50 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8, 0x0, 0x2, 0x39, 0x6, 0x9]}) [ 1409.641699][T14862] binder: 14858:14862 unknown command 28 [ 1409.671371][T14862] binder: 14858:14862 ioctl c0306201 20000100 returned -22 01:06:50 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5]}) 01:06:50 executing program 4: socketpair(0x2c, 0x0, 0xbe, &(0x7f0000000100)) 01:06:50 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8]}) 01:06:50 executing program 2: socketpair(0x22, 0x0, 0x1df, &(0x7f0000000100)) 01:06:50 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x6800, 0x0}) 01:06:50 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8, 0x0, 0x2, 0x39, 0x6]}) 01:06:51 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5]}) 01:06:51 executing program 4: socketpair(0x2c, 0x0, 0xbf, &(0x7f0000000100)) 01:06:51 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000]}) 01:06:51 executing program 2: socketpair(0x22, 0x0, 0x1e0, &(0x7f0000000100)) [ 1409.929344][T14880] binder: 14877:14880 unknown command 28 [ 1409.958367][T14880] binder: 14877:14880 ioctl c0306201 20000100 returned -22 01:06:51 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8, 0x0, 0x2, 0x39]}) 01:06:51 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175]}) 01:06:51 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x6c00, 0x0}) 01:06:51 executing program 2: socketpair(0x22, 0x0, 0x1e1, &(0x7f0000000100)) 01:06:51 executing program 4: socketpair(0x2c, 0x0, 0xc0, &(0x7f0000000100)) 01:06:51 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100]}) 01:06:51 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8, 0x0, 0x2]}) [ 1410.177376][T14892] binder: 14891:14892 unknown command 28 [ 1410.214274][T14892] binder: 14891:14892 ioctl c0306201 20000100 returned -22 01:06:51 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6]}) 01:06:51 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x7400, 0x0}) 01:06:51 executing program 4: socketpair(0x2c, 0x0, 0xc1, &(0x7f0000000100)) 01:06:51 executing program 2: socketpair(0x22, 0x0, 0x1e2, &(0x7f0000000100)) 01:06:51 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff]}) 01:06:51 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8]}) 01:06:51 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4]}) [ 1410.425089][T14908] binder: 14905:14908 unknown command 28 [ 1410.446507][T14908] binder: 14905:14908 ioctl c0306201 20000100 returned -22 01:06:51 executing program 4: socketpair(0x2c, 0x0, 0xc2, &(0x7f0000000100)) 01:06:51 executing program 2: socketpair(0x22, 0x0, 0x1e3, &(0x7f0000000100)) 01:06:51 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x7a00, 0x0}) 01:06:51 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681]}) 01:06:51 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5]}) 01:06:51 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4]}) 01:06:51 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1]}) [ 1410.672612][T14926] binder: 14923:14926 unknown command 28 [ 1410.692100][T14926] binder: 14923:14926 ioctl c0306201 20000100 returned -22 01:06:51 executing program 2: socketpair(0x22, 0x0, 0x1e4, &(0x7f0000000100)) 01:06:51 executing program 4: socketpair(0x2c, 0x0, 0xc3, &(0x7f0000000100)) 01:06:51 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40]}) 01:06:51 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0xff00, 0x0}) 01:06:51 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff]}) 01:06:52 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5]}) 01:06:52 executing program 2: socketpair(0x22, 0x0, 0x1e5, &(0x7f0000000100)) 01:06:52 executing program 4: socketpair(0x2c, 0x0, 0xc4, &(0x7f0000000100)) [ 1410.920510][T14940] binder: 14937:14940 unknown command 28 [ 1410.926425][T14940] binder: 14937:14940 ioctl c0306201 20000100 returned -22 01:06:52 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7]}) 01:06:52 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0xe0ffff, 0x0}) 01:06:52 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2]}) 01:06:52 executing program 2: socketpair(0x22, 0x0, 0x1e6, &(0x7f0000000100)) 01:06:52 executing program 4: socketpair(0x2c, 0x0, 0xc5, &(0x7f0000000100)) 01:06:52 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5]}) [ 1411.095778][T14951] binder: 14949:14951 unknown command 28 [ 1411.120465][T14951] binder: 14949:14951 ioctl c0306201 20000100 returned -22 01:06:52 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8]}) 01:06:52 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000]}) 01:06:52 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x1000000, 0x0}) 01:06:52 executing program 2: socketpair(0x22, 0x0, 0x1e7, &(0x7f0000000100)) 01:06:52 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175]}) 01:06:52 executing program 4: socketpair(0x2c, 0x0, 0xc6, &(0x7f0000000100)) 01:06:52 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000]}) [ 1411.333913][T14964] binder: 14962:14964 unknown command 28 [ 1411.352482][T14964] binder: 14962:14964 ioctl c0306201 20000100 returned -22 01:06:52 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6]}) 01:06:52 executing program 2: socketpair(0x22, 0x0, 0x1e8, &(0x7f0000000100)) 01:06:52 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x2000000, 0x0}) 01:06:52 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6]}) 01:06:52 executing program 4: socketpair(0x2c, 0x0, 0xc7, &(0x7f0000000100)) [ 1411.572179][T14980] binder: 14975:14980 unknown command 28 [ 1411.589444][T14980] binder: 14975:14980 ioctl c0306201 20000100 returned -22 01:06:52 executing program 2: socketpair(0x22, 0x0, 0x1e9, &(0x7f0000000100)) 01:06:52 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000]}) 01:06:52 executing program 4: socketpair(0x2c, 0x0, 0xc8, &(0x7f0000000100)) 01:06:52 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x3000000, 0x0}) 01:06:52 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6]}) 01:06:52 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4]}) 01:06:52 executing program 2: socketpair(0x22, 0x0, 0x1ea, &(0x7f0000000100)) 01:06:52 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100]}) 01:06:52 executing program 4: socketpair(0x2c, 0x0, 0xc9, &(0x7f0000000100)) [ 1411.794144][T14994] binder: 14991:14994 unknown command 28 [ 1411.819158][T14994] binder: 14991:14994 ioctl c0306201 20000100 returned -22 01:06:53 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000]}) 01:06:53 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4]}) 01:06:53 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x4000000, 0x0}) 01:06:53 executing program 2: socketpair(0x22, 0x0, 0x1eb, &(0x7f0000000100)) 01:06:53 executing program 4: socketpair(0x2c, 0x0, 0xca, &(0x7f0000000100)) 01:06:53 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff]}) 01:06:53 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff]}) 01:06:53 executing program 2: socketpair(0x22, 0x0, 0x1ec, &(0x7f0000000100)) 01:06:53 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31]}) [ 1412.082191][T15009] binder: 15006:15009 unknown command 28 [ 1412.106889][T15009] binder: 15006:15009 ioctl c0306201 20000100 returned -22 01:06:53 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x5000000, 0x0}) 01:06:53 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5]}) 01:06:53 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2]}) 01:06:53 executing program 4: socketpair(0x2c, 0x0, 0xcb, &(0x7f0000000100)) 01:06:53 executing program 2: socketpair(0x22, 0x0, 0x1ed, &(0x7f0000000100)) 01:06:53 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff]}) [ 1412.339887][T15025] binder: 15021:15025 unknown command 28 [ 1412.346109][T15025] binder: 15021:15025 ioctl c0306201 20000100 returned -22 01:06:53 executing program 4: socketpair(0x2c, 0x0, 0xcc, &(0x7f0000000100)) 01:06:53 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000]}) 01:06:53 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1]}) 01:06:53 executing program 2: socketpair(0x22, 0x0, 0x1ee, &(0x7f0000000100)) 01:06:53 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x6000000, 0x0}) 01:06:53 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2]}) 01:06:53 executing program 4: socketpair(0x2c, 0x0, 0xcd, &(0x7f0000000100)) 01:06:53 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5]}) 01:06:53 executing program 2: socketpair(0x22, 0x0, 0x1ef, &(0x7f0000000100)) 01:06:53 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6]}) [ 1412.586900][T15043] binder: 15039:15043 unknown command 28 [ 1412.620543][T15043] binder: 15039:15043 ioctl c0306201 20000100 returned -22 01:06:53 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800]}) 01:06:53 executing program 2: socketpair(0x22, 0x0, 0x1f0, &(0x7f0000000100)) 01:06:53 executing program 4: socketpair(0x2c, 0x0, 0xce, &(0x7f0000000100)) 01:06:53 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x7000000, 0x0}) 01:06:53 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6]}) 01:06:53 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5]}) [ 1412.841580][T15058] binder: 15054:15058 unknown command 28 01:06:54 executing program 4: socketpair(0x2c, 0x0, 0xcf, &(0x7f0000000100)) 01:06:54 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6]}) [ 1412.882923][T15058] binder: 15054:15058 ioctl c0306201 20000100 returned -22 01:06:54 executing program 2: socketpair(0x22, 0x0, 0x1f1, &(0x7f0000000100)) 01:06:54 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x8000000, 0x0}) 01:06:54 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000]}) 01:06:54 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7]}) 01:06:54 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175]}) 01:06:54 executing program 4: socketpair(0x2c, 0x0, 0xd0, &(0x7f0000000100)) 01:06:54 executing program 2: socketpair(0x22, 0x0, 0x1f2, &(0x7f0000000100)) [ 1413.099826][T15072] binder: 15071:15072 unknown command 28 [ 1413.123866][T15072] binder: 15071:15072 ioctl c0306201 20000100 returned -22 01:06:54 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x1f000000, 0x0}) 01:06:54 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800]}) 01:06:54 executing program 4: socketpair(0x2c, 0x0, 0xd1, &(0x7f0000000100)) 01:06:54 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31]}) 01:06:54 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6]}) 01:06:54 executing program 2: socketpair(0x22, 0x0, 0x1f3, &(0x7f0000000100)) [ 1413.329905][T15084] binder: 15083:15084 unknown command 28 [ 1413.335609][T15084] binder: 15083:15084 ioctl c0306201 20000100 returned -22 01:06:54 executing program 4: socketpair(0x2c, 0x0, 0xd2, &(0x7f0000000100)) 01:06:54 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff]}) 01:06:54 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x20000000, 0x0}) 01:06:54 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001]}) 01:06:54 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4]}) 01:06:54 executing program 2: socketpair(0x22, 0x0, 0x1f4, &(0x7f0000000100)) 01:06:54 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2]}) [ 1413.558544][T15100] binder: 15098:15100 unknown command 28 [ 1413.588887][T15100] binder: 15098:15100 ioctl c0306201 20000100 returned -22 01:06:54 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff]}) 01:06:54 executing program 4: socketpair(0x2c, 0x0, 0xd3, &(0x7f0000000100)) 01:06:54 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4]}) 01:06:54 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x48000000, 0x0}) 01:06:54 executing program 2: socketpair(0x22, 0x0, 0x1f5, &(0x7f0000000100)) 01:06:54 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800]}) 01:06:54 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff]}) [ 1413.788030][T15117] binder: 15111:15117 unknown command 28 [ 1413.810065][T15117] binder: 15111:15117 ioctl c0306201 20000100 returned -22 01:06:54 executing program 4: socketpair(0x2c, 0x0, 0xd4, &(0x7f0000000100)) 01:06:55 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc]}) 01:06:55 executing program 2: socketpair(0x22, 0x0, 0x1f6, &(0x7f0000000100)) 01:06:55 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x4c000000, 0x0}) 01:06:55 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6]}) 01:06:55 executing program 2: socketpair(0x22, 0x0, 0x1f7, &(0x7f0000000100)) 01:06:55 executing program 4: socketpair(0x2c, 0x0, 0xd5, &(0x7f0000000100)) 01:06:55 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2]}) 01:06:55 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8]}) [ 1414.024624][T15130] binder: 15129:15130 unknown command 28 [ 1414.035250][T15130] binder: 15129:15130 ioctl c0306201 20000100 returned -22 01:06:55 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x57150000, 0x0}) 01:06:55 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7]}) 01:06:55 executing program 2: socketpair(0x22, 0x0, 0x1f8, &(0x7f0000000100)) 01:06:55 executing program 4: socketpair(0x2c, 0x0, 0xd6, &(0x7f0000000100)) 01:06:55 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000]}) 01:06:55 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9]}) [ 1414.279384][T15143] binder: 15141:15143 unknown command 28 [ 1414.318180][T15143] binder: 15141:15143 ioctl c0306201 20000100 returned -22 01:06:55 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800]}) 01:06:55 executing program 2: socketpair(0x22, 0x0, 0x1f9, &(0x7f0000000100)) 01:06:55 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x58150000, 0x0}) 01:06:55 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6]}) 01:06:55 executing program 4: socketpair(0x2c, 0x0, 0xd7, &(0x7f0000000100)) 01:06:55 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2]}) 01:06:55 executing program 2: socketpair(0x22, 0x0, 0x1fa, &(0x7f0000000100)) 01:06:55 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001]}) [ 1414.522057][T15158] binder: 15156:15158 unknown command 28 [ 1414.540366][T15158] binder: 15156:15158 ioctl c0306201 20000100 returned -22 01:06:55 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x60000000, 0x0}) 01:06:55 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9]}) 01:06:55 executing program 4: socketpair(0x2c, 0x0, 0xd8, &(0x7f0000000100)) 01:06:55 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6]}) 01:06:55 executing program 2: socketpair(0x22, 0x0, 0x1fb, &(0x7f0000000100)) 01:06:55 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff]}) [ 1414.734749][T15171] binder: 15168:15171 unknown command 28 [ 1414.754838][T15171] binder: 15168:15171 ioctl c0306201 20000100 returned -22 01:06:55 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3]}) 01:06:55 executing program 4: socketpair(0x2c, 0x0, 0xd9, &(0x7f0000000100)) 01:06:56 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000]}) 01:06:56 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x68000000, 0x0}) 01:06:56 executing program 2: socketpair(0x22, 0x0, 0x1fc, &(0x7f0000000100)) 01:06:56 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc]}) 01:06:56 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2]}) 01:06:56 executing program 2: socketpair(0x22, 0x0, 0x1fd, &(0x7f0000000100)) 01:06:56 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31]}) 01:06:56 executing program 4: socketpair(0x2c, 0x0, 0xda, &(0x7f0000000100)) [ 1415.015252][T15190] binder: 15186:15190 unknown command 28 [ 1415.044362][T15190] binder: 15186:15190 ioctl c0306201 20000100 returned -22 01:06:56 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8]}) 01:06:56 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x6c000000, 0x0}) 01:06:56 executing program 4: socketpair(0x2c, 0x0, 0xdb, &(0x7f0000000100)) 01:06:56 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8]}) 01:06:56 executing program 2: socketpair(0x22, 0x0, 0x1fe, &(0x7f0000000100)) 01:06:56 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff]}) [ 1415.270513][T15204] binder: 15202:15204 unknown command 28 [ 1415.296725][T15204] binder: 15202:15204 ioctl c0306201 20000100 returned -22 01:06:56 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9]}) 01:06:56 executing program 4: socketpair(0x2c, 0x0, 0xdc, &(0x7f0000000100)) 01:06:56 executing program 2: socketpair(0x22, 0x0, 0x201, &(0x7f0000000100)) 01:06:56 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9]}) 01:06:56 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x74000000, 0x0}) 01:06:56 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2]}) 01:06:56 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2]}) 01:06:56 executing program 4: socketpair(0x2c, 0x0, 0xdd, &(0x7f0000000100)) 01:06:56 executing program 2: socketpair(0x22, 0x0, 0x300, &(0x7f0000000100)) 01:06:56 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7]}) [ 1415.566534][T15222] binder: 15219:15222 unknown command 28 [ 1415.590527][T15222] binder: 15219:15222 ioctl c0306201 20000100 returned -22 01:06:56 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9]}) 01:06:56 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x7a000000, 0x0}) 01:06:56 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800]}) 01:06:56 executing program 4: socketpair(0x2c, 0x0, 0xde, &(0x7f0000000100)) 01:06:56 executing program 2: socketpair(0x22, 0x0, 0x301, &(0x7f0000000100)) 01:06:56 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7]}) [ 1415.794855][T15235] binder: 15233:15235 unknown command 28 01:06:56 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6]}) [ 1415.839970][T15235] binder: 15233:15235 ioctl c0306201 20000100 returned -22 01:06:57 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3]}) 01:06:57 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0xff000000, 0x0}) 01:06:57 executing program 4: socketpair(0x2c, 0x0, 0xdf, &(0x7f0000000100)) 01:06:57 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7]}) 01:06:57 executing program 2: socketpair(0x22, 0x0, 0x500, &(0x7f0000000100)) 01:06:57 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8]}) 01:06:57 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2]}) [ 1416.052393][T15251] binder: 15249:15251 unknown command 28 [ 1416.077011][T15251] binder: 15249:15251 ioctl c0306201 20000100 returned -22 01:06:57 executing program 4: socketpair(0x2c, 0x0, 0xe0, &(0x7f0000000100)) 01:06:57 executing program 2: socketpair(0x22, 0x0, 0x501, &(0x7f0000000100)) 01:06:57 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800]}) 01:06:57 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0xffffe000, 0x0}) 01:06:57 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9]}) 01:06:57 executing program 4: socketpair(0x2c, 0x0, 0xe1, &(0x7f0000000100)) 01:06:57 executing program 2: socketpair(0x22, 0x0, 0x600, &(0x7f0000000100)) 01:06:57 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8]}) 01:06:57 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001]}) [ 1416.327372][T15269] binder: 15266:15269 unknown command 28 [ 1416.361395][T15269] binder: 15266:15269 ioctl c0306201 20000100 returned -22 01:06:57 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7]}) 01:06:57 executing program 2: socketpair(0x22, 0x0, 0x601, &(0x7f0000000100)) 01:06:57 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0xe0ffff00000000, 0x0}) 01:06:57 executing program 4: socketpair(0x2c, 0x0, 0xe2, &(0x7f0000000100)) 01:06:57 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9]}) 01:06:57 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff]}) 01:06:57 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613]}) [ 1416.580951][T15285] binder: 15281:15285 unknown command 28 [ 1416.608579][T15285] binder: 15281:15285 ioctl c0306201 20000100 returned -22 01:06:57 executing program 2: socketpair(0x22, 0x0, 0x700, &(0x7f0000000100)) 01:06:57 executing program 4: socketpair(0x2c, 0x0, 0xe3, &(0x7f0000000100)) 01:06:57 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7]}) 01:06:57 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x100000000000000, 0x0}) 01:06:57 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc]}) 01:06:57 executing program 2: socketpair(0x22, 0x0, 0x701, &(0x7f0000000100)) 01:06:57 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3]}) 01:06:58 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7]}) [ 1416.828043][T15299] binder: 15296:15299 unknown command 28 [ 1416.854537][T15299] binder: 15296:15299 ioctl c0306201 20000100 returned -22 01:06:58 executing program 4: socketpair(0x2c, 0x0, 0xe4, &(0x7f0000000100)) 01:06:58 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x200000000000000, 0x0}) 01:06:58 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8]}) 01:06:58 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8]}) 01:06:58 executing program 4: socketpair(0x2c, 0x0, 0xe5, &(0x7f0000000100)) 01:06:58 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8]}) 01:06:58 executing program 2: socketpair(0x22, 0x0, 0x801, &(0x7f0000000100)) [ 1417.062818][T15312] binder: 15311:15312 unknown command 28 [ 1417.075553][T15312] binder: 15311:15312 ioctl c0306201 20000100 returned -22 01:06:58 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9]}) 01:06:58 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x300000000000000, 0x0}) 01:06:58 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8]}) 01:06:58 executing program 2: socketpair(0x22, 0x0, 0x900, &(0x7f0000000100)) 01:06:58 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9]}) 01:06:58 executing program 4: socketpair(0x2c, 0x0, 0xe6, &(0x7f0000000100)) 01:06:58 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2]}) [ 1417.291637][T15326] binder: 15325:15326 unknown command 28 [ 1417.330601][T15326] binder: 15325:15326 ioctl c0306201 20000100 returned -22 01:06:58 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x400000000000000, 0x0}) 01:06:58 executing program 4: socketpair(0x2c, 0x0, 0xe7, &(0x7f0000000100)) 01:06:58 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4]}) 01:06:58 executing program 2: socketpair(0x22, 0x0, 0x901, &(0x7f0000000100)) 01:06:58 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7]}) 01:06:58 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9]}) [ 1417.523035][T15338] binder: 15337:15338 unknown command 28 [ 1417.535349][T15338] binder: 15337:15338 ioctl c0306201 20000100 returned -22 01:06:58 executing program 2: socketpair(0x22, 0x0, 0xa00, &(0x7f0000000100)) 01:06:58 executing program 4: socketpair(0x2c, 0x0, 0xe8, &(0x7f0000000100)) 01:06:58 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x500000000000000, 0x0}) 01:06:58 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff]}) 01:06:58 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3]}) 01:06:58 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613]}) [ 1417.721124][T15351] binder: 15350:15351 unknown command 28 [ 1417.749037][T15351] binder: 15350:15351 ioctl c0306201 20000100 returned -22 01:06:58 executing program 2: socketpair(0x22, 0x0, 0xa01, &(0x7f0000000100)) 01:06:58 executing program 4: socketpair(0x2c, 0x0, 0xe9, &(0x7f0000000100)) 01:06:59 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200]}) 01:06:59 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2]}) 01:06:59 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x600000000000000, 0x0}) 01:06:59 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3]}) 01:06:59 executing program 4: socketpair(0x2c, 0x0, 0xea, &(0x7f0000000100)) 01:06:59 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8]}) 01:06:59 executing program 2: socketpair(0x22, 0x0, 0xb00, &(0x7f0000000100)) 01:06:59 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94]}) [ 1418.013316][T15371] binder: 15368:15371 unknown command 28 [ 1418.043660][T15371] binder: 15368:15371 ioctl c0306201 20000100 returned -22 01:06:59 executing program 4: socketpair(0x2c, 0x0, 0xeb, &(0x7f0000000100)) 01:06:59 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8]}) 01:06:59 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x700000000000000, 0x0}) 01:06:59 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9]}) 01:06:59 executing program 2: socketpair(0x22, 0x0, 0xb01, &(0x7f0000000100)) 01:06:59 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8]}) 01:06:59 executing program 4: socketpair(0x2c, 0x0, 0xec, &(0x7f0000000100)) 01:06:59 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8]}) [ 1418.289410][T15388] binder: 15384:15388 unknown command 28 [ 1418.317556][T15388] binder: 15384:15388 ioctl c0306201 20000100 returned -22 01:06:59 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7]}) 01:06:59 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x800000000000000, 0x0}) 01:06:59 executing program 2: socketpair(0x22, 0x0, 0xc00, &(0x7f0000000100)) 01:06:59 executing program 4: socketpair(0x2c, 0x0, 0xed, &(0x7f0000000100)) [ 1418.487189][T15400] binder: 15398:15400 unknown command 28 [ 1418.497220][T15400] binder: 15398:15400 ioctl c0306201 20000100 returned -22 01:06:59 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4]}) 01:06:59 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40]}) 01:06:59 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7]}) 01:06:59 executing program 4: socketpair(0x2c, 0x0, 0xee, &(0x7f0000000100)) 01:06:59 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x1f00000000000000, 0x0}) 01:06:59 executing program 2: socketpair(0x22, 0x0, 0xc01, &(0x7f0000000100)) 01:06:59 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff]}) [ 1418.666914][T15411] binder: 15409:15411 unknown command 28 [ 1418.694901][T15411] binder: 15409:15411 ioctl c0306201 20000100 returned -22 01:06:59 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff]}) 01:06:59 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8]}) 01:06:59 executing program 4: socketpair(0x2c, 0x0, 0xef, &(0x7f0000000100)) 01:06:59 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x2000000000000000, 0x0}) 01:06:59 executing program 2: socketpair(0x22, 0x0, 0xd00, &(0x7f0000000100)) 01:07:00 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1]}) 01:07:00 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200]}) 01:07:00 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9]}) 01:07:00 executing program 4: socketpair(0x2c, 0x0, 0xf0, &(0x7f0000000100)) [ 1418.947475][T15427] binder: 15424:15427 unknown command 28 [ 1418.967090][T15427] binder: 15424:15427 ioctl c0306201 20000100 returned -22 01:07:00 executing program 2: socketpair(0x22, 0x0, 0xd01, &(0x7f0000000100)) 01:07:00 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x4800000000000000, 0x0}) 01:07:00 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1]}) 01:07:00 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94]}) 01:07:00 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7]}) 01:07:00 executing program 4: socketpair(0x2c, 0x0, 0xf1, &(0x7f0000000100)) 01:07:00 executing program 2: socketpair(0x22, 0x0, 0xe00, &(0x7f0000000100)) [ 1419.196120][T15441] binder: 15439:15441 unknown command 28 [ 1419.215967][T15441] binder: 15439:15441 ioctl c0306201 20000100 returned -22 01:07:00 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9]}) 01:07:00 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613]}) 01:07:00 executing program 4: socketpair(0x2c, 0x0, 0xf2, &(0x7f0000000100)) 01:07:00 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x4c00000000000000, 0x0}) 01:07:00 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8]}) 01:07:00 executing program 2: socketpair(0x22, 0x0, 0xe01, &(0x7f0000000100)) 01:07:00 executing program 4: socketpair(0x2c, 0x0, 0xf3, &(0x7f0000000100)) 01:07:00 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40]}) 01:07:00 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3]}) [ 1419.486266][T15460] binder: 15456:15460 unknown command 28 [ 1419.506891][T15460] binder: 15456:15460 ioctl c0306201 20000100 returned -22 01:07:00 executing program 2: socketpair(0x22, 0x0, 0xf00, &(0x7f0000000100)) 01:07:00 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4]}) 01:07:00 executing program 4: socketpair(0x2c, 0x0, 0xf4, &(0x7f0000000100)) 01:07:00 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x5715000000000000, 0x0}) 01:07:00 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff]}) 01:07:00 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80]}) 01:07:00 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8]}) 01:07:00 executing program 2: socketpair(0x22, 0x0, 0xf01, &(0x7f0000000100)) [ 1419.783041][T15476] binder: 15474:15476 unknown command 28 [ 1419.795639][T15476] binder: 15474:15476 ioctl c0306201 20000100 returned -22 01:07:00 executing program 4: socketpair(0x2c, 0x0, 0xf5, &(0x7f0000000100)) 01:07:01 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1]}) 01:07:01 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x5815000000000000, 0x0}) 01:07:01 executing program 2: socketpair(0x22, 0x0, 0x1001, &(0x7f0000000100)) 01:07:01 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8]}) 01:07:01 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f]}) 01:07:01 executing program 4: socketpair(0x2c, 0x0, 0xf6, &(0x7f0000000100)) [ 1420.015392][T15492] binder: 15488:15492 unknown command 28 01:07:01 executing program 2: socketpair(0x22, 0x0, 0x1100, &(0x7f0000000100)) [ 1420.057074][T15492] binder: 15488:15492 ioctl c0306201 20000100 returned -22 01:07:01 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4]}) 01:07:01 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1]}) 01:07:01 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8]}) 01:07:01 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x6000000000000000, 0x0}) 01:07:01 executing program 4: socketpair(0x2c, 0x0, 0xf7, &(0x7f0000000100)) 01:07:01 executing program 2: socketpair(0x22, 0x0, 0x1101, &(0x7f0000000100)) 01:07:01 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff]}) 01:07:01 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9]}) 01:07:01 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2]}) [ 1420.290998][T15508] binder: 15506:15508 unknown command 28 [ 1420.311270][T15508] binder: 15506:15508 ioctl c0306201 20000100 returned -22 01:07:01 executing program 4: socketpair(0x2c, 0x0, 0xf8, &(0x7f0000000100)) 01:07:01 executing program 2: socketpair(0x22, 0x0, 0x1200, &(0x7f0000000100)) 01:07:01 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x6800000000000000, 0x0}) 01:07:01 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200]}) 01:07:01 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4]}) 01:07:01 executing program 2: socketpair(0x22, 0x0, 0x1201, &(0x7f0000000100)) 01:07:01 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3]}) 01:07:01 executing program 4: socketpair(0x2c, 0x0, 0xf9, &(0x7f0000000100)) [ 1420.542059][T15524] binder: 15522:15524 unknown command 28 [ 1420.562018][T15524] binder: 15522:15524 ioctl c0306201 20000100 returned -22 01:07:01 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x6c00000000000000, 0x0}) 01:07:01 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94]}) 01:07:01 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80]}) 01:07:01 executing program 2: socketpair(0x22, 0x0, 0x1300, &(0x7f0000000100)) 01:07:01 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2]}) 01:07:01 executing program 4: socketpair(0x2c, 0x0, 0xfa, &(0x7f0000000100)) [ 1420.779108][T15536] binder: 15535:15536 unknown command 28 [ 1420.785019][T15536] binder: 15535:15536 ioctl c0306201 20000100 returned -22 01:07:02 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1]}) 01:07:02 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f]}) 01:07:02 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8]}) 01:07:02 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x7400000000000000, 0x0}) 01:07:02 executing program 2: socketpair(0x22, 0x0, 0x1301, &(0x7f0000000100)) 01:07:02 executing program 4: socketpair(0x2c, 0x0, 0xfb, &(0x7f0000000100)) [ 1421.033474][T15552] binder: 15548:15552 unknown command 28 [ 1421.067671][T15552] binder: 15548:15552 ioctl c0306201 20000100 returned -22 01:07:02 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8]}) 01:07:02 executing program 2: socketpair(0x22, 0x0, 0x1400, &(0x7f0000000100)) 01:07:02 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40]}) 01:07:02 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9]}) 01:07:02 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x7a00000000000000, 0x0}) 01:07:02 executing program 4: socketpair(0x2c, 0x0, 0xfc, &(0x7f0000000100)) 01:07:02 executing program 2: socketpair(0x22, 0x0, 0x1401, &(0x7f0000000100)) 01:07:02 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff]}) 01:07:02 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76]}) 01:07:02 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2]}) [ 1421.271841][T15568] binder: 15565:15568 unknown command 28 [ 1421.303377][T15568] binder: 15565:15568 ioctl c0306201 20000100 returned -22 01:07:02 executing program 4: socketpair(0x2c, 0x0, 0xfd, &(0x7f0000000100)) 01:07:02 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0xff00000000000000, 0x0}) 01:07:02 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1]}) 01:07:02 executing program 2: socketpair(0x22, 0x0, 0x1500, &(0x7f0000000100)) 01:07:02 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff]}) 01:07:02 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3]}) [ 1421.528301][T15582] binder: 15580:15582 unknown command 28 [ 1421.535736][T15582] binder: 15580:15582 ioctl c0306201 20000100 returned -22 01:07:02 executing program 4: socketpair(0x2c, 0x0, 0xfe, &(0x7f0000000100)) 01:07:02 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000040)=[@release={0x40046306, 0x10001}], 0x62, 0x0, &(0x7f0000000080)="0da79a1c820da78ab2cb49aad0da7c3fc563ad4f9cfc53a7c94dbfb66c5fd8d87e3c5fbcf2e22704350270024c5ef33a0d2356532e81001eb4f8246202e3016a789c80ff037df9a30ca11614dc89fe7711b3ca1d872b43bc763aca847891c336a069"}) 01:07:02 executing program 2: socketpair(0x22, 0x0, 0x1501, &(0x7f0000000100)) 01:07:02 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1]}) 01:07:02 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8]}) 01:07:02 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2]}) [ 1421.742982][T15594] binder: 15593:15594 unknown command 28 [ 1421.760189][T15594] binder: 15593:15594 ioctl c0306201 20000100 returned -22 01:07:02 executing program 4: socketpair(0x2c, 0x0, 0x102, &(0x7f0000000100)) 01:07:02 executing program 2: socketpair(0x22, 0x0, 0x1600, &(0x7f0000000100)) [ 1421.795629][T15594] binder: 15593:15594 unknown command 28 [ 1421.825444][T15594] binder: 15593:15594 ioctl c0306201 20000100 returned -22 01:07:03 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9]}) 01:07:03 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5]}) 01:07:03 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1]}) 01:07:03 executing program 4: socketpair(0x2c, 0x0, 0x103, &(0x7f0000000100)) 01:07:03 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x0, 0x0}) mmap$binder(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x7e1) 01:07:03 executing program 2: socketpair(0x22, 0x0, 0x1601, &(0x7f0000000100)) 01:07:03 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4]}) 01:07:03 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9]}) 01:07:03 executing program 4: socketpair(0x2c, 0x0, 0x104, &(0x7f0000000100)) [ 1422.125177][T15619] binder: 15614:15619 unknown command 28 [ 1422.148108][T15619] binder: 15614:15619 ioctl c0306201 20000100 returned -22 01:07:03 executing program 2: socketpair(0x22, 0x0, 0x1700, &(0x7f0000000100)) 01:07:03 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80]}) 01:07:03 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9]}) [ 1422.186748][T15619] binder: 15614:15619 unknown command 28 [ 1422.207637][T15619] binder: 15614:15619 ioctl c0306201 20000100 returned -22 01:07:03 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6]}) 01:07:03 executing program 4: socketpair(0x2c, 0x0, 0x105, &(0x7f0000000100)) 01:07:03 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="e91cd5026203576bb3c862a659339fd50b9baaffca91fd26fa82f38aece03486c432a60f960e3b8099765ca6e30580d29d35fe3ca0e021ee5036cb4f87250a6cd64a52e5684a092f15792f9d4eb445bc1b8496d7790e7fc3c5da2c7cb16d56001bbfcb62276549dd59a2005477a1a667d571305493e43a4e79bf6980381ba9821b55ec813cfbf923f890b73e42f3db04d3987769fefe26f86a6997ece555c60926d96fc25045048b7b243ba838e70dbcdd08d2d1f4e477ad3f09d7ad3fe18c2a557095bc8b2a796911d6bfa488a2f778a02f3f78fc72220f60556526cd994fad1ec0f67b481da443ede3017654e7934cf741e1e16034a13aa368f98a2e70913aab11f68a5e8c54f8454289397d2521f7f8a89efb8c0387af15690000"], 0x0, 0x0, 0x0}) r1 = syz_open_procfs(0x0, &(0x7f0000000040)='net/ipx\x00') r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000140)='/dev/zero\x00', 0x101a00, 0x0) read$rfkill(r3, &(0x7f0000000180), 0x8) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r2, 0x8000000) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f00000000c0)={0x2000, &(0x7f0000000080), 0x4, r2, 0x1}) 01:07:03 executing program 2: socketpair(0x22, 0x0, 0x1701, &(0x7f0000000100)) 01:07:03 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f]}) 01:07:03 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff]}) 01:07:03 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76]}) 01:07:03 executing program 4: socketpair(0x2c, 0x0, 0x106, &(0x7f0000000100)) [ 1422.484914][T15640] binder: 15636:15640 unknown command 47521001 [ 1422.506691][T15640] binder: 15636:15640 ioctl c0306201 20000100 returned -22 01:07:03 executing program 2: socketpair(0x22, 0x0, 0x1800, &(0x7f0000000100)) 01:07:03 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8]}) [ 1422.546363][T15640] binder: 15636:15640 unknown command 47521001 [ 1422.583198][T15640] binder: 15636:15640 ioctl c0306201 20000100 returned -22 01:07:03 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff]}) 01:07:03 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4]}) 01:07:03 executing program 4: socketpair(0x2c, 0x0, 0x107, &(0x7f0000000100)) 01:07:03 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="2324a0ec2b14cdc63f5560364f7c096ccd0fd1e58a3ac86f1b409471570553cba032e4b25cbdfdcb8f1a9cd22b8ee6319296f395ae8392400a9ee492eb4db25c957aec15176a0632731740ee9f20e1730cb9e6ac098c90b6d21b3cb81072bce94363e603f33fee21f5e838a0458b2c71f262f33066f5502d657d19afb5f1e2771b9b279bd8f1912bd2d0ef37f23e"], 0x0, 0x0, 0x0}) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r1, 0x8000000) ioctl$KVM_HYPERV_EVENTFD(r1, 0x4018aebd, &(0x7f0000000140)={0x1, 0xffffffffffffffff, 0x1}) 01:07:03 executing program 2: socketpair(0x22, 0x0, 0x1801, &(0x7f0000000100)) 01:07:03 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2]}) 01:07:03 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1]}) [ 1422.780062][ T3235] ieee802154 phy0 wpan0: encryption failed: -22 [ 1422.786538][ T3235] ieee802154 phy1 wpan1: encryption failed: -22 [ 1422.815062][T15662] binder: 15660:15662 unknown command -325049309 01:07:03 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8]}) [ 1422.847636][T15662] binder: 15660:15662 ioctl c0306201 20000100 returned -22 [ 1422.884289][T15662] binder: 15660:15662 unknown command -325049309 01:07:04 executing program 4: socketpair(0x2c, 0x0, 0x108, &(0x7f0000000100)) 01:07:04 executing program 2: socketpair(0x22, 0x0, 0x1900, &(0x7f0000000100)) [ 1422.906969][T15662] binder: 15660:15662 ioctl c0306201 20000100 returned -22 01:07:04 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3]}) 01:07:04 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x800) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="1cf85b4ab1b8ba11fba2b6076960712a03e0459c9a07a4127b99e80cfba5dc852679c97c1cc236bbff6384c1413fe3abd54e1f54c0dade4149963ea8e4edbc118adc6e4c06d820e55823abdee9e5f8fdd2d062be367a66fbf1cb39cd04770ec4b100ba37fefef90d5a488b78d34d845058f9a2fa8c7231c6507b1850c84f08d602c72b9122863d6c000000000000"], 0x0, 0x0, 0x0}) socket$xdp(0x2c, 0x3, 0x0) 01:07:04 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5]}) 01:07:04 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2]}) 01:07:04 executing program 4: socketpair(0x2c, 0x0, 0x109, &(0x7f0000000100)) 01:07:04 executing program 2: socketpair(0x22, 0x0, 0x1901, &(0x7f0000000100)) [ 1423.118240][T15681] binder: 15677:15681 unknown command 1247541276 [ 1423.151584][T15681] binder: 15677:15681 ioctl c0306201 20000140 returned -22 01:07:04 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2]}) 01:07:04 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100]}) 01:07:04 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9]}) [ 1423.192923][T15685] binder: 15677:15685 unknown command 1247541276 [ 1423.221686][T15685] binder: 15677:15685 ioctl c0306201 20000140 returned -22 01:07:04 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="1c33f1e8de65f9c8cffaa43d53ca3a1bd58f7675095fc2411117fa7b797b6489f537a0af287c2b2702c4834b633a54452e0bc250b73102978b08ae0024bac40d5a47d492cf6c023f3525f46a11b8d65181b655904bf16de2b91f88c2902acc16a93b4c7fb0bfaf35a45290b4dc34744578847e26345487ba6f3ec26e95077095ba4d345a42646c120f3f2b3a147cc3595ee5ffabb22ece2ce309d76d6b71af38d39a8d"], 0x0, 0x0, 0x0}) 01:07:04 executing program 4: socketpair(0x2c, 0x0, 0x10a, &(0x7f0000000100)) 01:07:04 executing program 2: socketpair(0x22, 0x0, 0x1a00, &(0x7f0000000100)) 01:07:04 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1]}) 01:07:04 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352]}) 01:07:04 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6]}) 01:07:04 executing program 4: socketpair(0x2c, 0x0, 0x10b, &(0x7f0000000100)) [ 1423.414061][T15698] binder: 15696:15698 unknown command -386845924 [ 1423.448134][T15698] binder: 15696:15698 ioctl c0306201 20000100 returned -22 01:07:04 executing program 2: socketpair(0x22, 0x0, 0x1a01, &(0x7f0000000100)) 01:07:04 executing program 1: ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f0000000040)={0x0, 0x1, 0xffffffffffffffff, 0x6}) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="ee000000cd7543c63c"], 0x0, 0x0, 0x0}) 01:07:04 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9]}) 01:07:04 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8]}) 01:07:04 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff]}) 01:07:04 executing program 4: socketpair(0x2c, 0x0, 0x10c, &(0x7f0000000100)) 01:07:04 executing program 2: socketpair(0x22, 0x0, 0x1b00, &(0x7f0000000100)) [ 1423.687907][T15715] binder: 15711:15715 unknown command 238 [ 1423.716976][T15715] binder: 15711:15715 ioctl c0306201 20000100 returned -22 01:07:04 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76]}) 01:07:04 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7]}) [ 1423.768587][T15721] binder: 15711:15721 unknown command 238 [ 1423.791999][T15721] binder: 15711:15721 ioctl c0306201 20000100 returned -22 01:07:04 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4]}) 01:07:05 executing program 4: socketpair(0x2c, 0x0, 0x10d, &(0x7f0000000100)) 01:07:05 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x0, 0x0}) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r1, 0x8000000) ioctl$IOCTL_VMCI_SET_NOTIFY(r1, 0x7cb, &(0x7f0000000040)={0x10001, 0x2, 0x716}) 01:07:05 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff]}) 01:07:05 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd]}) 01:07:05 executing program 2: socketpair(0x22, 0x0, 0x1b01, &(0x7f0000000100)) 01:07:05 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1]}) 01:07:05 executing program 4: socketpair(0x2c, 0x0, 0x10e, &(0x7f0000000100)) [ 1424.034802][T15740] binder: 15734:15740 unknown command 28 [ 1424.060538][T15740] binder: 15734:15740 ioctl c0306201 20000100 returned -22 01:07:05 executing program 2: socketpair(0x22, 0x0, 0x1c00, &(0x7f0000000100)) 01:07:05 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8]}) 01:07:05 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7]}) [ 1424.103553][T15740] binder: 15734:15740 unknown command 28 [ 1424.125998][T15740] binder: 15734:15740 ioctl c0306201 20000100 returned -22 01:07:05 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2]}) 01:07:05 executing program 2: socketpair(0x22, 0x0, 0x1c01, &(0x7f0000000100)) 01:07:05 executing program 4: socketpair(0x2c, 0x0, 0x10f, &(0x7f0000000100)) 01:07:05 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x2) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x0, 0x0}) 01:07:05 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9]}) 01:07:05 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5]}) 01:07:05 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100]}) 01:07:05 executing program 2: socketpair(0x22, 0x0, 0x1d00, &(0x7f0000000100)) 01:07:05 executing program 4: socketpair(0x2c, 0x0, 0x110, &(0x7f0000000100)) [ 1424.421039][T15763] binder: 15759:15763 unknown command 28 [ 1424.448142][T15763] binder: 15759:15763 ioctl c0306201 20000100 returned -22 01:07:05 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022]}) 01:07:05 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9]}) 01:07:05 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000040)) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r1, 0x8000000) mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1, 0x11, r1, 0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB='7'], 0x0, 0x0, 0x0}) 01:07:05 executing program 2: socketpair(0x22, 0x0, 0x1d01, &(0x7f0000000100)) 01:07:05 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352]}) 01:07:05 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7]}) 01:07:05 executing program 4: socketpair(0x2c, 0x0, 0x111, &(0x7f0000000100)) 01:07:05 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6]}) [ 1424.714069][T15778] binder: 15775:15778 unknown command 55 [ 1424.722588][T15778] binder: 15775:15778 ioctl c0306201 20000100 returned -22 01:07:05 executing program 2: socketpair(0x22, 0x0, 0x1e00, &(0x7f0000000100)) 01:07:05 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8]}) 01:07:05 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3]}) 01:07:05 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x802) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x0, 0x0}) sendmsg$AUDIT_USER(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f00000000c0)={&(0x7f00000001c0)={0x9c, 0x3ed, 0x200, 0x70bd25, 0x25dfdbfe, "257fcde10f64be5b52ee010ac7634d48574e1a47e072c1f5e8595db7c5149a876585c6364c48d4987b26a4076064e9efabfdbd8a76ab959b081a5669fcfd6dcff7db011404c0f5b2e7fea27f247723cfd045c0c7da7a371beff5e29e7ee53cb24d019bbe7c65a24c8798fb0805c4fd611a7df1b11207003f2232588ad3ebd79600e55622fc319c5b9d94d8a2", [""]}, 0x9c}, 0x1, 0x0, 0x0, 0x20000810}, 0x24000001) 01:07:05 executing program 4: socketpair(0x2c, 0x0, 0x112, &(0x7f0000000100)) 01:07:06 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff]}) [ 1424.926480][T15795] binder: 15789:15795 unknown command 28 [ 1424.932888][T15795] binder: 15789:15795 ioctl c0306201 20000100 returned -22 [ 1424.961259][T15798] binder: 15789:15798 unknown command 28 01:07:06 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6]}) [ 1424.975399][T15798] binder: 15789:15798 ioctl c0306201 20000100 returned -22 01:07:06 executing program 2: socketpair(0x22, 0x0, 0x1e01, &(0x7f0000000100)) 01:07:06 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7]}) 01:07:06 executing program 4: socketpair(0x2c, 0x0, 0x113, &(0x7f0000000100)) 01:07:06 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = socket$xdp(0x2c, 0x3, 0x0) write$rfkill(0xffffffffffffffff, &(0x7f00000000c0)={0x1, 0xb, 0x3, 0x0, 0xfd}, 0x8) setsockopt$XDP_RX_RING(r1, 0x11b, 0x2, &(0x7f0000001e40)=0x100080, 0x4) write$rfkill(0xffffffffffffffff, &(0x7f0000000140)={0x1, 0x8, 0x2, 0x1}, 0x8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000040)=ANY=[@ANYRESOCT=r1], 0x0, 0x0, 0x0}) 01:07:06 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4]}) 01:07:06 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd]}) 01:07:06 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40]}) 01:07:06 executing program 2: socketpair(0x22, 0x0, 0x1f00, &(0x7f0000000100)) 01:07:06 executing program 4: socketpair(0x2c, 0x0, 0x114, &(0x7f0000000100)) [ 1425.223059][T15811] binder: 15809:15811 unknown command 808464432 01:07:06 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1]}) [ 1425.267870][T15811] binder: 15809:15811 ioctl c0306201 20000100 returned -22 01:07:06 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x0, 0x0}) 01:07:06 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7]}) 01:07:06 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5]}) 01:07:06 executing program 2: socketpair(0x22, 0x0, 0x1f01, &(0x7f0000000100)) 01:07:06 executing program 4: socketpair(0x2c, 0x0, 0x115, &(0x7f0000000100)) 01:07:06 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2]}) 01:07:06 executing program 2: socketpair(0x22, 0x0, 0x2000, &(0x7f0000000100)) [ 1425.514727][T15829] binder: 15825:15829 unknown command 28 [ 1425.547857][T15829] binder: 15825:15829 ioctl c0306201 20000100 returned -22 01:07:06 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff]}) 01:07:06 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9]}) 01:07:06 executing program 4: socketpair(0x2c, 0x0, 0x116, &(0x7f0000000100)) 01:07:06 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_RX_RING(r1, 0x11b, 0x2, &(0x7f0000001e40)=0x100080, 0x4) r2 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_RX_RING(r2, 0x11b, 0x2, &(0x7f0000001e40)=0x100080, 0x4) r3 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_RX_RING(r3, 0x11b, 0x2, &(0x7f0000001e40)=0x100080, 0x4) r4 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_RX_RING(r4, 0x11b, 0x2, &(0x7f0000001e40)=0x100080, 0x4) r5 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_RX_RING(r5, 0x11b, 0x2, &(0x7f0000001e40)=0x100080, 0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="adab188c6f7f70e0ded9b3bc6471321f0afcf881136f2a0876dff138f28b55dab377", @ANYRES32=r2, @ANYRES32, @ANYRESDEC=r1, @ANYRES64=r3, @ANYRES16, @ANYRESDEC=r4, @ANYRESDEC=r3, @ANYRESDEC=r5, @ANYBLOB="326f5091fe6821b42184249a85417ea132335ba2b93de7175dd59bdecaae38dcf511100a01795f37af0590559d56df445ec82a36a46bace7d29ddc985ed9da6924594b32010e6677a13fe7ff7f201c4c71d5f77b50f26482eba446c0a99f8dc3d3f78efd311ba1645f3f1a3ad17b2d241e8eced870ff688a2d7c3ff8b1dcbbc2765fab10"], 0x0, 0x0, 0x0}) getsockopt$XDP_STATISTICS(r1, 0x11b, 0x7, &(0x7f0000000040), &(0x7f0000000140)=0x30) seccomp$SECCOMP_SET_MODE_FILTER(0x1, 0x2, &(0x7f00000000c0)={0x4, &(0x7f0000000080)=[{0x5, 0x5d, 0xd4, 0xfff}, {0x2, 0xfc, 0x2, 0x3}, {0x6, 0xff, 0x1, 0x8}, {0xdc65, 0x1, 0x40, 0x81}]}) 01:07:06 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100]}) 01:07:06 executing program 2: socketpair(0x22, 0x0, 0x2001, &(0x7f0000000100)) 01:07:06 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff]}) 01:07:06 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022]}) [ 1425.777248][T15846] binder: 15844:15846 unknown command -1944540243 [ 1425.796292][T15846] binder: 15844:15846 ioctl c0306201 20000100 returned -22 01:07:06 executing program 4: socketpair(0x2c, 0x0, 0x117, &(0x7f0000000100)) 01:07:07 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352]}) 01:07:07 executing program 2: socketpair(0x22, 0x0, 0x2100, &(0x7f0000000100)) [ 1425.851574][T15850] binder: 15844:15850 unknown command -1944540243 [ 1425.875967][T15850] binder: 15844:15850 ioctl c0306201 20000100 returned -22 01:07:07 executing program 4: socketpair(0x2c, 0x0, 0x118, &(0x7f0000000100)) 01:07:07 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff]}) 01:07:07 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x0, 0x0}) r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/net/ipv4/vs/conntrack\x00', 0x2, 0x0) sendmsg$SMC_PNETID_DEL(r1, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f00000000c0)={&(0x7f00000001c0)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00022abd7000ffdbdf25030000000900030073797a32000000000900010073797a31000000001400020077673000"/58], 0x4c}, 0x1, 0x0, 0x0, 0x20000000}, 0x4000000) 01:07:07 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7]}) 01:07:07 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8]}) 01:07:07 executing program 2: socketpair(0x22, 0x0, 0x2101, &(0x7f0000000100)) 01:07:07 executing program 4: socketpair(0x2c, 0x0, 0x119, &(0x7f0000000100)) [ 1426.139795][T15868] binder: 15864:15868 unknown command 28 [ 1426.145492][T15868] binder: 15864:15868 ioctl c0306201 20000100 returned -22 01:07:07 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6]}) 01:07:07 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3]}) 01:07:07 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7]}) 01:07:07 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1d"], 0x0, 0x0, 0x0}) 01:07:07 executing program 2: socketpair(0x22, 0x0, 0x2200, &(0x7f0000000100)) 01:07:07 executing program 4: socketpair(0x2c, 0x0, 0x11a, &(0x7f0000000100)) 01:07:07 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff]}) 01:07:07 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6]}) 01:07:07 executing program 2: socketpair(0x22, 0x0, 0x2201, &(0x7f0000000100)) 01:07:07 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd]}) [ 1426.430969][T15885] binder: 15882:15885 unknown command 29 [ 1426.446050][T15885] binder: 15882:15885 ioctl c0306201 20000100 returned -22 01:07:07 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x0, 0x0}) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000040)='/dev/zero\x00', 0x80400, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x1c, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="096310400200000000000000000000000000000007e7dffc4e000000"], 0xa7, 0x0, &(0x7f00000001c0)="6c52cd2cc85f967dcdcd9cbe3259add5a0c5f1865d5a5dd37e35a2f75a1d7759af685ba7f565ad1bee0903aeb2ab372c1e0847dedef0099cd5e66038a1c41f2058fb97820eeab8fa9495f98e7677ae42657fc98f65b90932e464d146f0f234be16012d0a1c1fa230d6fd124c33bfef7b002198d943a090dfc2d4a41c10fa1fe84b36dac8422eb24543914ada27052dc896f4676d1b34503f4f2130ca47e5ed474e40cae18c9315"}) r2 = syz_open_procfs(0x0, &(0x7f00000002c0)='fdinfo\x00') ioctl$vim2m_VIDIOC_DQBUF(r2, 0xc0585611, &(0x7f0000000340)={0x81, 0x3, 0x4, 0xe000, 0x1, {}, {0x4, 0x8, 0x1, 0x9, 0x7, 0x9, "4caecdf0"}, 0x80, 0x2, @planes=&(0x7f0000000300)={0x7, 0x80000000, @mem_offset=0x1, 0x10001}, 0x50, 0x0, r1}) r3 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ubi_ctrl\x00', 0x80, 0x0) ioctl$IOCTL_VMCI_GET_CONTEXT_ID(r3, 0x7b3, &(0x7f0000000280)) 01:07:07 executing program 4: socketpair(0x2c, 0x0, 0x11b, &(0x7f0000000100)) 01:07:07 executing program 2: socketpair(0x22, 0x0, 0x2300, &(0x7f0000000100)) 01:07:07 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8]}) 01:07:07 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40]}) 01:07:07 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7]}) [ 1426.629704][T15898] binder: 15897:15898 unknown command 28 [ 1426.659085][T15898] binder: 15897:15898 ioctl c0306201 20000100 returned -22 [ 1426.700536][T15898] binder: 15897:15898 unknown command 28 [ 1426.727800][T15898] binder: 15897:15898 ioctl c0306201 20000100 returned -22 01:07:07 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1]}) 01:07:07 executing program 4: socketpair(0x2c, 0x0, 0x11c, &(0x7f0000000100)) 01:07:07 executing program 2: socketpair(0x22, 0x0, 0x2301, &(0x7f0000000100)) 01:07:07 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5]}) 01:07:08 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x2) r1 = socket$xdp(0x2c, 0x3, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f00000002c0)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000280)={0xffffffffffffffff}, 0x111, 0x3}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(0xffffffffffffffff, &(0x7f0000000300)={0x10, 0x30, 0xfa00, {&(0x7f0000000240), 0x4, {0xa, 0x4e23, 0x40, @empty, 0x4}, r2}}, 0x38) setsockopt$XDP_RX_RING(r1, 0x11b, 0x2, &(0x7f0000001e40)=0x100080, 0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x59, 0x0, &(0x7f0000000080)=ANY=[@ANYRES32=r1], 0x0, 0x0, 0x0}) sendmsg$xdp(r1, &(0x7f0000000200)={&(0x7f0000000000)={0x2c, 0x2, 0x0, 0x27}, 0x10, &(0x7f00000000c0)=[{&(0x7f0000000140)="8d22fd81a6a0e7ac81e24165bac6d8e258f988143af36fd6920b80f0d42e0ad6e1fccb471d8ff5a065f395da2d04f3525edb1aa278268549d775f12192ef87c71c902c49c1776c43fecd9ade5d5904a94177193e1b1ae64a3bd6ec767e40d333b82a5c621f7e494094c342dfb69fbe6a175f650b16631516b17a58bd7a990ef972dc08164ead3aa6647aa8fa4e7e1c391ad4330b57c541a784", 0x99}], 0x1, 0x0, 0x0, 0x40000}, 0x4004050) 01:07:08 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7]}) 01:07:08 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7]}) 01:07:08 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff]}) 01:07:08 executing program 2: socketpair(0x22, 0x0, 0x2400, &(0x7f0000000100)) 01:07:08 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9]}) 01:07:08 executing program 4: socketpair(0x2c, 0x0, 0x11d, &(0x7f0000000100)) [ 1427.022301][T15923] binder: 15921:15923 unknown command 4 [ 1427.070160][T15923] binder: 15921:15923 ioctl c0306201 20000100 returned -22 01:07:08 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4]}) 01:07:08 executing program 2: socketpair(0x22, 0x0, 0x2401, &(0x7f0000000100)) 01:07:08 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x0, 0x0}) r1 = socket$inet6_udp(0xa, 0x2, 0x0) getpeername(r1, &(0x7f0000000380)=@vsock={0x28, 0x0, 0x0, @local}, &(0x7f0000000400)=0x80) 01:07:08 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff]}) 01:07:08 executing program 4: socketpair(0x2c, 0x0, 0x11e, &(0x7f0000000100)) 01:07:08 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000]}) 01:07:08 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022]}) 01:07:08 executing program 4: socketpair(0x2c, 0x0, 0x11f, &(0x7f0000000100)) [ 1427.336102][T15946] binder: 15941:15946 unknown command 28 [ 1427.356951][T15946] binder: 15941:15946 ioctl c0306201 20000100 returned -22 01:07:08 executing program 2: socketpair(0x22, 0x0, 0x2500, &(0x7f0000000100)) 01:07:08 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6]}) 01:07:08 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000]}) [ 1427.402127][T15946] binder: 15941:15946 unknown command 28 [ 1427.440576][T15946] binder: 15941:15946 ioctl c0306201 20000100 returned -22 01:07:08 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7]}) 01:07:08 executing program 2: socketpair(0x22, 0x0, 0x2501, &(0x7f0000000100)) 01:07:08 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000080)='/dev/zero\x00', 0x50000, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(0xffffffffffffffff, &(0x7f0000000040)={0x5, 0x10, 0xfa00, {&(0x7f00000001c0)}}, 0x18) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x0, 0x0}) 01:07:08 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8]}) 01:07:08 executing program 4: socketpair(0x2c, 0x0, 0x120, &(0x7f0000000100)) 01:07:08 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff]}) 01:07:08 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3]}) 01:07:08 executing program 2: socketpair(0x22, 0x0, 0x2600, &(0x7f0000000100)) [ 1427.661208][T15966] binder: 15961:15966 unknown command 28 [ 1427.675335][T15966] binder: 15961:15966 ioctl c0306201 20000100 returned -22 01:07:08 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5]}) 01:07:08 executing program 1: r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/dlm-control\x00', 0x80, 0x0) r1 = eventfd2(0x278, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000300)={0x58, 0x0, &(0x7f0000000240)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x8, 0x0, 0x3}, @fda={0x66646185, 0x8, 0x1, 0xf}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000140)={0x0, 0x20, 0x40}}, 0x40}, @exit_looper, @release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000002c0)}) ioctl$KVM_IOEVENTFD(0xffffffffffffffff, 0x4040ae79, &(0x7f0000000080)={0x2, &(0x7f0000000040), 0x4}) r2 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x0, 0x0}) mmap$binder(&(0x7f0000ff5000/0x9000)=nil, 0x9000, 0x1, 0x11, r2, 0x6) 01:07:08 executing program 4: socketpair(0x2c, 0x0, 0x121, &(0x7f0000000100)) 01:07:08 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8]}) 01:07:09 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6]}) 01:07:09 executing program 2: socketpair(0x22, 0x0, 0x2601, &(0x7f0000000100)) 01:07:09 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff]}) 01:07:09 executing program 4: socketpair(0x2c, 0x0, 0x122, &(0x7f0000000100)) [ 1427.912727][T15980] binder: 15976:15980 unknown command 28 [ 1427.933921][T15980] binder: 15976:15980 ioctl c0306201 20000100 returned -22 01:07:09 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40]}) [ 1427.993802][T15980] binder: 15976:15980 unknown command 28 [ 1428.018054][T15980] binder: 15976:15980 ioctl c0306201 20000100 returned -22 01:07:09 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1]}) 01:07:09 executing program 2: socketpair(0x22, 0x0, 0x2700, &(0x7f0000000100)) 01:07:09 executing program 4: socketpair(0x2c, 0x0, 0x123, &(0x7f0000000100)) 01:07:09 executing program 1: ioctl$UFFDIO_COPY(0xffffffffffffffff, 0xc028aa03, &(0x7f0000000040)={&(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ffb000/0x2000)=nil, 0x3000}) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x0, 0x0}) 01:07:09 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d]}) 01:07:09 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7]}) 01:07:09 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5]}) 01:07:09 executing program 2: socketpair(0x22, 0x0, 0x2701, &(0x7f0000000100)) [ 1428.243862][T16003] binder: 15998:16003 unknown command 28 [ 1428.271585][T16003] binder: 15998:16003 ioctl c0306201 20000100 returned -22 01:07:09 executing program 4: socketpair(0x2c, 0x0, 0x124, &(0x7f0000000100)) 01:07:09 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4]}) [ 1428.310274][T16007] binder: 15998:16007 unknown command 28 [ 1428.336056][T16007] binder: 15998:16007 ioctl c0306201 20000100 returned -22 01:07:09 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4]}) 01:07:09 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff]}) 01:07:09 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="42d66a6e8a09576b2be0efdb930c5a69287b3fdc3f69f66d6c8a0ec5cd9d441c00000000000000"], 0x0, 0x0, 0x0}) 01:07:09 executing program 2: socketpair(0x22, 0x0, 0x2800, &(0x7f0000000100)) 01:07:09 executing program 4: socketpair(0x2c, 0x0, 0x125, &(0x7f0000000100)) 01:07:09 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000]}) 01:07:09 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff]}) 01:07:09 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000]}) [ 1428.567824][T16023] binder: 16017:16023 unknown command 1852495426 [ 1428.591166][T16023] binder: 16017:16023 ioctl c0306201 20000100 returned -22 01:07:09 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1]}) 01:07:09 executing program 4: socketpair(0x2c, 0x0, 0x126, &(0x7f0000000100)) 01:07:09 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x0, 0x0}) getitimer(0x1, &(0x7f0000000040)) 01:07:09 executing program 2: socketpair(0x22, 0x0, 0x2801, &(0x7f0000000100)) 01:07:09 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000]}) 01:07:09 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69]}) 01:07:09 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6]}) [ 1428.817824][T16039] binder: 16037:16039 unknown command 28 [ 1428.846808][T16039] binder: 16037:16039 ioctl c0306201 20000100 returned -22 01:07:10 executing program 4: socketpair(0x2c, 0x0, 0x127, &(0x7f0000000100)) 01:07:10 executing program 2: socketpair(0x22, 0x0, 0x2900, &(0x7f0000000100)) [ 1428.864437][T16039] binder: 16037:16039 unknown command 28 [ 1428.887468][T16039] binder: 16037:16039 ioctl c0306201 20000100 returned -22 01:07:10 executing program 1: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r0, 0x8000000) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r1, 0x8000000) ioctl$UFFDIO_ZEROPAGE(r1, 0xc020aa04, &(0x7f0000000380)={{&(0x7f0000ffd000/0x2000)=nil, 0x2000}, 0x1}) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r2, 0x8000000) getsockname$packet(r0, &(0x7f0000000500)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000000540)=0x14) write$RDMA_USER_CM_CMD_SET_OPTION(r2, &(0x7f00000004c0)={0xe, 0x18, 0xfa00, @id_afonly={&(0x7f0000000480), 0xffffffffffffffff, 0x0, 0x2, 0x4}}, 0x20) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r3, 0x8000000) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(r1, 0x7, &(0x7f0000000300)=r3, 0x1) r4 = syz_open_procfs(0x0, &(0x7f0000000140)='personality\x00') ioctl$KVM_HYPERV_EVENTFD(r0, 0x4018aebd, &(0x7f00000002c0)={0x4, r4, 0x1}) io_uring_register$IORING_REGISTER_EVENTFD(r1, 0x4, &(0x7f0000000340)=r0, 0x1) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sched_rr_get_interval(0x0, &(0x7f0000000080)) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000000c0)={0x30, 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="04630440020000000c630000060000f8c700000008631040030000000000000000000000000000000563044000000000dc492db302405b59969af0b3c57a7802b8056bb3413cae29c82a081a3c77a0bc95bab0dfb27fee95264e15448f579d96120f82eb2a2b5f728099d70d42237099b26df8b7651c907833234645b24dbea7b1"], 0xd9, 0x0, &(0x7f00000001c0)="a18f459dafe5f49ea61b525f2adce0e58b897d7a5ee191ae0e0620076af39512e6e3222a9c452c39fb14411ba1a3923f38663828fd3a7dfda9f91551f03baca661b39f797975a890d2d9e9312a93a085b9df0d67afffa40dc544e06318cff47abd52d65584daf73068e84aeb63a8e197f9b2bdfe7eb97dda6f52c25cf26fe4af0f904e432ecde77e963539d7a98e9d88c11d284d07b2476019552faef36128fcc82c19f67cf4869090bc20bb533bd360cc3a53a493abfb4276b0c02ac40e3aa61721af9e3e91c04a2696595be70f0f5a080f9aad6c73815325"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="1432fa030acaeca430bdf8ca97fad14eded0f9f48f0be10f6e2d06ab42c78275146218ed67103374c194c3ad60fbe9da26a7c1cbb7cdcca8ea20bdcc501a44809d82db9527e2d4df96464420190a0b5714e98d6a8fc72e8258972e44881ec1f3a1ca7f606b2e7c7a2e6f1c544fd5441f4cffdc384412b1d8773a0d75d517c476830139e98909eb71d92168f4c1a0f75085538e61991b1a03d6e6f6ca2f82662dfeb28ba0d6915e29ea3940f92d"], 0x0, 0x0, 0x0}) 01:07:10 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff]}) 01:07:10 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8]}) 01:07:10 executing program 4: socketpair(0x2c, 0x0, 0x128, &(0x7f0000000100)) 01:07:10 executing program 2: socketpair(0x22, 0x0, 0x2901, &(0x7f0000000100)) 01:07:10 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4]}) 01:07:10 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5]}) 01:07:10 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8]}) 01:07:10 executing program 4: socketpair(0x2c, 0x0, 0x129, &(0x7f0000000100)) 01:07:10 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x3) write$eventfd(0xffffffffffffffff, &(0x7f0000000000), 0x8) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r1, 0x8000000) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000014c0)={0xd0, 0x0, &(0x7f00000003c0)=[@transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000240)={@ptr={0x70742a85, 0x1, &(0x7f0000000080)=""/65, 0x41, 0x0, 0x10}, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/193, 0xc1, 0x0, 0x13}}, &(0x7f00000002c0)={0x0, 0x28, 0x40}}}, @register_looper, @increfs_done={0x40106308, 0x1}, @request_death={0x400c630e, 0x3}, @release={0x40046306, 0x1}, @request_death={0x400c630e, 0x1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000001500)=ANY=[@ANYBLOB="852a64660000003609a2c57214", @ANYRES32=r0, @ANYBLOB="00000000000000000000000085616466000000000a0000000000000001000000000000000a000000000000008561646600000000080000000000000002000000000000003200000000000000"], &(0x7f0000000380)={0x0, 0x18, 0x38}}, 0x400}], 0x1000, 0x0, &(0x7f00000004c0)="a0d0c07b72d62fcd7c73ac7c7561f13812cd6c2fc9c8af4b18f1bdff07ecb769653454d8ce4cee009490b0d9c7fc86cb3cd767393c3eccc1970e81d398b1d18f72f729955155b4fe9dfb4f33b4cfd1eb954bbdbfba813b20438233de0b22aced01fc7d71f1a70f8d31ff95eec5b03e4e195c04b7335c7481a89b082b5e6c546b236debeb21f0aaedc1ed544d4fa5d5d143a1ae8ee50f7249274c3467b44d7ccb69a352be2ee5d176406a03f0e5dc0d98836eb8cd49a09f9cc5d8c6f88c4a4edfd881dd2a4fca2bf6cbeb8d86c0d01660f5be268d7d3ad4630c1a53968cfcbf7a4aa395207a546fde75f208697e98130d5aef1e84035913e088410276a92072602d60096e02102b127ed27adf829f6d21c648affd0255b5f3b697a1648754c538ba086153539f74ff90131c53e8a51461820e16b8903bdfd322baa0c02ca33385242c5f8ec8ba6e157236f844be7597166fd3961345cde0487bda8fded92fd1e16e699785105d0cd041c9a9d502a819280895acc3a7141bf5187e5e3ae1be242d07167d6add781758ab9eab799f4ff3337e45f8c332a3be2e21d4f77929a85bc7af8256e68d3ad8c7b77d1abad5338e9ba8bc8d2b70de318dd46b579cebb0a24c78fb1e4d248b62f21be3922bafa14918552347ae7f59dfa935928fb3d8c01e42dedf786bcccd6095ac3bf2332deb7485f61c04422ceb5bca6c1e839146eab64f4dab6f5fa496acbd5dfffe3e29c6bac3def68e81afa7f45d307f962896ad2fe102fa54801b6ceaf63c744e425cc573903a7a0cdb1e04c89c68be89cddbd6951e5ade69ce5d9a02b34815dbe8973ef86a13ec052f21e1bd9dccb5b2bbb2cc2738e62f4f09e9749a5dbb28570540ca68e3aeda98604ec0a925c2ffc8b0c1ba117e5c5d6e7b0f9614af86c8572536688a61046f4fbaa8a939af672d72442a70de662ba7db4a18e6a25b2a7007ab48fa93f1136d411067c85b1c4aeb5c26dc82209098252d7fd3806b638c6a5a1d4c2affbba97db252a9980d0b8e230ff197030d6d85410f689e2947a19789e0de58ae9261e48c6d5d7a3f1687e2e1a3a781a9b7de2948db3327fe629c34700e696e54823abd0679b9ff4433729524f78b8977a59344bc21dd4cda9ec049be0657f8ac0e249f2988d1bbefd0f6108f0bda3e1c3fbd34d09b87308de23e8e70270765efe3f00d78626c28717b8af44a8b8509099e25cb1d5a083f4cf43b704794345a20edee80952d525e9f6751f45d8ddf59050322ec102eecffc3bf3a39df53b156d61b948c7316feb7ef6a366a268983c96aedaf8e64fe177416bface65f7231bac1864e3ac1bb2017f92f1e36ba4fe1db1adb025aaaf3526e74999de5f3c05ecef5aa292545e9d493ef7583e1eaa43bdb715806d126e78fcac1f1b8aa3a9cae408b368bb27e04410c5c5868758f020a86b47642e43a72fa985306cd04fc9b78da10455f9ab7744c11588b37088c0cfa1a10a1fb36dc539e4462374e552850a62cd28ffbb78c6aa0372c84d353d871de1816eeec031794549e1b857c3203c338c6b3a135d93912c7738b584e5c12026ef11c3f309c7dd70702d52ed88af289b54cc3cd7d1c599e09b034aa24bb076f2ae18901f0e9d41648be4895a4c542a0e9a4cc953d9df8ec4cf0c85f28f8c2ac2f88ebf47572f5427399b9a2b24b460f20c1c1d5019b94931ff931b48b62981b24fee1f96d7e8acaa494b256eb468ebf8fab43fd8addf30b421318995c9daea48218df74078693c0f96ba79ffb4b3810dba366d25d7520e08f39047158e61c7fc71f1ff261338ec91d28afb882d97d3a4b041aa689af264bdac3f36f50b8612278fafba0de85c73648cc7cbc17a162a9582519cb4a78e82efd36516dc5726519e7aa3a40153dc6f509ca7ece1c5c33b6ca8caa78d27870750f93b5a2675dd5aa45e27d92cb7eb56c39c5d5288dbe6b7b70c27457fd371536d74b3647c4fd817e122df15712393d36ebe44ef4f4e3c15f67d7f0ada11a71a6d1378f3fa634d11dde05e38aca0d38801cdad306ed9920c9121e6bdc01eed5626ae4144497fcd7cb182a60e6a01ef59dd36ced6d25d2f6cc7545ebcf7a03abdc2944fc034b48d36d1995af66ea9a0be00a05d352d23bf060fb583474017a9c9277e8d5de0922d4bcda46911560c2743855a6f8b057b8584e3989a66d2d23eeaee01757cdef3d295e1665e01c0034a379ba4e5d91544479bff06ea524c6236e9cc93741ff9d02469e84ca7e209d716078f8bf280a17ff0f145973e1c5f3934207016623e743ab5f3e3d7e03ed5d0deb6b0d629a82a763f94e855627dc2c82f2017e92500c3019cb65968163708dd98ab37a3983859dec4d28abe5bced0e9ea4de6e18692248cc549f777ec6dcb1b9afc644edbd0b71a9f80ae392a719640320fff3a8332163009b8ebb2e5e9c787ec5dd653f13edce89868d17dcf7dd03fabdff4d081712282d4221aefe46dcb94f19f39b71d9a0c98ee8bd11e62aed03e28758d1d365fb4b94e71fe8e74ca9e6f7bc0f2b318b87294f31f57e9b1c92b0f5569331875b8413efd37d4c1b8314ebb7ed9343936d42147efcb80a59636bf9f43fe58cd3e7b92e03e9fbd8d0e2adaa59e4670771d63d4bd5132242eb9cdb96bd51efb1fc3080f0347ed633796542f8815c6030b11fa6c0c1e5aa4357248c9d8359c52f01d1eb3b0886714980f70562f4b83bcdfa4e68ae92c3248bb04caee8750788eacca748f8020535d2e525d22bd593aea9ede6857e7b831e2c22f79954222ebe5af98f246947543eec61247297196f59c5c8d0c1e0ce7c0c512f855bd38db59c289b86d7eb500798ba093309174030a8e49cfd0bf6ea8ca9f89eace8f62af5eb2b2ab180d59babc7c3f570f4fb3b63a332a4d953946b5ef93e53c34e98bc5927f440762284011a491fde82bdb0a6922a001ff4805709bc48c238eafd17979317d73f97b88be7eb164ebac04d0604d549eb5f26baf51e63e4540c44e42746eb5c50dd4fdf602092ed69d300fd9d0af6a796aaad88384982b85fdae69266e7303d77877e0ee3ea1ffc10237325c140fc14138d92262fb5c877e0eea5bd29d09081720ffaeb6bf43148ee09d1e91f48ee004812d6be4807165fa8b3aa19656ddd9514ccd42931ddbac09d300f54a6408d3c20f47c37886295da94143d51f58a1aedeb16d500daab34128db59f13345e412fd6ac2123c33979b37e77f742a8bb1f9fc14dbe45d84a8a0328be7b5ea1a6f139d8e836232acda58f5a6b0ed5f81b3b564c66c63c532ffa19289cf03bcc5d99be66072d45ac0a8e322516bb85b76da6e03217321dad992a6b470814a34c318a2e88b1e0614674a5fdfc78a7c3308d5da61c515b714fdc3e4bcca0b62bdbe456178edb64792e921510898565b1f2f49e272ef12fc0770cc6ced3e2eed249547a73d1e4c9928de0a32a55748e6c1a002689e7fb47c02a19b1a047c39b4f160d3898f3494d46c17f1673338ae467a77138a0fc7893c7f2c7dd4ad80df6a39ac2cd0d46337295eb1788fd18c2bcacd80005bd3df2dfb83f0ed4de5a8b19a045adc5e7e83a7e83939ecfbfc3da6388883ce62bfc7df41926c96e4b98a44922173c69c88ca7d23dc05b69b6262058d080cf644b33680d9f6a7f0b92f07fdea6ee6774011f1d27a70bd03c4c49aef8c3c881fac259eddf1996b4a3483c5920d2c6e8168a7c2f2328073a43230af4f00bce421db6593931b5fdf23c68f26c6da2ff94318f4bf6a4efddadd67d9f8fef4ee7340b4a5704fee97a49dc34ee0b431658851e9e47227187ca34548806bee00569dd6b52b2699d557a79f6f1e415c29471ef4a12e80db53cdf8dfe05ac8ba7c396026988754228ad66536c7f46338882729e18ce4aaa01cc10757f3d24bfa05c8aca004594c542557f0b1398208be87dedd514194acf190f6d0786b4cdff484270d62f38f6e326ea77c5e6bec894c482d1763c2e3ed33c3c203c2916ff42bdaf90f5d17e9461d1041a7b1c07e63575fe100e0b853fafa095010059a0a62ed0d33008556017f41e02523fe2c901e9c12d210ab1d06e7a11a3520f6721bf349cc88ee588d7d73b74fb72923d6ce2855292b1bf7bf69e8f5c5b82a28196d4014165be3bea7ef51133f81fd8c7ff1a8fcabcac81f27252854aabf4087c024baa91fb83fe6550b679401f20f59f9c911b622d37f40bf30393cae4c92076f26a8cd9f322ce966763437e05191ed9caa663b782a8ed19f764dabb573f7b64f505ace57b7610c646bf7a6a79d8d74352201291e9b0053dd1295e57cf362235690caff8027e145efb14929043291ea8cd77694f5f50a86e22814329e7698e381948adfc6cf4091639a7d19b2e04fe860224f6e657725e0218b106f6bc1ba27834c9a3e24dff16cb49771f67dfa4d6dfb42bc0ce1580f5f03d9a9577b2a022fea6a464714a690835ae4d6393376cc05bffc60957b405f8ad147eaa783557dc48648d3a55d261160baf5eac2ec7db8e357215b2a730cd333c099b1cb83ec85b2410ae1252933da6434c60319ee05f9751b95b6c7d57e39a88e17fd9a148596418aa908227306f54aa642d3448c7d70588695fd72fd887535ee15d08335cb2ef9b785995b19eb7b33770fc63c436a11cb0520148c23d0095af0d69310134ad2d5f4a100018fbc71b57f03bc7b3d2482c131a7fce446af2c8264708cace6fd0272354591e2ce561b931e465a9f18f3bd50e7f4dd1306e0a0cd861e3a99daba4833babc1c453702272a397ddf45c76c72e3b98c0b221cf23132f1618902ed5e72a8aacb474033eebb02de720c17fef7786e0c73a68e743c1a637738189a0b47496d75a4283b9e8a9d676417550ae93b074e32f99023965e06d9b4a5fff4130c7342edca0e585d739229353feb91e0b7dab2525f96f40749def76b2c771d4f0f0c7b911edf8350b3c6b71601df3d514da97d1fa2fe214d8f0eb4a49f38a90cb6a589b5d6ba13ded1471d154f2900152347aefb50724515d20aa268af5460eb83f1d1efbfd9243463c65e56586aa5122294dc9f065722e4fefd20f5a8305ac7cf2bf1f7da658c26639882f8a8b87cfe78da9f2c9b710a1d4d37bb196bf2100310a9fcb132c334ca77fd05397db4d227582e7d65cbe53ae03766044cdf635c39298fd974848b8b49fe3810f44a8a9d457f38ff8011603d353e75ad3ae2b4aa8e87dafa0297436d4db4dd8dfdf441cb8a4b2fb98fb5128da2b46acef28486c0cc93628a8add37b50387bacb6136ac7dee606a6e8599d6efb06cd29602ee9756bbf2e7c51c98a6bbaa97cd39ec4155ba941b14bc77f1b45ac3a04ea80f00a95292cf023fb5e3584b575effb9aa9f522516b59a0cab10f12d10b20507b6d71abcfcaae588a9dc85ab88f0364f786bb94276e4f91d779677aea27e0c447653f28f2aa8742f75a728ca39da499373d8fcccd83827b287e55d53149ba98698c93bee382d729224c5f69af58880aebadf98358a24dbbf2cd5cee704d3c2eddbcc9dd82cfa2e231e65cd64f751fcd517f94aa070cbfac1716178c23a7680ac8180f7619a47f16e4512042e9350d193e38581cd9e4be8b2fedfba5a5dee8253ac288e2c85d27eea65ac0a499fd9ee944cc1ca5e2d4f771c1695ff54b734cabc2cfa4999cc61191539dcea0ade6b6fb1081ef6965e2450f438c3172ae7b50b4461f4eb50f1dd788a60902d42d56107b2cf640b828d9a0d45395606eea96e38a46f9a8375319a0877c6b9794ea0a2eb4a3792690b74c75d37d840d08ce557f"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[], 0x0, 0x0, 0x0}) 01:07:10 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7]}) 01:07:10 executing program 2: socketpair(0x22, 0x0, 0x2a00, &(0x7f0000000100)) 01:07:10 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff]}) 01:07:10 executing program 2: socketpair(0x22, 0x0, 0x2a01, &(0x7f0000000100)) [ 1429.379753][T16071] binder: 16069:16071 unknown command 0 [ 1429.390525][T16071] binder: 16069:16071 ioctl c0306201 20000100 returned -22 01:07:10 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1]}) 01:07:10 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}}) [ 1429.441045][T16076] binder: 16069:16076 unknown command 0 [ 1429.458805][T16076] binder: 16069:16076 ioctl c0306201 20000100 returned -22 01:07:10 executing program 4: socketpair(0x2c, 0x0, 0x12a, &(0x7f0000000100)) 01:07:10 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d]}) 01:07:10 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) getrandom(&(0x7f0000000040)=""/136, 0x88, 0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)=ANY=[@ANYRESDEC=r0], 0x0, 0x0, 0x0}) 01:07:10 executing program 2: socketpair(0x22, 0x0, 0x2b00, &(0x7f0000000100)) 01:07:10 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7]}) 01:07:10 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x3) write$eventfd(0xffffffffffffffff, &(0x7f0000000000), 0x8) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r1, 0x8000000) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000014c0)={0xd0, 0x0, &(0x7f00000003c0)=[@transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000240)={@ptr={0x70742a85, 0x1, &(0x7f0000000080)=""/65, 0x41, 0x0, 0x10}, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/193, 0xc1, 0x0, 0x13}}, &(0x7f00000002c0)={0x0, 0x28, 0x40}}}, @register_looper, @increfs_done={0x40106308, 0x1}, @request_death={0x400c630e, 0x3}, @release={0x40046306, 0x1}, @request_death={0x400c630e, 0x1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000001500)=ANY=[@ANYBLOB="852a64660000003609a2c57214", @ANYRES32=r0, @ANYBLOB="00000000000000000000000085616466000000000a0000000000000001000000000000000a000000000000008561646600000000080000000000000002000000000000003200000000000000"], &(0x7f0000000380)={0x0, 0x18, 0x38}}, 0x400}], 0x1000, 0x0, &(0x7f00000004c0)="a0d0c07b72d62fcd7c73ac7c7561f13812cd6c2fc9c8af4b18f1bdff07ecb769653454d8ce4cee009490b0d9c7fc86cb3cd767393c3eccc1970e81d398b1d18f72f729955155b4fe9dfb4f33b4cfd1eb954bbdbfba813b20438233de0b22aced01fc7d71f1a70f8d31ff95eec5b03e4e195c04b7335c7481a89b082b5e6c546b236debeb21f0aaedc1ed544d4fa5d5d143a1ae8ee50f7249274c3467b44d7ccb69a352be2ee5d176406a03f0e5dc0d98836eb8cd49a09f9cc5d8c6f88c4a4edfd881dd2a4fca2bf6cbeb8d86c0d01660f5be268d7d3ad4630c1a53968cfcbf7a4aa395207a546fde75f208697e98130d5aef1e84035913e088410276a92072602d60096e02102b127ed27adf829f6d21c648affd0255b5f3b697a1648754c538ba086153539f74ff90131c53e8a51461820e16b8903bdfd322baa0c02ca33385242c5f8ec8ba6e157236f844be7597166fd3961345cde0487bda8fded92fd1e16e699785105d0cd041c9a9d502a819280895acc3a7141bf5187e5e3ae1be242d07167d6add781758ab9eab799f4ff3337e45f8c332a3be2e21d4f77929a85bc7af8256e68d3ad8c7b77d1abad5338e9ba8bc8d2b70de318dd46b579cebb0a24c78fb1e4d248b62f21be3922bafa14918552347ae7f59dfa935928fb3d8c01e42dedf786bcccd6095ac3bf2332deb7485f61c04422ceb5bca6c1e839146eab64f4dab6f5fa496acbd5dfffe3e29c6bac3def68e81afa7f45d307f962896ad2fe102fa54801b6ceaf63c744e425cc573903a7a0cdb1e04c89c68be89cddbd6951e5ade69ce5d9a02b34815dbe8973ef86a13ec052f21e1bd9dccb5b2bbb2cc2738e62f4f09e9749a5dbb28570540ca68e3aeda98604ec0a925c2ffc8b0c1ba117e5c5d6e7b0f9614af86c8572536688a61046f4fbaa8a939af672d72442a70de662ba7db4a18e6a25b2a7007ab48fa93f1136d411067c85b1c4aeb5c26dc82209098252d7fd3806b638c6a5a1d4c2affbba97db252a9980d0b8e230ff197030d6d85410f689e2947a19789e0de58ae9261e48c6d5d7a3f1687e2e1a3a781a9b7de2948db3327fe629c34700e696e54823abd0679b9ff4433729524f78b8977a59344bc21dd4cda9ec049be0657f8ac0e249f2988d1bbefd0f6108f0bda3e1c3fbd34d09b87308de23e8e70270765efe3f00d78626c28717b8af44a8b8509099e25cb1d5a083f4cf43b704794345a20edee80952d525e9f6751f45d8ddf59050322ec102eecffc3bf3a39df53b156d61b948c7316feb7ef6a366a268983c96aedaf8e64fe177416bface65f7231bac1864e3ac1bb2017f92f1e36ba4fe1db1adb025aaaf3526e74999de5f3c05ecef5aa292545e9d493ef7583e1eaa43bdb715806d126e78fcac1f1b8aa3a9cae408b368bb27e04410c5c5868758f020a86b47642e43a72fa985306cd04fc9b78da10455f9ab7744c11588b37088c0cfa1a10a1fb36dc539e4462374e552850a62cd28ffbb78c6aa0372c84d353d871de1816eeec031794549e1b857c3203c338c6b3a135d93912c7738b584e5c12026ef11c3f309c7dd70702d52ed88af289b54cc3cd7d1c599e09b034aa24bb076f2ae18901f0e9d41648be4895a4c542a0e9a4cc953d9df8ec4cf0c85f28f8c2ac2f88ebf47572f5427399b9a2b24b460f20c1c1d5019b94931ff931b48b62981b24fee1f96d7e8acaa494b256eb468ebf8fab43fd8addf30b421318995c9daea48218df74078693c0f96ba79ffb4b3810dba366d25d7520e08f39047158e61c7fc71f1ff261338ec91d28afb882d97d3a4b041aa689af264bdac3f36f50b8612278fafba0de85c73648cc7cbc17a162a9582519cb4a78e82efd36516dc5726519e7aa3a40153dc6f509ca7ece1c5c33b6ca8caa78d27870750f93b5a2675dd5aa45e27d92cb7eb56c39c5d5288dbe6b7b70c27457fd371536d74b3647c4fd817e122df15712393d36ebe44ef4f4e3c15f67d7f0ada11a71a6d1378f3fa634d11dde05e38aca0d38801cdad306ed9920c9121e6bdc01eed5626ae4144497fcd7cb182a60e6a01ef59dd36ced6d25d2f6cc7545ebcf7a03abdc2944fc034b48d36d1995af66ea9a0be00a05d352d23bf060fb583474017a9c9277e8d5de0922d4bcda46911560c2743855a6f8b057b8584e3989a66d2d23eeaee01757cdef3d295e1665e01c0034a379ba4e5d91544479bff06ea524c6236e9cc93741ff9d02469e84ca7e209d716078f8bf280a17ff0f145973e1c5f3934207016623e743ab5f3e3d7e03ed5d0deb6b0d629a82a763f94e855627dc2c82f2017e92500c3019cb65968163708dd98ab37a3983859dec4d28abe5bced0e9ea4de6e18692248cc549f777ec6dcb1b9afc644edbd0b71a9f80ae392a719640320fff3a8332163009b8ebb2e5e9c787ec5dd653f13edce89868d17dcf7dd03fabdff4d081712282d4221aefe46dcb94f19f39b71d9a0c98ee8bd11e62aed03e28758d1d365fb4b94e71fe8e74ca9e6f7bc0f2b318b87294f31f57e9b1c92b0f5569331875b8413efd37d4c1b8314ebb7ed9343936d42147efcb80a59636bf9f43fe58cd3e7b92e03e9fbd8d0e2adaa59e4670771d63d4bd5132242eb9cdb96bd51efb1fc3080f0347ed633796542f8815c6030b11fa6c0c1e5aa4357248c9d8359c52f01d1eb3b0886714980f70562f4b83bcdfa4e68ae92c3248bb04caee8750788eacca748f8020535d2e525d22bd593aea9ede6857e7b831e2c22f79954222ebe5af98f246947543eec61247297196f59c5c8d0c1e0ce7c0c512f855bd38db59c289b86d7eb500798ba093309174030a8e49cfd0bf6ea8ca9f89eace8f62af5eb2b2ab180d59babc7c3f570f4fb3b63a332a4d953946b5ef93e53c34e98bc5927f440762284011a491fde82bdb0a6922a001ff4805709bc48c238eafd17979317d73f97b88be7eb164ebac04d0604d549eb5f26baf51e63e4540c44e42746eb5c50dd4fdf602092ed69d300fd9d0af6a796aaad88384982b85fdae69266e7303d77877e0ee3ea1ffc10237325c140fc14138d92262fb5c877e0eea5bd29d09081720ffaeb6bf43148ee09d1e91f48ee004812d6be4807165fa8b3aa19656ddd9514ccd42931ddbac09d300f54a6408d3c20f47c37886295da94143d51f58a1aedeb16d500daab34128db59f13345e412fd6ac2123c33979b37e77f742a8bb1f9fc14dbe45d84a8a0328be7b5ea1a6f139d8e836232acda58f5a6b0ed5f81b3b564c66c63c532ffa19289cf03bcc5d99be66072d45ac0a8e322516bb85b76da6e03217321dad992a6b470814a34c318a2e88b1e0614674a5fdfc78a7c3308d5da61c515b714fdc3e4bcca0b62bdbe456178edb64792e921510898565b1f2f49e272ef12fc0770cc6ced3e2eed249547a73d1e4c9928de0a32a55748e6c1a002689e7fb47c02a19b1a047c39b4f160d3898f3494d46c17f1673338ae467a77138a0fc7893c7f2c7dd4ad80df6a39ac2cd0d46337295eb1788fd18c2bcacd80005bd3df2dfb83f0ed4de5a8b19a045adc5e7e83a7e83939ecfbfc3da6388883ce62bfc7df41926c96e4b98a44922173c69c88ca7d23dc05b69b6262058d080cf644b33680d9f6a7f0b92f07fdea6ee6774011f1d27a70bd03c4c49aef8c3c881fac259eddf1996b4a3483c5920d2c6e8168a7c2f2328073a43230af4f00bce421db6593931b5fdf23c68f26c6da2ff94318f4bf6a4efddadd67d9f8fef4ee7340b4a5704fee97a49dc34ee0b431658851e9e47227187ca34548806bee00569dd6b52b2699d557a79f6f1e415c29471ef4a12e80db53cdf8dfe05ac8ba7c396026988754228ad66536c7f46338882729e18ce4aaa01cc10757f3d24bfa05c8aca004594c542557f0b1398208be87dedd514194acf190f6d0786b4cdff484270d62f38f6e326ea77c5e6bec894c482d1763c2e3ed33c3c203c2916ff42bdaf90f5d17e9461d1041a7b1c07e63575fe100e0b853fafa095010059a0a62ed0d33008556017f41e02523fe2c901e9c12d210ab1d06e7a11a3520f6721bf349cc88ee588d7d73b74fb72923d6ce2855292b1bf7bf69e8f5c5b82a28196d4014165be3bea7ef51133f81fd8c7ff1a8fcabcac81f27252854aabf4087c024baa91fb83fe6550b679401f20f59f9c911b622d37f40bf30393cae4c92076f26a8cd9f322ce966763437e05191ed9caa663b782a8ed19f764dabb573f7b64f505ace57b7610c646bf7a6a79d8d74352201291e9b0053dd1295e57cf362235690caff8027e145efb14929043291ea8cd77694f5f50a86e22814329e7698e381948adfc6cf4091639a7d19b2e04fe860224f6e657725e0218b106f6bc1ba27834c9a3e24dff16cb49771f67dfa4d6dfb42bc0ce1580f5f03d9a9577b2a022fea6a464714a690835ae4d6393376cc05bffc60957b405f8ad147eaa783557dc48648d3a55d261160baf5eac2ec7db8e357215b2a730cd333c099b1cb83ec85b2410ae1252933da6434c60319ee05f9751b95b6c7d57e39a88e17fd9a148596418aa908227306f54aa642d3448c7d70588695fd72fd887535ee15d08335cb2ef9b785995b19eb7b33770fc63c436a11cb0520148c23d0095af0d69310134ad2d5f4a100018fbc71b57f03bc7b3d2482c131a7fce446af2c8264708cace6fd0272354591e2ce561b931e465a9f18f3bd50e7f4dd1306e0a0cd861e3a99daba4833babc1c453702272a397ddf45c76c72e3b98c0b221cf23132f1618902ed5e72a8aacb474033eebb02de720c17fef7786e0c73a68e743c1a637738189a0b47496d75a4283b9e8a9d676417550ae93b074e32f99023965e06d9b4a5fff4130c7342edca0e585d739229353feb91e0b7dab2525f96f40749def76b2c771d4f0f0c7b911edf8350b3c6b71601df3d514da97d1fa2fe214d8f0eb4a49f38a90cb6a589b5d6ba13ded1471d154f2900152347aefb50724515d20aa268af5460eb83f1d1efbfd9243463c65e56586aa5122294dc9f065722e4fefd20f5a8305ac7cf2bf1f7da658c26639882f8a8b87cfe78da9f2c9b710a1d4d37bb196bf2100310a9fcb132c334ca77fd05397db4d227582e7d65cbe53ae03766044cdf635c39298fd974848b8b49fe3810f44a8a9d457f38ff8011603d353e75ad3ae2b4aa8e87dafa0297436d4db4dd8dfdf441cb8a4b2fb98fb5128da2b46acef28486c0cc93628a8add37b50387bacb6136ac7dee606a6e8599d6efb06cd29602ee9756bbf2e7c51c98a6bbaa97cd39ec4155ba941b14bc77f1b45ac3a04ea80f00a95292cf023fb5e3584b575effb9aa9f522516b59a0cab10f12d10b20507b6d71abcfcaae588a9dc85ab88f0364f786bb94276e4f91d779677aea27e0c447653f28f2aa8742f75a728ca39da499373d8fcccd83827b287e55d53149ba98698c93bee382d729224c5f69af58880aebadf98358a24dbbf2cd5cee704d3c2eddbcc9dd82cfa2e231e65cd64f751fcd517f94aa070cbfac1716178c23a7680ac8180f7619a47f16e4512042e9350d193e38581cd9e4be8b2fedfba5a5dee8253ac288e2c85d27eea65ac0a499fd9ee944cc1ca5e2d4f771c1695ff54b734cabc2cfa4999cc61191539dcea0ade6b6fb1081ef6965e2450f438c3172ae7b50b4461f4eb50f1dd788a60902d42d56107b2cf640b828d9a0d45395606eea96e38a46f9a8375319a0877c6b9794ea0a2eb4a3792690b74c75d37d840d08ce557f"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[], 0x0, 0x0, 0x0}) 01:07:10 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4]}) 01:07:10 executing program 4: socketpair(0x2c, 0x0, 0x12b, &(0x7f0000000100)) 01:07:10 executing program 1: r0 = syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x100000001, 0xc8380) mmap$snddsp_control(&(0x7f0000ffc000/0x4000)=nil, 0x1000, 0x1, 0x10010, r0, 0x83000000) r1 = socket$bt_bnep(0x1f, 0x3, 0x4) ioctl$sock_ifreq(r1, 0x8992, &(0x7f0000000080)={'veth0_to_bond\x00', @ifru_addrs=@generic}) r2 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r3 = openat$ipvs(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/sys/net/ipv4/vs/am_droprate\x00', 0x2, 0x0) r4 = socket(0x21, 0x4, 0x3) ioctl$sock_ifreq(r4, 0x8936, &(0x7f00000001c0)={'veth0_to_bond\x00', @ifru_names}) ioctl$sock_bt_cmtp_CMTPCONNDEL(r3, 0x400443c9, &(0x7f0000000140)={@none, 0xfffffffd}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x0, 0x0}) 01:07:10 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4]}) 01:07:10 executing program 2: socketpair(0x22, 0x0, 0x2b01, &(0x7f0000000100)) [ 1429.823911][T16097] binder: 16096:16097 unknown command 0 [ 1429.849105][T16097] binder: 16096:16097 ioctl c0306201 20000100 returned -22 01:07:11 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) getrandom(&(0x7f0000000040)=""/136, 0x88, 0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)=ANY=[@ANYRESDEC=r0], 0x0, 0x0, 0x0}) 01:07:11 executing program 4: socketpair(0x2c, 0x0, 0x12c, &(0x7f0000000100)) [ 1429.882720][T16105] binder: 16102:16105 unknown command 28 [ 1429.896820][T16105] binder: 16102:16105 ioctl c0306201 20000100 returned -22 01:07:11 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_RX_RING(r1, 0x11b, 0x2, &(0x7f0000001e40)=0x100080, 0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000040)=ANY=[@ANYRESDEC=r1, @ANYRESDEC=r1], 0x0, 0x0, 0x0}) mmap$xdp(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x2000005, 0x2010, r1, 0x180000000) 01:07:11 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000]}) 01:07:11 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000]}) 01:07:11 executing program 2: socketpair(0x22, 0x0, 0x2c00, &(0x7f0000000100)) 01:07:11 executing program 4: socketpair(0x2c, 0x0, 0x12d, &(0x7f0000000100)) 01:07:11 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) getrandom(&(0x7f0000000040)=""/136, 0x88, 0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)=ANY=[@ANYRESDEC=r0], 0x0, 0x0, 0x0}) [ 1430.091496][T16117] binder: 16113:16117 unknown command 808464432 [ 1430.113187][T16117] binder: 16113:16117 ioctl c0306201 20000100 returned -22 01:07:11 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000]}) 01:07:11 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1]}) 01:07:11 executing program 2: socketpair(0x22, 0x0, 0x2c01, &(0x7f0000000100)) 01:07:11 executing program 1: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r0, 0x8000000) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000040)={0xffffffffffffffff}, 0x2, 0x8e5a10e08a145984}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f00000001c0), r1}}, 0x18) r2 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x0, 0x0}) 01:07:11 executing program 4: socketpair(0x2c, 0x0, 0x12e, &(0x7f0000000100)) 01:07:11 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) getrandom(&(0x7f0000000040)=""/136, 0x88, 0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)=ANY=[@ANYRESDEC=r0], 0x0, 0x0, 0x0}) 01:07:11 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8]}) 01:07:11 executing program 2: socketpair(0x22, 0x0, 0x2d00, &(0x7f0000000100)) 01:07:11 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69]}) [ 1430.379478][T16134] binder: 16131:16134 unknown command 28 [ 1430.397527][T16134] binder: 16131:16134 ioctl c0306201 20000100 returned -22 01:07:11 executing program 4: socketpair(0x2c, 0x0, 0x12f, &(0x7f0000000100)) 01:07:11 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5]}) 01:07:11 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="00caf2ffef71dbfd62bfb8ec4dc4a03919d3cfeb9a629281a45d95675dc59d3751ce0ae492de8b13973951b7b9290600000000000065ddb8d1cca25dd3f49f2ff7889038f03ebde47a12a54e86fe56b739f155"], 0x0, 0x0, 0x0}) 01:07:11 executing program 2: socketpair(0x22, 0x0, 0x2d01, &(0x7f0000000100)) 01:07:11 executing program 5: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) getrandom(&(0x7f0000000040)=""/136, 0x88, 0x4) 01:07:11 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4]}) 01:07:11 executing program 4: socketpair(0x2c, 0x0, 0x130, &(0x7f0000000100)) [ 1430.648402][T16151] binder: 16146:16151 unknown command -865792 [ 1430.671590][T16151] binder: 16146:16151 ioctl c0306201 20000100 returned -22 01:07:11 executing program 2: socketpair(0x22, 0x0, 0x2e00, &(0x7f0000000100)) 01:07:11 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff]}) 01:07:11 executing program 5: getrandom(&(0x7f0000000040)=""/136, 0x88, 0x4) 01:07:11 executing program 1: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) 01:07:11 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7]}) 01:07:11 executing program 4: socketpair(0x2c, 0x0, 0x131, &(0x7f0000000100)) 01:07:12 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d]}) 01:07:12 executing program 2: socketpair(0x22, 0x0, 0x2e01, &(0x7f0000000100)) 01:07:12 executing program 5: getrandom(0x0, 0x0, 0x4) 01:07:12 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) r2 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_RX_RING(r2, 0x11b, 0x2, &(0x7f0000001e40)=0x100080, 0x4) r3 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_RX_RING(r3, 0x11b, 0x2, &(0x7f0000001e40)=0x100080, 0x4) r4 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_RX_RING(r4, 0x11b, 0x2, &(0x7f0000001e40)=0x100080, 0x4) r5 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_RX_RING(r5, 0x11b, 0x2, &(0x7f0000001e40)=0x100080, 0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f00000001c0)=ANY=[@ANYRES16=r2, @ANYRESOCT=r1, @ANYRES32, @ANYRESHEX=r5], 0x0, 0x0, 0x0}) r6 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000040)={0xffffffffffffffff, 0xcdd6, 0x18}, 0xc) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f00000000c0)={r6, 0x28, &(0x7f0000000080)}, 0x10) 01:07:12 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}}) 01:07:12 executing program 4: socketpair(0x2c, 0x0, 0x132, &(0x7f0000000100)) 01:07:12 executing program 5: getrandom(0x0, 0x0, 0x0) 01:07:12 executing program 2: socketpair(0x22, 0x0, 0x2f00, &(0x7f0000000100)) [ 1431.077909][T16178] binder: 16176:16178 unknown command 825229316 [ 1431.112165][T16178] binder: 16176:16178 ioctl c0306201 20000140 returned -22 01:07:12 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4]}) 01:07:12 executing program 4: socketpair(0x2c, 0x0, 0x133, &(0x7f0000000100)) [ 1431.141291][T16182] binder: 16176:16182 unknown command 825229316 [ 1431.150045][T16182] binder: 16176:16182 ioctl c0306201 20000140 returned -22 01:07:12 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000040)=ANY=[@ANYRES64], 0x0, 0x0, 0x0}) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x6) 01:07:12 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8]}) 01:07:12 executing program 5: getrandom(0x0, 0x0, 0x0) 01:07:12 executing program 2: socketpair(0x22, 0x0, 0x2f01, &(0x7f0000000100)) 01:07:12 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000]}) 01:07:12 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8]}) [ 1431.324329][T16195] binder: 16192:16195 unknown command -1 [ 1431.376113][T16195] binder: 16192:16195 ioctl c0306201 20000100 returned -22 01:07:12 executing program 4: socketpair(0x2c, 0x0, 0x134, &(0x7f0000000100)) 01:07:12 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r1, 0x8000000) pipe(&(0x7f0000000080)={0xffffffffffffffff}) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x1f) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x0, 0x0}) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f0000000040)={0x0, 0x1, r0, 0x9}) 01:07:12 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8]}) 01:07:12 executing program 2: socketpair(0x22, 0x0, 0x3000, &(0x7f0000000100)) 01:07:12 executing program 4: socketpair(0x2c, 0x0, 0x135, &(0x7f0000000100)) 01:07:12 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1]}) [ 1431.558419][T16209] binder: 16208:16209 unknown command 28 [ 1431.571839][T16209] binder: 16208:16209 ioctl c0306201 20000100 returned -22 [ 1431.587329][T16209] binder: 16208:16209 unknown command 28 01:07:12 executing program 5: getrandom(0x0, 0x0, 0x0) [ 1431.608243][T16209] binder: 16208:16209 ioctl c0306201 20000100 returned -22 01:07:12 executing program 2: socketpair(0x22, 0x0, 0x3001, &(0x7f0000000100)) 01:07:12 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="e2457b6299284002ff7420d162608408b0b35936d90967d635dcf2e31c"], 0x0, 0x0, 0x0}) syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x800) 01:07:12 executing program 0: ioctl$SNDRV_CTL_IOCTL_ELEM_READ(0xffffffffffffffff, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8]}) 01:07:12 executing program 4: socketpair(0x2c, 0x0, 0x136, &(0x7f0000000100)) 01:07:12 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69]}) 01:07:12 executing program 5: socketpair(0x2c, 0x0, 0x133, &(0x7f0000000100)) [ 1431.817192][T16225] binder: 16223:16225 unknown command 1652245986 [ 1431.831377][T16225] binder: 16223:16225 ioctl c0306201 20000100 returned -22 [ 1431.853854][T16225] binder: 16223:16225 unknown command 1652245986 01:07:13 executing program 4: socketpair(0x2c, 0x0, 0x137, &(0x7f0000000100)) [ 1431.873646][T16225] binder: 16223:16225 ioctl c0306201 20000100 returned -22 01:07:13 executing program 2: socketpair(0x22, 0x0, 0x3100, &(0x7f0000000100)) 01:07:13 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4]}) 01:07:13 executing program 0: ioctl$SNDRV_CTL_IOCTL_ELEM_READ(0xffffffffffffffff, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8]}) 01:07:13 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7]}) 01:07:13 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="9a5bd23788bcf09348703f7620e3e01cdad63d29df9b6ff958e468fb82463d41a42320036d8f8eb4f0d2a27314d0e7ed48dea2dd64d1781f8445c0817918691102bcbaf1e092c87100"/83], 0x0, 0x0, 0x0}) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000040)=0x4, 0x4) socketpair(0xf, 0x80000, 0x3bf69f1, &(0x7f0000000080)={0xffffffffffffffff}) ioctl$sock_bt_bnep_BNEPGETCONNLIST(r1, 0x800442d2, &(0x7f00000000c0)={0x4, &(0x7f00000001c0)=[{0x0, 0x0, 0x0, @random}, {}, {}, {0x0, 0x0, 0x0, @multicast}]}) 01:07:13 executing program 2: socketpair(0x22, 0x0, 0x3101, &(0x7f0000000100)) 01:07:13 executing program 4: socketpair(0x2c, 0x0, 0x138, &(0x7f0000000100)) 01:07:13 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7]}) 01:07:13 executing program 0: ioctl$SNDRV_CTL_IOCTL_ELEM_READ(0xffffffffffffffff, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8]}) [ 1432.120341][T16245] binder: 16242:16245 unknown command 936532890 [ 1432.149924][T16245] binder: 16242:16245 ioctl c0306201 20000100 returned -22 01:07:13 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7]}) [ 1432.192766][T16245] binder: 16242:16245 unknown command 936532890 [ 1432.224591][T16245] binder: 16242:16245 ioctl c0306201 20000100 returned -22 01:07:13 executing program 2: socketpair(0x22, 0x0, 0x3200, &(0x7f0000000100)) 01:07:13 executing program 4: socketpair(0x2c, 0x0, 0x139, &(0x7f0000000100)) 01:07:13 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7]}) 01:07:13 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}}) 01:07:13 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="1c"], 0x0, 0x0, 0x0}) 01:07:13 executing program 0: r0 = syz_open_dev$sndctrl(0x0, 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8]}) 01:07:13 executing program 2: socketpair(0x22, 0x0, 0x3201, &(0x7f0000000100)) 01:07:13 executing program 4: socketpair(0x2c, 0x0, 0x13a, &(0x7f0000000100)) [ 1432.458788][T16268] binder: 16264:16268 unknown command 28 [ 1432.479387][T16268] binder: 16264:16268 ioctl c0306201 20000100 returned -22 01:07:13 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4]}) 01:07:13 executing program 5: ioctl$SNDRV_CTL_IOCTL_ELEM_READ(0xffffffffffffffff, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7]}) 01:07:13 executing program 0: r0 = syz_open_dev$sndctrl(0x0, 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8]}) 01:07:13 executing program 1: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x802) r1 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_RX_RING(r1, 0x11b, 0x2, &(0x7f0000001e40)=0x100080, 0x4) accept(r1, 0x0, &(0x7f0000000080)) write$RDMA_USER_CM_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x4}, 0xc) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000040)=ANY=[@ANYRES16], 0x0, 0x0, 0x0}) 01:07:13 executing program 2: socketpair(0x22, 0x0, 0x3300, &(0x7f0000000100)) 01:07:13 executing program 4: socketpair(0x2c, 0x0, 0x13b, &(0x7f0000000100)) 01:07:13 executing program 5: ioctl$SNDRV_CTL_IOCTL_ELEM_READ(0xffffffffffffffff, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7]}) [ 1432.710851][T16282] binder: 16279:16282 unknown command 65535 [ 1432.721837][T16282] binder: 16279:16282 ioctl c0306201 20000100 returned -22 01:07:13 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40]}) 01:07:13 executing program 0: r0 = syz_open_dev$sndctrl(0x0, 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8]}) 01:07:13 executing program 2: socketpair(0x22, 0x0, 0x3301, &(0x7f0000000100)) 01:07:13 executing program 4: socketpair(0x2c, 0x0, 0x13c, &(0x7f0000000100)) 01:07:14 executing program 1: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r0, 0x8000000) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x1c, 0x0, &(0x7f0000000080)=ANY=[@ANYRESHEX=r0, @ANYRESOCT, @ANYBLOB="50e933e606bbe16404cb987b34b4c752d57c77222544bedf06d5bdb76170d80df55c30dc9a07600c793657f1a7359067102e058043e0db31ab207fc303a5a8a895e74122cdd4e52b3b1765cabfa5180b02234b1bdd5f707e3018a3af3b41de50a29dd939c9f8a8b33556d28dd0397fe46327645a82b8ad1b6ce68b685abc15c7f60ac430bba001e4c40e7f1d0b09cd489c8e29ebac2260922fb03c50657e1d253c510b593d627452b034cc0b56e50bdd96a69ae7a9839023ccb041335ddc0f1e633460a77387f91f2b20ad15b6a345", @ANYRES64, @ANYRES64], 0xffffffffffffff74, 0x0, 0x0}) 01:07:14 executing program 0: syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(0xffffffffffffffff, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8]}) 01:07:14 executing program 3: socketpair(0x22, 0x0, 0x2601, &(0x7f0000000100)) 01:07:14 executing program 5: ioctl$SNDRV_CTL_IOCTL_ELEM_READ(0xffffffffffffffff, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7]}) 01:07:14 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) 01:07:14 executing program 2: socketpair(0x22, 0x0, 0x3400, &(0x7f0000000100)) 01:07:14 executing program 4: socketpair(0x2c, 0x0, 0x13d, &(0x7f0000000100)) 01:07:14 executing program 5: r0 = syz_open_dev$sndctrl(0x0, 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7]}) 01:07:14 executing program 4: socketpair(0x2c, 0x0, 0x13e, &(0x7f0000000100)) 01:07:14 executing program 0: syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(0xffffffffffffffff, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8]}) [ 1433.098249][T16310] binder: 16306:16310 unknown command 0 [ 1433.135371][T16310] binder: 16306:16310 ioctl c0306201 20000100 returned -22 01:07:14 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7]}) 01:07:14 executing program 2: socketpair(0x22, 0x0, 0x3401, &(0x7f0000000100)) 01:07:14 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x800) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="d7293c59d8db65ca1c"], 0x0, 0x0, 0x0}) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000040)='/dev/zero\x00', 0x0, 0x0) write$RDMA_USER_CM_CMD_GET_EVENT(r1, &(0x7f0000000080)={0xc, 0x8, 0xfa00, {&(0x7f00000001c0)}}, 0x10) recvmsg$kcm(r1, &(0x7f0000000580)={&(0x7f0000000340)=@ieee802154={0x24, @short}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000000)=""/61, 0x3d}, {&(0x7f00000003c0)=""/79, 0x4f}, {&(0x7f0000000440)=""/211, 0xd3}], 0x3, &(0x7f0000000540)=""/10, 0xa}, 0x2000) 01:07:14 executing program 0: syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(0xffffffffffffffff, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8]}) 01:07:14 executing program 5: r0 = syz_open_dev$sndctrl(0x0, 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7]}) 01:07:14 executing program 4: socketpair(0x2c, 0x0, 0x13f, &(0x7f0000000100)) 01:07:14 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x2) r1 = socket$xdp(0x2c, 0x3, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f00000002c0)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000280)={0xffffffffffffffff}, 0x111, 0x3}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(0xffffffffffffffff, &(0x7f0000000300)={0x10, 0x30, 0xfa00, {&(0x7f0000000240), 0x4, {0xa, 0x4e23, 0x40, @empty, 0x4}, r2}}, 0x38) setsockopt$XDP_RX_RING(r1, 0x11b, 0x2, &(0x7f0000001e40)=0x100080, 0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x59, 0x0, &(0x7f0000000080)=ANY=[@ANYRES32=r1], 0x0, 0x0, 0x0}) sendmsg$xdp(r1, &(0x7f0000000200)={&(0x7f0000000000)={0x2c, 0x2, 0x0, 0x27}, 0x10, &(0x7f00000000c0)=[{&(0x7f0000000140)="8d22fd81a6a0e7ac81e24165bac6d8e258f988143af36fd6920b80f0d42e0ad6e1fccb471d8ff5a065f395da2d04f3525edb1aa278268549d775f12192ef87c71c902c49c1776c43fecd9ade5d5904a94177193e1b1ae64a3bd6ec767e40d333b82a5c621f7e494094c342dfb69fbe6a175f650b16631516b17a58bd7a990ef972dc08164ead3aa6647aa8fa4e7e1c391ad4330b57c541a784", 0x99}], 0x1, 0x0, 0x0, 0x40000}, 0x4004050) 01:07:14 executing program 2: socketpair(0x22, 0x0, 0x3500, &(0x7f0000000100)) [ 1433.392737][T16323] binder: 16322:16323 unknown command 1497115095 [ 1433.423997][T16323] binder: 16322:16323 ioctl c0306201 20000100 returned -22 01:07:14 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, 0x0) 01:07:14 executing program 5: r0 = syz_open_dev$sndctrl(0x0, 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7]}) [ 1433.460760][T16330] binder: 16327:16330 unknown command 4 [ 1433.473477][T16323] binder: 16322:16323 unknown command 1497115095 [ 1433.491479][T16330] binder: 16327:16330 ioctl c0306201 20000100 returned -22 [ 1433.503910][T16323] binder: 16322:16323 ioctl c0306201 20000100 returned -22 01:07:14 executing program 4: socketpair(0x2c, 0x0, 0x140, &(0x7f0000000100)) 01:07:14 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x2) r1 = socket$xdp(0x2c, 0x3, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f00000002c0)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000280)={0xffffffffffffffff}, 0x111, 0x3}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(0xffffffffffffffff, &(0x7f0000000300)={0x10, 0x30, 0xfa00, {&(0x7f0000000240), 0x4, {0xa, 0x4e23, 0x40, @empty, 0x4}, r2}}, 0x38) setsockopt$XDP_RX_RING(r1, 0x11b, 0x2, &(0x7f0000001e40)=0x100080, 0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x59, 0x0, &(0x7f0000000080)=ANY=[@ANYRES32=r1], 0x0, 0x0, 0x0}) sendmsg$xdp(r1, &(0x7f0000000200)={&(0x7f0000000000)={0x2c, 0x2, 0x0, 0x27}, 0x10, &(0x7f00000000c0)=[{&(0x7f0000000140)="8d22fd81a6a0e7ac81e24165bac6d8e258f988143af36fd6920b80f0d42e0ad6e1fccb471d8ff5a065f395da2d04f3525edb1aa278268549d775f12192ef87c71c902c49c1776c43fecd9ade5d5904a94177193e1b1ae64a3bd6ec767e40d333b82a5c621f7e494094c342dfb69fbe6a175f650b16631516b17a58bd7a990ef972dc08164ead3aa6647aa8fa4e7e1c391ad4330b57c541a784", 0x99}], 0x1, 0x0, 0x0, 0x40000}, 0x4004050) 01:07:14 executing program 2: socketpair(0x22, 0x0, 0x3501, &(0x7f0000000100)) 01:07:14 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x2) sendmsg$AUDIT_TRIM(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x10, 0x3f6, 0x300, 0x70bd27, 0x25dfdbfb, "", ["", "", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x8c8}, 0x0) ioctl$UFFDIO_COPY(0xffffffffffffffff, 0xc028aa03, &(0x7f0000000040)={&(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, 0x4000}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x0, 0x0}) 01:07:14 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, 0x0) 01:07:14 executing program 5: syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(0xffffffffffffffff, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7]}) [ 1433.666057][T16343] binder: 16341:16343 unknown command 4 [ 1433.697957][T16343] binder: 16341:16343 ioctl c0306201 20000100 returned -22 01:07:14 executing program 4: socketpair(0x2c, 0x0, 0x141, &(0x7f0000000100)) 01:07:14 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x2) r1 = socket$xdp(0x2c, 0x3, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f00000002c0)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000280)={0xffffffffffffffff}, 0x111, 0x3}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(0xffffffffffffffff, &(0x7f0000000300)={0x10, 0x30, 0xfa00, {&(0x7f0000000240), 0x4, {0xa, 0x4e23, 0x40, @empty, 0x4}, r2}}, 0x38) setsockopt$XDP_RX_RING(r1, 0x11b, 0x2, &(0x7f0000001e40)=0x100080, 0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x59, 0x0, &(0x7f0000000080)=ANY=[@ANYRES32=r1], 0x0, 0x0, 0x0}) sendmsg$xdp(r1, &(0x7f0000000200)={&(0x7f0000000000)={0x2c, 0x2, 0x0, 0x27}, 0x10, &(0x7f00000000c0)=[{&(0x7f0000000140)="8d22fd81a6a0e7ac81e24165bac6d8e258f988143af36fd6920b80f0d42e0ad6e1fccb471d8ff5a065f395da2d04f3525edb1aa278268549d775f12192ef87c71c902c49c1776c43fecd9ade5d5904a94177193e1b1ae64a3bd6ec767e40d333b82a5c621f7e494094c342dfb69fbe6a175f650b16631516b17a58bd7a990ef972dc08164ead3aa6647aa8fa4e7e1c391ad4330b57c541a784", 0x99}], 0x1, 0x0, 0x0, 0x40000}, 0x4004050) 01:07:14 executing program 2: socketpair(0x22, 0x0, 0x3600, &(0x7f0000000100)) 01:07:14 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, 0x0) [ 1433.796012][T16351] binder: 16347:16351 unknown command 28 [ 1433.822245][T16351] binder: 16347:16351 ioctl c0306201 20000100 returned -22 01:07:15 executing program 5: syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(0xffffffffffffffff, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7]}) [ 1433.882930][T16357] binder: 16355:16357 unknown command 4 [ 1433.903134][T16357] binder: 16355:16357 ioctl c0306201 20000100 returned -22 01:07:15 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='attr/exec\x00') ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="1dedccbd43c3a0a05787629184027dd68a93c828fff71b7aa41f94a8ba93a39336a081f8f1c9a6152492fa5926017cd374cd44f64f1595d13927e07cef69e759486d19a300dc809480322ae2ade200dcb056f084dd78c2c332e505a7e305c9893d7529a0cf25fa8ba0fb88d6c2cdea01dcc648ecac6bc18ebecb3af0f7c7a7707ac9"], 0x0, 0x0, 0x0}) 01:07:15 executing program 4: socketpair(0x2c, 0x0, 0x142, &(0x7f0000000100)) 01:07:15 executing program 2: socketpair(0x22, 0x0, 0x3601, &(0x7f0000000100)) 01:07:15 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8]}) 01:07:15 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x2) r1 = socket$xdp(0x2c, 0x3, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f00000002c0)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000280)={0xffffffffffffffff}, 0x111, 0x3}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(0xffffffffffffffff, &(0x7f0000000300)={0x10, 0x30, 0xfa00, {&(0x7f0000000240), 0x4, {0xa, 0x4e23, 0x40, @empty, 0x4}, r2}}, 0x38) setsockopt$XDP_RX_RING(r1, 0x11b, 0x2, &(0x7f0000001e40)=0x100080, 0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x59, 0x0, &(0x7f0000000080)=ANY=[@ANYRES32=r1], 0x0, 0x0, 0x0}) 01:07:15 executing program 5: syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(0xffffffffffffffff, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7]}) [ 1434.065857][T16367] binder: 16365:16367 unknown command -1110643427 [ 1434.097474][T16367] binder: 16365:16367 ioctl c0306201 20000100 returned -22 01:07:15 executing program 4: socketpair(0x2c, 0x0, 0x143, &(0x7f0000000100)) [ 1434.136651][T16374] binder: 16372:16374 unknown command 4 [ 1434.159070][T16374] binder: 16372:16374 ioctl c0306201 20000100 returned -22 01:07:15 executing program 2: socketpair(0x22, 0x0, 0x3700, &(0x7f0000000100)) 01:07:15 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_RX_RING(r1, 0x11b, 0x2, &(0x7f0000001e40)=0x100080, 0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="6f1561824f6cbf7dcc740427783beffa270fecc6fd900488e5efcfdef1649a0214e2604319f23fd7fa8966850a9a52ea28364cda0f59c783a599cd7efa5648d5a9b5ebbec0a02001c506341d064c129ff660eaf19b3ea6eac1822498eb988c6532e9f484bfee79d1a5cd6cfa13cc1eb2faf1e591ec3777a49a58b6a2435f4ab920d5ad37d8f55829c81b52c648b0b3dcf05bdd0440298dc633d979d1"], 0x0, 0x0, 0x0}) 01:07:15 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8]}) 01:07:15 executing program 3: syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x2) r0 = socket$xdp(0x2c, 0x3, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000002c0)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000280)={0xffffffffffffffff}, 0x111, 0x3}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(0xffffffffffffffff, &(0x7f0000000300)={0x10, 0x30, 0xfa00, {&(0x7f0000000240), 0x4, {0xa, 0x4e23, 0x40, @empty, 0x4}, r1}}, 0x38) setsockopt$XDP_RX_RING(r0, 0x11b, 0x2, &(0x7f0000001e40)=0x100080, 0x4) 01:07:15 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, 0x0) 01:07:15 executing program 4: socketpair(0x2c, 0x0, 0x144, &(0x7f0000000100)) [ 1434.343435][T16386] binder: 16381:16386 unknown command -2107566737 [ 1434.357526][T16386] binder: 16381:16386 ioctl c0306201 20000100 returned -22 01:07:15 executing program 3: syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x2) r0 = socket$xdp(0x2c, 0x3, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000002c0)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000280)={0xffffffffffffffff}, 0x111, 0x3}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(0xffffffffffffffff, &(0x7f0000000300)={0x10, 0x30, 0xfa00, {&(0x7f0000000240), 0x4, {0xa, 0x4e23, 0x40, @empty, 0x4}, r1}}, 0x38) 01:07:15 executing program 2: socketpair(0x22, 0x0, 0x3701, &(0x7f0000000100)) 01:07:15 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8]}) 01:07:15 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, 0x0) 01:07:15 executing program 1: syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff}) read$eventfd(r0, &(0x7f0000000140), 0x8) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="58482b8a39d304992089322f78d39cf3db5f792752a1e9fdc5f6bfafdafc2bda366c273344007859d626730be677f2f88c7b061f01b00f3c28056446ab185aeaf8cb1c80e4a3ec20e9f1b5c5fcf51fd807d302c9a117986b7f6e25a2084d18003661f52b13fe31e376c58862"], 0x0, 0x0, 0x0}) 01:07:15 executing program 4: socketpair(0x2c, 0x0, 0x145, &(0x7f0000000100)) 01:07:15 executing program 3: syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x2) r0 = socket$xdp(0x2c, 0x3, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000002c0)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000280), 0x111, 0x3}}, 0x20) 01:07:15 executing program 2: socketpair(0x22, 0x0, 0x3800, &(0x7f0000000100)) 01:07:15 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5]}) 01:07:15 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, 0x0) 01:07:15 executing program 4: socketpair(0x2c, 0x0, 0x146, &(0x7f0000000100)) 01:07:15 executing program 2: socketpair(0x22, 0x0, 0x3801, &(0x7f0000000100)) 01:07:15 executing program 3: syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x2) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000280), 0x111, 0x3}}, 0x20) 01:07:15 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff]}) 01:07:16 executing program 4: socketpair(0x2c, 0x0, 0x147, &(0x7f0000000100)) 01:07:16 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7]}) 01:07:16 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) sendmsg$xdp(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000400)=[{&(0x7f0000000040)="26116e90b7d1141127bd279572bac04fd067c018d48f6834c05ef6ab8b3831dc19da12924a7b459ab35160782f76", 0x2e}, {&(0x7f00000001c0)="309546f37afa28fa5ad1dc919846226679aa3f9293651149ed3a94910c10545bad049eb6bccd28e90d428bf2489e678d59fa0a213ea0f9e064a36f67a6c12bdd249fa790cbfe4adf539daebfec57e3f2e87e160dd25b732599efec821a4277a5e2d906f680152c7076f1e405048da33b0e92ecda9df92d3416c656d8bf5d6a0347f92f54b8caf7715212aac0e8a97fa7e89655bdfa4bffcd71236d3810c6991e9197f65dda84120eabd8c56de9401b7c4b22bd71c2bb8f0c64f4d23f94d059a531d78a9fa10910af89a31b7a40bffe6dfdc7fc4d868b233d8394c2f86db60a93c013827217142d036695211fd940", 0xee}, {&(0x7f0000000080)="52e84f206a778e88e29c4558b62b3262b0bc48353a063ad353267f639464ea01d08b", 0x22}, {&(0x7f00000002c0)="9667a144925fb53032baf3dfdd29871724ffc2bee061fd0723207a60fe8f9c4db95f60b1dde4a8ebe1c6d8131bdfcf7579ef398e6b8aba6c0adc900190036ecf3e736d19d18738bd3c24bd4c7744d0b5ae307e967314b0a09c2bee0d6340c984af4dfaa9215cd8a0817e9b", 0x6b}, {&(0x7f00000000c0)="7c87f7f22bd57630d5ea37a0706f2c74543023ce97c61e9137dba10b22eeb6576e098827d3d56919516ae2190235841746cb39d70aa0f89e74f28d337d82", 0x3e}, {&(0x7f0000000340)="d6bac0efdaba5b95cd442a22111cea0b6cedc5b85decd9602af8d12947ebee287184ef925bb32da240b9d435d8aceef2863acf1e92e607b33f1c006d7e7552802dfcd5719410034fc302664debf0430978042b89d98ebe0595a231bf3f6950cd8beaa244aae16b78e45744288396ae3d983fe12658319b214dd78be193348ef7d00e18560b3c15158504bbd86a5d96256928ca50b2bde2e9575b3a71", 0x9c}, {&(0x7f0000000140)}], 0x7, 0x0, 0x0, 0x4000030}, 0x10) ioctl$SNDRV_CTL_IOCTL_HWDEP_INFO(0xffffffffffffffff, 0x80dc5521, &(0x7f0000000140)=""/102) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_INFO(0xffffffffffffffff, 0xc10c5541, &(0x7f00000005c0)={0x81, 0x80000001}) ioctl$SNDRV_CTL_IOCTL_TLV_COMMAND(0xffffffffffffffff, 0xc008551c, &(0x7f00000007c0)={0x80000000, 0x10, [0x0, 0x7, 0x4, 0x2]}) getsockopt$XDP_MMAP_OFFSETS(0xffffffffffffffff, 0x11b, 0x1, &(0x7f0000000700), &(0x7f0000000780)=0x80) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1c200df16dbd8f859b6afa402eda79a5a9f8de76675c969a3d1cf200c85b4017fff7739f10776b45850ae91bcd898938fb89b2e12f2117bf58845bc810c5f2092b052c723bb0c9eea6fc2b182d9bc66a5d20adc90bd18746b37ab800d18c245166d5b402de3f55f86f5f97faf35194ccd8631ed483dfd1e0677f05e53a273ff51d76312176120094c4f33b5f4b6c2c3586730494e5a8e400cf47cfbc67222bef380d0f3a60c943d4a4d3a968333ed78a914c1a288ecea454ce7d04029ff9bb8cf0dcf0c96d3707a34e2283781758abf5aec36a9ca67747"], 0x0, 0x0, 0x0}) 01:07:16 executing program 2: socketpair(0x22, 0x0, 0x3900, &(0x7f0000000100)) 01:07:16 executing program 3: syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x2) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000280), 0x111, 0x3}}, 0x20) 01:07:16 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d]}) 01:07:16 executing program 4: socketpair(0x2c, 0x0, 0x148, &(0x7f0000000100)) 01:07:16 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7]}) 01:07:16 executing program 2: socketpair(0x22, 0x0, 0x3901, &(0x7f0000000100)) 01:07:16 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4]}) 01:07:16 executing program 4: socketpair(0x2c, 0x0, 0x149, &(0x7f0000000100)) 01:07:16 executing program 3: syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x2) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000280), 0x111, 0x3}}, 0x20) 01:07:16 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7]}) [ 1435.601109][T16438] binder: 16437:16438 unknown command -250798052 [ 1435.618448][T16438] binder: 16437:16438 ioctl c0306201 20000100 returned -22 [ 1435.656818][T16441] binder: 16437:16441 unknown command -250798052 [ 1435.670143][T16441] binder: 16437:16441 ioctl c0306201 20000100 returned -22 01:07:16 executing program 2: socketpair(0x22, 0x0, 0x3a00, &(0x7f0000000100)) 01:07:16 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB='O'], 0x0, 0x0, 0x0}) 01:07:16 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000]}) 01:07:16 executing program 4: socketpair(0x2c, 0x0, 0x14a, &(0x7f0000000100)) 01:07:16 executing program 3: r0 = socket$xdp(0x2c, 0x3, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000002c0)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000280), 0x111, 0x3}}, 0x20) 01:07:16 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4]}) 01:07:17 executing program 4: socketpair(0x2c, 0x0, 0x14b, &(0x7f0000000100)) [ 1435.893787][T16459] binder: 16455:16459 unknown command 79 [ 1435.909166][T16459] binder: 16455:16459 ioctl c0306201 20000100 returned -22 01:07:17 executing program 2: socketpair(0x22, 0x0, 0x3a01, &(0x7f0000000100)) 01:07:17 executing program 3: socket$xdp(0x2c, 0x3, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000280), 0x111, 0x3}}, 0x20) 01:07:17 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1]}) 01:07:17 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000040)=ANY=[], 0x0, 0x0, 0x0}) 01:07:17 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000]}) 01:07:17 executing program 3: socket$xdp(0x2c, 0x3, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000280), 0x111, 0x3}}, 0x20) 01:07:17 executing program 4: socketpair(0x2c, 0x0, 0x14c, &(0x7f0000000100)) 01:07:17 executing program 2: socketpair(0x22, 0x0, 0x3b00, &(0x7f0000000100)) 01:07:17 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000]}) [ 1436.136739][T16473] binder: 16471:16473 unknown command 0 [ 1436.155586][T16473] binder: 16471:16473 ioctl c0306201 20000100 returned -22 01:07:17 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69]}) 01:07:17 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="cea805525bd8bc0cd5562dd5ac3436b7187f019b744d4a5e61374215c0422245f1453e9a2c5a62fe62af07198be696735e"], 0x0, 0x0, 0x0}) syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) 01:07:17 executing program 3: socket$xdp(0x2c, 0x3, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000280), 0x111, 0x3}}, 0x20) 01:07:17 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8]}) 01:07:17 executing program 4: socketpair(0x2c, 0x0, 0x14d, &(0x7f0000000100)) 01:07:17 executing program 2: socketpair(0x22, 0x0, 0x3b01, &(0x7f0000000100)) [ 1436.327081][T16484] binder: 16483:16484 unknown command 1376102606 [ 1436.342875][T16484] binder: 16483:16484 ioctl c0306201 20000100 returned -22 [ 1436.390902][T16484] binder: 16483:16484 unknown command 1376102606 [ 1436.415769][T16484] binder: 16483:16484 ioctl c0306201 20000100 returned -22 01:07:17 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4]}) 01:07:17 executing program 3: r0 = socket$xdp(0x2c, 0x3, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, 0x0, 0x0) 01:07:17 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5]}) 01:07:17 executing program 1: ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f00000000c0)={0x0, 0x0, 0xffffffffffffffff, 0x9, 0x80000}) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) sendmsg$AUDIT_USER_TTY(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000300)={&(0x7f0000000200)={0xcc, 0x464, 0x8, 0x70bd26, 0x25dfdbff, "ac1a2ff48efe57c9360691403296ed54a9f7e41f37c605bd2539aa21c6d176a4f345e5dfb5b0eb54f6dba4666586a9b2746910ec6d94e0798949c904b1088576aa96e7ea68ce9ef1a42d256da23f6f9db6a1804caec3b791d9ab3b5b24b994494c216f3110504057e77664470c85a049a366364e6a527faf3a6040267fbf255e8261baa82cb3226e7743deffd551a8b51da0dcbbc969698421aef06dfd4049b4b0f39af244e89193b26a21e11e4c47419f73eb5fb61550e04fde", ["", ""]}, 0xcc}}, 0x40800) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x0, 0x0}) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_SET_OPTION(r1, &(0x7f0000000080)={0xe, 0x18, 0xfa00, @id_afonly={&(0x7f0000000140)=0x1}}, 0xfffffffffffffdd4) 01:07:17 executing program 4: socketpair(0x2c, 0x0, 0x14e, &(0x7f0000000100)) 01:07:17 executing program 2: socketpair(0x22, 0x0, 0x3c00, &(0x7f0000000100)) 01:07:17 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7]}) 01:07:17 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7]}) [ 1436.632749][T16504] binder: 16500:16504 unknown command 28 [ 1436.645733][T16504] binder: 16500:16504 ioctl c0306201 20000100 returned -22 01:07:17 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff]}) 01:07:17 executing program 2: socketpair(0x22, 0x0, 0x3c01, &(0x7f0000000100)) [ 1436.692552][T16504] binder: 16500:16504 unknown command 28 [ 1436.717170][T16504] binder: 16500:16504 ioctl c0306201 20000100 returned -22 01:07:17 executing program 4: socketpair(0x2c, 0x0, 0x14f, &(0x7f0000000100)) 01:07:17 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}}) 01:07:17 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="1c592b9edf99fb48e895f9d71c1b374fe39aa8bacd22b69234b3f01d2aa15416cd3730e2754402f33f9a3ebcb82efd425594ef69cb14dd0637abac7ee6efac660e95c2d4d104236aa1bc27f06690fa87e5cfc9c3f1aa1af6021d2963ceae8b6e4ce7ea92b421a5bb8278a148ed462a0841719d6623ef4e72679c3aff91e66583827a0bf2ae1072e193a4b614fe317f19c14bcd59041a71ffabdc90dfa326e219b655b558d9019b4c2b5f1014b9b34a2681fc4e51516f0b644ecdfe5702bb1d41423a974e5b0a9f3177e58df24f66aeddcb20daffadd1030000000000000d939eaeb3558f4c1d77447d00"/247], 0x0, 0x0, 0x0}) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r1, 0x8000000) io_uring_setup(0x7b99, &(0x7f0000000140)={0x0, 0x2, 0x2, 0x2, 0x39e, 0x0, r1}) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000040)={0x0}) ioctl$SECCOMP_IOCTL_NOTIF_ID_VALID(r1, 0x40082102, &(0x7f00000001c0)=r2) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f00000000c0)={r2, 0x1, r0, 0x5433, 0x80000}) 01:07:18 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7]}) 01:07:18 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d]}) 01:07:18 executing program 2: socketpair(0x22, 0x0, 0x3d00, &(0x7f0000000100)) 01:07:18 executing program 4: socketpair(0x2c, 0x0, 0x150, &(0x7f0000000100)) [ 1436.921276][T16520] binder: 16519:16520 unknown command -1641326308 [ 1436.928535][T16520] binder: 16519:16520 ioctl c0306201 20000100 returned -22 [ 1436.960912][T16520] binder: 16519:16520 unknown command -1641326308 01:07:18 executing program 0: ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f00000000c0)={0x0, 0x0, 0xffffffffffffffff, 0x9, 0x80000}) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) sendmsg$AUDIT_USER_TTY(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000300)={&(0x7f0000000200)={0xcc, 0x464, 0x8, 0x70bd26, 0x25dfdbff, "ac1a2ff48efe57c9360691403296ed54a9f7e41f37c605bd2539aa21c6d176a4f345e5dfb5b0eb54f6dba4666586a9b2746910ec6d94e0798949c904b1088576aa96e7ea68ce9ef1a42d256da23f6f9db6a1804caec3b791d9ab3b5b24b994494c216f3110504057e77664470c85a049a366364e6a527faf3a6040267fbf255e8261baa82cb3226e7743deffd551a8b51da0dcbbc969698421aef06dfd4049b4b0f39af244e89193b26a21e11e4c47419f73eb5fb61550e04fde", ["", ""]}, 0xcc}}, 0x40800) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x0, 0x0}) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_SET_OPTION(r1, &(0x7f0000000080)={0xe, 0x18, 0xfa00, @id_afonly={&(0x7f0000000140)=0x1}}, 0xfffffffffffffdd4) [ 1436.982710][T16520] binder: 16519:16520 ioctl c0306201 20000100 returned -22 01:07:18 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4]}) 01:07:18 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r1, 0x8000000) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r1, &(0x7f00000001c0)={0x15, 0x110, 0xfa00, {0xffffffffffffffff, 0xffff, 0x0, 0x0, 0x0, @ib={0x1b, 0x91, 0xfffffffc, {"def3c5f2bfd27d2aecb36cc8b615af60"}, 0x7, 0x6, 0x3ff}, @in6={0xa, 0x4e24, 0x101, @local}}}, 0x118) mmap$usbfs(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x3000003, 0x30, r1, 0x6) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x0, 0x0}) 01:07:18 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7]}) 01:07:18 executing program 2: socketpair(0x22, 0x0, 0x3d01, &(0x7f0000000100)) 01:07:18 executing program 4: socketpair(0x2c, 0x0, 0x151, &(0x7f0000000100)) [ 1437.155608][T16533] binder: 16532:16533 unknown command 28 [ 1437.172541][T16533] binder: 16532:16533 ioctl c0306201 20000100 returned -22 01:07:18 executing program 0: ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f00000000c0)={0x0, 0x0, 0xffffffffffffffff, 0x9, 0x80000}) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) sendmsg$AUDIT_USER_TTY(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000300)={&(0x7f0000000200)={0xcc, 0x464, 0x8, 0x70bd26, 0x25dfdbff, "ac1a2ff48efe57c9360691403296ed54a9f7e41f37c605bd2539aa21c6d176a4f345e5dfb5b0eb54f6dba4666586a9b2746910ec6d94e0798949c904b1088576aa96e7ea68ce9ef1a42d256da23f6f9db6a1804caec3b791d9ab3b5b24b994494c216f3110504057e77664470c85a049a366364e6a527faf3a6040267fbf255e8261baa82cb3226e7743deffd551a8b51da0dcbbc969698421aef06dfd4049b4b0f39af244e89193b26a21e11e4c47419f73eb5fb61550e04fde", ["", ""]}, 0xcc}}, 0x40800) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x0, 0x0}) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_SET_OPTION(r1, &(0x7f0000000080)={0xe, 0x18, 0xfa00, @id_afonly={&(0x7f0000000140)=0x1}}, 0xfffffffffffffdd4) [ 1437.221934][T16539] binder: 16534:16539 unknown command 28 [ 1437.244307][T16539] binder: 16534:16539 ioctl c0306201 20000100 returned -22 01:07:18 executing program 3: ioctl$SNDRV_CTL_IOCTL_ELEM_READ(0xffffffffffffffff, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7]}) 01:07:18 executing program 2: socketpair(0x22, 0x0, 0x3e00, &(0x7f0000000100)) 01:07:18 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000]}) 01:07:18 executing program 4: socketpair(0x2c, 0x0, 0x152, &(0x7f0000000100)) 01:07:18 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r1, 0x8000000) r2 = mmap$binder(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x9) r3 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x84, 0x0, &(0x7f00000011c0)=[@free_buffer={0x40086303, r2}, @free_buffer, @clear_death={0x400c630f, 0x2}, @release={0x40046306, 0x3}, @decrefs, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000040)={@fd={0x66642a85, 0x0, r3}, @fda={0x66646185, 0x7, 0x0, 0x17}, @ptr={0x70742a85, 0x0, &(0x7f00000001c0)=""/4096, 0x1000, 0x1, 0x19}}, &(0x7f00000000c0)={0x0, 0x18, 0x38}}, 0x40}], 0x5c, 0x0, &(0x7f0000001280)="d3b950590a6a633f7e20c80906965db3a7cb8299b51180809595a803f2c1652e13ffc85d3820bc92556d637c16c526e5342112a6ddba933d34ed311aa75072ee9793307b24702c8ec9b16f21eaa3ec39926c136a4c742cb4d4d0ab37"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000001300)=ANY=[@ANYBLOB="2f9257b645c7933adf2f027be51f7caf980b85a0ff3bb0c1b46b60f113bac6b6d7c28fb0241d056c2e561f582d2c8aa4b7323ad0c36485517f9a19fde874c51c3154e6539ff962702be28e6111620c3a6444434a155661d3375a6b13a1a1a3589e7bfdee9a32554801a5100fcf"], 0x0, 0x0, 0x0}) 01:07:18 executing program 3: ioctl$SNDRV_CTL_IOCTL_ELEM_READ(0xffffffffffffffff, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7]}) [ 1437.426051][T16551] binder: 16547:16551 unknown command 28 01:07:18 executing program 2: socketpair(0x22, 0x0, 0x3e01, &(0x7f0000000100)) 01:07:18 executing program 4: socketpair(0x2c, 0x0, 0x153, &(0x7f0000000100)) [ 1437.469160][T16551] binder: 16547:16551 ioctl c0306201 20000100 returned -22 [ 1437.502731][T16556] binder: 16554:16556 unknown command -1235774929 01:07:18 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1]}) [ 1437.534098][T16556] binder: 16554:16556 ioctl c0306201 20000100 returned -22 01:07:18 executing program 0: ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f00000000c0)={0x0, 0x0, 0xffffffffffffffff, 0x9, 0x80000}) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) sendmsg$AUDIT_USER_TTY(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000300)={&(0x7f0000000200)={0xcc, 0x464, 0x8, 0x70bd26, 0x25dfdbff, "ac1a2ff48efe57c9360691403296ed54a9f7e41f37c605bd2539aa21c6d176a4f345e5dfb5b0eb54f6dba4666586a9b2746910ec6d94e0798949c904b1088576aa96e7ea68ce9ef1a42d256da23f6f9db6a1804caec3b791d9ab3b5b24b994494c216f3110504057e77664470c85a049a366364e6a527faf3a6040267fbf255e8261baa82cb3226e7743deffd551a8b51da0dcbbc969698421aef06dfd4049b4b0f39af244e89193b26a21e11e4c47419f73eb5fb61550e04fde", ["", ""]}, 0xcc}}, 0x40800) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x0, 0x0}) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_SET_OPTION(r1, &(0x7f0000000080)={0xe, 0x18, 0xfa00, @id_afonly={&(0x7f0000000140)=0x1}}, 0xfffffffffffffdd4) 01:07:18 executing program 3: ioctl$SNDRV_CTL_IOCTL_ELEM_READ(0xffffffffffffffff, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7]}) [ 1437.584317][T16562] binder: 16554:16562 unknown command -1235774929 [ 1437.609430][T16562] binder: 16554:16562 ioctl c0306201 20000100 returned -22 01:07:18 executing program 2: socketpair(0x22, 0x0, 0x3f00, &(0x7f0000000100)) 01:07:18 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="1786773d36893cac10c00efd5855d1caed825476fe10d74e17a6c627f0498eb94766a10000000000000000c9afb8ff4b81b1b2e13e791334a531af450e93d9eb7f0bbea7287e1c69e5bd3623ce7cc6483c832ed1db24bc1418378fb5506cc8d028fd89f6b925315ed990564074067772020a498a6bd6b4a674ee87984e2b269d7133cd0b084ce40926f0f66e4365060000000a1c8ec97a794cfb83ef1bb06928af15fe0c7b08757ebd288f147f1e25cba039f415786f8c2b3ac432d13a720bb1b7096bd249344486cf092367a829e062623fa25a6fb979146cf2050df1178df19e74b05661d03cac2ae041d0a22ede779bc2113e58548f799931c5f94851c4eb201fe9338598d6020870d3ee0586275de3790d7b20223c3884c775d54230fa5a262f02b248cec87a6838d42fbf1eb84c8a"], 0x0, 0x0, 0x0}) syz_genetlink_get_family_id$smc(&(0x7f00000006c0)='SMC_PNETID\x00', 0xffffffffffffffff) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r1, 0x8000000) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r1, 0x89f8, &(0x7f0000000140)={'ip6gre0\x00', &(0x7f0000000080)={'ip6gre0\x00', 0x0, 0x4, 0xed, 0x2, 0x0, 0x0, @ipv4={[], [], @remote}, @dev={0xfe, 0x80, [], 0x40}, 0x10, 0x8000, 0x401, 0x40}}) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r2, 0x8000000) r3 = openat$ocfs2_control(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ocfs2_control\x00', 0x400, 0x0) ioctl$sock_bt_hidp_HIDPCONNADD(r2, 0x400448c8, &(0x7f0000000600)={r3, r1, 0x7, 0xea, &(0x7f0000000500)="a6b71da1922800f9862f481886d640bba83b146572621d660f5e6387b0ca2151f4c8700ec3fb9be26ac114d161e7dcf26587d631d20717d33a186a4f67cf6ecf9fd459a4b69f2d099b56024f0eb4208e7f4221ca5e26f4a66be493559a7e3d0f66df942c412ad62dcaa71a23e74f1a367698bccda56c065cc87c42cbf50dc52930e891e0cdbc004108541456a5a3a922559e48ab4e3c58f595a279afc9c9107ffd2a3216feed1a8e4c0ea94814317e84a2245fa9d065e19c8538384245e0ea8b21c98911ecbf1a54a92605a301a0312499e1b3c13b180ea36787ea1d957478197c54da227f4517b955be", 0x0, 0x7, 0x0, 0x2, 0x200, 0x3, 0x5e000000, 'syz0\x00'}) r4 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000700)='/proc/sys/net/ipv4/vs/expire_quiescent_template\x00', 0x2, 0x0) io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000740)=r4, 0x1) write$RDMA_USER_CM_CMD_QUERY_ROUTE(0xffffffffffffffff, &(0x7f0000000040)={0x5, 0x10, 0xfa00, {&(0x7f00000001c0), 0xffffffffffffffff, 0x2}}, 0x18) r5 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r5, 0x8000000) ioctl$vim2m_VIDIOC_QUERYBUF(0xffffffffffffffff, 0xc0585609, &(0x7f0000000780)={0xffff, 0x1, 0x4, 0x20, 0x0, {}, {0x2, 0x2, 0x0, 0x3, 0x7, 0xd2, "a08bb1c6"}, 0x1f, 0x21d4fc92c97cf4d8, @fd=r5, 0x7, 0x0, r3}) 01:07:18 executing program 4: socketpair(0x2c, 0x0, 0x154, &(0x7f0000000100)) [ 1437.682207][T16568] binder: 16567:16568 unknown command 28 [ 1437.709386][T16568] binder: 16567:16568 ioctl c0306201 20000100 returned -22 01:07:18 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69]}) 01:07:18 executing program 0: ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f00000000c0)={0x0, 0x0, 0xffffffffffffffff, 0x9, 0x80000}) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) sendmsg$AUDIT_USER_TTY(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000300)={&(0x7f0000000200)={0xcc, 0x464, 0x8, 0x70bd26, 0x25dfdbff, "ac1a2ff48efe57c9360691403296ed54a9f7e41f37c605bd2539aa21c6d176a4f345e5dfb5b0eb54f6dba4666586a9b2746910ec6d94e0798949c904b1088576aa96e7ea68ce9ef1a42d256da23f6f9db6a1804caec3b791d9ab3b5b24b994494c216f3110504057e77664470c85a049a366364e6a527faf3a6040267fbf255e8261baa82cb3226e7743deffd551a8b51da0dcbbc969698421aef06dfd4049b4b0f39af244e89193b26a21e11e4c47419f73eb5fb61550e04fde", ["", ""]}, 0xcc}}, 0x40800) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x0, 0x0}) write$RDMA_USER_CM_CMD_SET_OPTION(0xffffffffffffffff, &(0x7f0000000080)={0xe, 0x18, 0xfa00, @id_afonly={&(0x7f0000000140)=0x1}}, 0xfffffffffffffdd4) 01:07:18 executing program 3: r0 = syz_open_dev$sndctrl(0x0, 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7]}) 01:07:18 executing program 2: socketpair(0x22, 0x0, 0x3f01, &(0x7f0000000100)) [ 1437.844819][T16577] binder: 16575:16577 unknown command 1031243287 01:07:19 executing program 4: socketpair(0x2c, 0x0, 0x155, &(0x7f0000000100)) 01:07:19 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4]}) [ 1437.885811][T16577] binder: 16575:16577 ioctl c0306201 20000100 returned -22 [ 1437.949141][T16577] binder: 16575:16577 unknown command 1031243287 [ 1437.951826][T16584] binder: 16581:16584 unknown command 28 [ 1437.978654][T16577] binder: 16575:16577 ioctl c0306201 20000100 returned -22 [ 1437.989223][T16584] binder: 16581:16584 ioctl c0306201 20000100 returned -22 01:07:19 executing program 3: r0 = syz_open_dev$sndctrl(0x0, 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7]}) 01:07:19 executing program 2: socketpair(0x22, 0x0, 0x4000, &(0x7f0000000100)) 01:07:19 executing program 4: socketpair(0x2c, 0x0, 0x156, &(0x7f0000000100)) 01:07:19 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB='\\'], 0x0, 0x0, 0x0}) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r1, 0x8000000) setsockopt$bt_BT_SNDMTU(r1, 0x112, 0xc, &(0x7f0000000040)=0x98b, 0x2) sendmsg$AUDIT_GET(r1, &(0x7f0000000140)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x10, 0x3e8, 0x800, 0x70bd23, 0x25dfdbfc, "", ["", "", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x20000050}, 0x880) 01:07:19 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7]}) 01:07:19 executing program 0: ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f00000000c0)={0x0, 0x0, 0xffffffffffffffff, 0x9, 0x80000}) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) sendmsg$AUDIT_USER_TTY(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000300)={&(0x7f0000000200)={0xcc, 0x464, 0x8, 0x70bd26, 0x25dfdbff, "ac1a2ff48efe57c9360691403296ed54a9f7e41f37c605bd2539aa21c6d176a4f345e5dfb5b0eb54f6dba4666586a9b2746910ec6d94e0798949c904b1088576aa96e7ea68ce9ef1a42d256da23f6f9db6a1804caec3b791d9ab3b5b24b994494c216f3110504057e77664470c85a049a366364e6a527faf3a6040267fbf255e8261baa82cb3226e7743deffd551a8b51da0dcbbc969698421aef06dfd4049b4b0f39af244e89193b26a21e11e4c47419f73eb5fb61550e04fde", ["", ""]}, 0xcc}}, 0x40800) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x0, 0x0}) write$RDMA_USER_CM_CMD_SET_OPTION(0xffffffffffffffff, &(0x7f0000000080)={0xe, 0x18, 0xfa00, @id_afonly={&(0x7f0000000140)=0x1}}, 0xfffffffffffffdd4) 01:07:19 executing program 3: r0 = syz_open_dev$sndctrl(0x0, 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7]}) 01:07:19 executing program 2: socketpair(0x22, 0x0, 0x4001, &(0x7f0000000100)) [ 1438.205147][T16600] binder: 16598:16600 unknown command 92 [ 1438.228581][T16600] binder: 16598:16600 ioctl c0306201 20000100 returned -22 [ 1438.241094][T16604] binder: 16602:16604 unknown command 28 01:07:19 executing program 4: socketpair(0x2c, 0x0, 0x157, &(0x7f0000000100)) [ 1438.257680][T16604] binder: 16602:16604 ioctl c0306201 20000100 returned -22 [ 1438.284290][T16600] binder: 16598:16600 unknown command 92 01:07:19 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}}) [ 1438.317747][T16600] binder: 16598:16600 ioctl c0306201 20000100 returned -22 01:07:19 executing program 0: ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f00000000c0)={0x0, 0x0, 0xffffffffffffffff, 0x9, 0x80000}) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) sendmsg$AUDIT_USER_TTY(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000300)={&(0x7f0000000200)={0xcc, 0x464, 0x8, 0x70bd26, 0x25dfdbff, "ac1a2ff48efe57c9360691403296ed54a9f7e41f37c605bd2539aa21c6d176a4f345e5dfb5b0eb54f6dba4666586a9b2746910ec6d94e0798949c904b1088576aa96e7ea68ce9ef1a42d256da23f6f9db6a1804caec3b791d9ab3b5b24b994494c216f3110504057e77664470c85a049a366364e6a527faf3a6040267fbf255e8261baa82cb3226e7743deffd551a8b51da0dcbbc969698421aef06dfd4049b4b0f39af244e89193b26a21e11e4c47419f73eb5fb61550e04fde", ["", ""]}, 0xcc}}, 0x40800) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x0, 0x0}) write$RDMA_USER_CM_CMD_SET_OPTION(0xffffffffffffffff, &(0x7f0000000080)={0xe, 0x18, 0xfa00, @id_afonly={&(0x7f0000000140)=0x1}}, 0xfffffffffffffdd4) 01:07:19 executing program 3: syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(0xffffffffffffffff, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7]}) 01:07:19 executing program 2: socketpair(0x22, 0x0, 0x4100, &(0x7f0000000100)) 01:07:19 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000000c0)=0x14) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000040)=ANY=[@ANYRESHEX=r0], 0x0, 0x0, 0x0}) 01:07:19 executing program 4: socketpair(0x2c, 0x0, 0x158, &(0x7f0000000100)) [ 1438.486751][T16618] binder: 16614:16618 unknown command 28 [ 1438.515658][T16618] binder: 16614:16618 ioctl c0306201 20000100 returned -22 01:07:19 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB='\\'], 0x0, 0x0, 0x0}) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r1, 0x8000000) setsockopt$bt_BT_SNDMTU(r1, 0x112, 0xc, &(0x7f0000000040)=0x98b, 0x2) sendmsg$AUDIT_GET(r1, &(0x7f0000000140)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x10, 0x3e8, 0x800, 0x70bd23, 0x25dfdbfc, "", ["", "", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x20000050}, 0x880) 01:07:19 executing program 3: syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(0xffffffffffffffff, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7]}) 01:07:19 executing program 2: socketpair(0x22, 0x0, 0x4101, &(0x7f0000000100)) [ 1438.541163][T16622] binder: 16620:16622 unknown command 808482864 [ 1438.572876][T16622] binder: 16620:16622 ioctl c0306201 20000100 returned -22 01:07:19 executing program 0: ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f00000000c0)={0x0, 0x0, 0xffffffffffffffff, 0x9, 0x80000}) syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) sendmsg$AUDIT_USER_TTY(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000300)={&(0x7f0000000200)={0xcc, 0x464, 0x8, 0x70bd26, 0x25dfdbff, "ac1a2ff48efe57c9360691403296ed54a9f7e41f37c605bd2539aa21c6d176a4f345e5dfb5b0eb54f6dba4666586a9b2746910ec6d94e0798949c904b1088576aa96e7ea68ce9ef1a42d256da23f6f9db6a1804caec3b791d9ab3b5b24b994494c216f3110504057e77664470c85a049a366364e6a527faf3a6040267fbf255e8261baa82cb3226e7743deffd551a8b51da0dcbbc969698421aef06dfd4049b4b0f39af244e89193b26a21e11e4c47419f73eb5fb61550e04fde", ["", ""]}, 0xcc}}, 0x40800) r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000080)={0xe, 0x18, 0xfa00, @id_afonly={&(0x7f0000000140)=0x1}}, 0xfffffffffffffdd4) 01:07:19 executing program 4: socketpair(0x2c, 0x0, 0x159, &(0x7f0000000100)) [ 1438.641277][T16627] binder: 16620:16627 unknown command 808482864 [ 1438.664789][T16627] binder: 16620:16627 ioctl c0306201 20000100 returned -22 [ 1438.694525][T16630] binder: 16626:16630 unknown command 92 [ 1438.716608][T16630] binder: 16626:16630 ioctl c0306201 20000100 returned -22 01:07:19 executing program 2: socketpair(0x22, 0x0, 0x4200, &(0x7f0000000100)) 01:07:19 executing program 1: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r0, 0xc0502100, &(0x7f0000000580)={0x0, 0x0}) syz_open_procfs(r1, &(0x7f00000000c0)='smaps_rollup\x00') mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r0, 0x8000000) ioctl$IOCTL_VMCI_DATAGRAM_SEND(r0, 0x7ab, &(0x7f0000000080)={&(0x7f0000000140)={{@my=0x0, 0x6}, {@any, 0x1}, 0x400, "2c2107474f2a6657fb49fb89893294a9257684cdcc1ab5bbbeb81dc7a1f7e400ab68abbf1370d6463d75111dd809d8161e04f3fe8d86a135b4cb6150bbb6b82617d6adbb0606bff1fc665091bbae567ecd112ecabd864b961a39747b0efd17a45b4c9c2faa27ae2cdd92fbf363c9367737ffc57fda875cf4ba57ae39b4b27650af4809bd36cac7ee44274499fdbb6d928f084a101b48898240502224e39ed728eb58d6227ef698dff223f3e139788ca85905520a5f56930a8754bfff50496951e5452beeecf7df6ddbcf1a76c2959c3085fea703630b18c455b3765b63afa564054ca96f2541d7b661f06cffc41a2710f95007990dcef1859a23db62890f07c2edbe65908a0038bad03f111ddf1288882802f0b16be30e194698693d65653872e7d186f123c4396666ba5694780df32fb4aa55054b753e9c58855f10fe0bc4198df51b505bead68a956e5b062f3d42ae45f69ad817fb6666498c3b3a19a7f6fd93c8451845f7ce2413b8412968646c789ff4756bfb711b20b480e03e6026234eb9b41b1be95fffe894d3af1033efd77a1f5119453e6dc7dcf50c346de2f815178d7e5054503739da65543aadccab9b21bc4c2fc60f3e1b14a6a55541bdd7d20d6ee6112efbb2bfe77c78dc41cb1f2d69d6e655db09355961a766fa50ecdf7b597747975951fb931aca5a39f350d428622401dc355a180e48cf08883415c6c1aa6563cf68c9c67ff10a2bb9859ee510f8184dc6d2d2570273c3a2b02ee29090810aa7cedfaa0541817857bf99e1c263570db73729453ae3b1433e1e68a60ed1bfa4ef68c556ed8b1ddce124fbbe8bb061432d96ce2c809c122fc080c31f81186fcf4c3dea027d5261af4515c56cae501b7317961232fab28ddc3080e3214c6517e04bb389dbd1b85895c59db947393d4253adb2a9a18b94b4b4f5236ac6eb16ee50cc0c1f4bfe5ec343469def1c3977e329bc490eda9bcd5413dacf49abe34ff76d597bdaeebe6af9a6a298b80af44f090c3366ebb658a6793e2ab191f34270ddb2dfa38ca6d1239e88ecfff80b5a720a62c158b3a2db7ed46aec7f1c9228fc14bbfb235a2cf3f7016cc2e9c2ada26e1bb0b86e2ebe5cd10745c92a09cf0736f53e443bb2cab1c5dd43de1872c37ec0157fb2aa31ebc3c99635efb22348862669a3b6275d6a1cf145a2af3de282cd1fca10ab89759447732540b843ae0ac64e9e20a9bd20ce643b6c5141dd60d6a8094171c0fda9ce119698fa19827b2aa42038edfa09bad66b60194833c5f8f0147c19c23550fffe1a6e10def5d69cc50c53ca386efd0e9478162a2210fc53a8089a5be4eba4231bb264a84f7e80b79612360aab6fd48e06a9c0e10c550338ae175beeebe2c4764c09de1f7987e0f9df2e4308be284e504bb6413a4dee3ae581cabc8f2ecc25e1f96dad19abbc5ae2f0207100"}, 0x418, 0x53d}) r2 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="1cda35faced26a535ea00d510c62718d971f16e53050e3b4de73b46cb0"], 0x0, 0x0, 0x0}) 01:07:19 executing program 3: syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(0xffffffffffffffff, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7]}) 01:07:19 executing program 5: ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f00000000c0)={0x0, 0x0, 0xffffffffffffffff, 0x9, 0x80000}) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) sendmsg$AUDIT_USER_TTY(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000300)={&(0x7f0000000200)={0xcc, 0x464, 0x8, 0x70bd26, 0x25dfdbff, "ac1a2ff48efe57c9360691403296ed54a9f7e41f37c605bd2539aa21c6d176a4f345e5dfb5b0eb54f6dba4666586a9b2746910ec6d94e0798949c904b1088576aa96e7ea68ce9ef1a42d256da23f6f9db6a1804caec3b791d9ab3b5b24b994494c216f3110504057e77664470c85a049a366364e6a527faf3a6040267fbf255e8261baa82cb3226e7743deffd551a8b51da0dcbbc969698421aef06dfd4049b4b0f39af244e89193b26a21e11e4c47419f73eb5fb61550e04fde", ["", ""]}, 0xcc}}, 0x40800) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x0, 0x0}) write$RDMA_USER_CM_CMD_SET_OPTION(0xffffffffffffffff, &(0x7f0000000080)={0xe, 0x18, 0xfa00, @id_afonly={&(0x7f0000000140)=0x1}}, 0xfffffffffffffdd4) 01:07:20 executing program 0: ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f00000000c0)={0x0, 0x0, 0xffffffffffffffff, 0x9, 0x80000}) syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000080)={0xe, 0x18, 0xfa00, @id_afonly={&(0x7f0000000140)=0x1}}, 0xfffffffffffffdd4) 01:07:20 executing program 4: socketpair(0x2c, 0x0, 0x15a, &(0x7f0000000100)) [ 1438.915355][T16642] binder: 16639:16642 unknown command -97134052 [ 1438.938826][T16647] binder: 16644:16647 unknown command 28 [ 1438.945299][T16642] binder: 16639:16642 ioctl c0306201 20000100 returned -22 01:07:20 executing program 2: socketpair(0x22, 0x0, 0x4201, &(0x7f0000000100)) 01:07:20 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, 0x0) [ 1438.960677][T16647] binder: 16644:16647 ioctl c0306201 20000100 returned -22 01:07:20 executing program 4: socketpair(0x2c, 0x0, 0x15b, &(0x7f0000000100)) 01:07:20 executing program 0: ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f00000000c0)={0x0, 0x0, 0xffffffffffffffff, 0x9, 0x80000}) r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000080)={0xe, 0x18, 0xfa00, @id_afonly={&(0x7f0000000140)=0x1}}, 0xfffffffffffffdd4) 01:07:20 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d]}) [ 1439.007907][T16650] binder: 16639:16650 unknown command -97134052 [ 1439.039079][T16650] binder: 16639:16650 ioctl c0306201 20000100 returned -22 01:07:20 executing program 2: socketpair(0x22, 0x0, 0x4300, &(0x7f0000000100)) 01:07:20 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x1800) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xfffffffffffffe6f, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="ace5174128321c7097b571d1f0dbe06a6c67ffff01d09742895172af0a9160c79b04993c1ec231b80c5c3aec70df5831f15f49ac76ee1b68039bbcd2491e39268cc1f144b82fc9bef9ef452f1724b713dbc5b0f10340ae403f7a0d9ce989bc1168ad9ec287f7827831c4ab5348b3fe389ada24ed7e20c5160bc39a5a0e010000000000000051fdaa2799464136b1fb5c75138e3fb5ef0c8fca9ddc87c702aac3de02e92aa5cba3b838050e2d70e06e9086201ba32bfc5872e9d180d0d7862939012df2728a9f6abab5154069bcb3063485e6a906b37f6669f10a8d062cc4020a6af39df8005ecf230000000000"], 0x0, 0x0, 0x0}) syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) 01:07:20 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, 0x0) 01:07:20 executing program 0: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000080)={0xe, 0x18, 0xfa00, @id_afonly={&(0x7f0000000140)=0x1}}, 0xfffffffffffffdd4) 01:07:20 executing program 4: socketpair(0x2c, 0x0, 0x15c, &(0x7f0000000100)) 01:07:20 executing program 2: socketpair(0x22, 0x0, 0x4301, &(0x7f0000000100)) 01:07:20 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, 0x0) 01:07:20 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="1c60b8f85403c14571b31734c9f42909f012601a33c4246e57b426275bd1c4d3ed105db48a8d8f7cee1cbb53a275aee68e09c172607c0b219487de8711a4f561e92506ee50f35b9ba051722c0a5ad8ed92ca6c816a53aaf3590c2dc77316e7d9bfd28f9f0a480c9636e1a5d56cd3af6320d099f707d1a64eeb39e7f363b2abbbc3e0e5dda427dd0071401845171bdbfe74bb4567dd67c9addef687f211ecf2ea28ca4d79b34b47f5c9dfd51dfc8db41040c77af113908e28e76c438deb0d21361d6d318cf5f10007435951db7ba2"], 0x0, 0x0, 0x0}) 01:07:20 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, 0x0) 01:07:20 executing program 4: socketpair(0x2c, 0x0, 0x15d, &(0x7f0000000100)) 01:07:20 executing program 0: r0 = openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000080)={0xe, 0x18, 0xfa00, @id_afonly={&(0x7f0000000140)=0x1}}, 0xfffffffffffffdd4) 01:07:20 executing program 2: socketpair(0x22, 0x0, 0x4400, &(0x7f0000000100)) 01:07:20 executing program 5: socketpair(0x2c, 0x0, 0x15c, &(0x7f0000000100)) [ 1439.478242][T16680] binder: 16678:16680 unknown command -122134500 [ 1439.507568][T16680] binder: 16678:16680 ioctl c0306201 20000100 returned -22 01:07:20 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4]}) 01:07:20 executing program 0: r0 = openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000080)={0xe, 0x18, 0xfa00, @id_afonly={&(0x7f0000000140)=0x1}}, 0xfffffffffffffdd4) 01:07:20 executing program 4: socketpair(0x2c, 0x0, 0x15e, &(0x7f0000000100)) 01:07:20 executing program 1: write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000040), 0x111}}, 0x20) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x0, 0x0}) 01:07:20 executing program 2: socketpair(0x22, 0x0, 0x4401, &(0x7f0000000100)) 01:07:20 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7]}) 01:07:20 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000]}) [ 1439.728270][T16695] binder: 16692:16695 unknown command 28 [ 1439.742504][T16695] binder: 16692:16695 ioctl c0306201 20000100 returned -22 01:07:20 executing program 0: r0 = openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000080)={0xe, 0x18, 0xfa00, @id_afonly={&(0x7f0000000140)=0x1}}, 0xfffffffffffffdd4) 01:07:20 executing program 2: socketpair(0x22, 0x0, 0x4500, &(0x7f0000000100)) [ 1439.783120][T16700] binder: 16692:16700 unknown command 28 [ 1439.817469][T16700] binder: 16692:16700 ioctl c0306201 20000100 returned -22 01:07:20 executing program 4: socketpair(0x2c, 0x0, 0x15f, &(0x7f0000000100)) 01:07:21 executing program 5: socketpair(0x2c, 0x0, 0x15e, &(0x7f0000000100)) 01:07:21 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000]}) 01:07:21 executing program 0: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_SET_OPTION(0xffffffffffffffff, &(0x7f0000000080)={0xe, 0x18, 0xfa00, @id_afonly={&(0x7f0000000140)=0x1}}, 0xfffffffffffffdd4) 01:07:21 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x804) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB='xM'], 0x0, 0x0, 0x0}) 01:07:21 executing program 2: socketpair(0x22, 0x0, 0x4501, &(0x7f0000000100)) 01:07:21 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_RX_RING(r1, 0x11b, 0x2, &(0x7f0000001e40)=0x100080, 0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="6f1561824f6cbf7dcc740427783beffa270fecc6fd900488e5efcfdef1649a0214e2604319f23fd7fa8966850a9a52ea28364cda0f59c783a599cd7efa5648d5a9b5ebbec0a02001c506341d064c129ff660eaf19b3ea6eac1822498eb988c6532e9f484bfee79d1a5cd6cfa13cc1eb2faf1e591ec3777a49a58b6a2435f4ab920d5ad37d8f55829c81b52c648b0b3dcf05bdd0440298dc633d979d1"], 0x0, 0x0, 0x0}) 01:07:21 executing program 4: socketpair(0x2c, 0x0, 0x160, &(0x7f0000000100)) [ 1440.042244][T16716] binder: 16714:16716 unknown command 19832 [ 1440.061974][T16716] binder: 16714:16716 ioctl c0306201 20000100 returned -22 01:07:21 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8]}) 01:07:21 executing program 0: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_SET_OPTION(0xffffffffffffffff, &(0x7f0000000080)={0xe, 0x18, 0xfa00, @id_afonly={&(0x7f0000000140)=0x1}}, 0xfffffffffffffdd4) 01:07:21 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="6c81a6af01a16cba564e75f862eb6ac61c709a6006ca96c3c8754876d4cd544faac6e47fc56cb28f838d2dee04388f468c8cbd50e18e8981664a5d908e07c156d1c9f277f6f2fae80f6482a42a85d8cbdc0bc3dae857d0b395ebbfa6247c744d0110281986260d0186a48d83a7d5532ac5a38e95b97d9a55b9f259134697a7dac081f52d9828c255e6d71350e2bd318b7db378f1eec9befd1feca469023df555ad508f305b95664f6cd934cfbebd33850c77c56b"], 0x0, 0x0, 0x0}) 01:07:21 executing program 2: socketpair(0x22, 0x0, 0x4600, &(0x7f0000000100)) [ 1440.171086][T16722] binder: 16719:16722 unknown command -2107566737 [ 1440.187976][T16722] binder: 16719:16722 ioctl c0306201 20000100 returned -22 01:07:21 executing program 4: socketpair(0x2c, 0x0, 0x161, &(0x7f0000000100)) 01:07:21 executing program 0: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_SET_OPTION(0xffffffffffffffff, &(0x7f0000000080)={0xe, 0x18, 0xfa00, @id_afonly={&(0x7f0000000140)=0x1}}, 0xfffffffffffffdd4) 01:07:21 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, 0x0) 01:07:21 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5]}) [ 1440.262380][T16728] binder: 16727:16728 unknown command -1348042388 [ 1440.288215][T16728] binder: 16727:16728 ioctl c0306201 20000100 returned -22 01:07:21 executing program 2: socketpair(0x22, 0x0, 0x4601, &(0x7f0000000100)) 01:07:21 executing program 0: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_SET_OPTION(r0, 0x0, 0x0) 01:07:21 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) setsockopt$bt_BT_POWER(0xffffffffffffffff, 0x112, 0x9, &(0x7f0000000040)=0xc2, 0x1) socket$nl_generic(0x10, 0x3, 0x10) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x0, 0x0}) 01:07:21 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff]}) 01:07:21 executing program 4: socketpair(0x2c, 0x0, 0x162, &(0x7f0000000100)) 01:07:21 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, 0x0) 01:07:21 executing program 2: socketpair(0x22, 0x0, 0x4700, &(0x7f0000000100)) 01:07:21 executing program 0: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_SET_OPTION(r0, 0x0, 0x0) [ 1440.533650][T16745] binder: 16742:16745 unknown command 28 [ 1440.563026][T16745] binder: 16742:16745 ioctl c0306201 20000100 returned -22 01:07:21 executing program 4: socketpair(0x2c, 0x0, 0x163, &(0x7f0000000100)) 01:07:21 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d]}) 01:07:21 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = openat$ocfs2_control(0xffffffffffffff9c, &(0x7f0000000280)='/dev/ocfs2_control\x00', 0x202, 0x0) getsockopt$bt_BT_RCVMTU(r1, 0x112, 0xd, &(0x7f00000002c0)=0x7f, &(0x7f0000000300)=0x2) pipe(&(0x7f00000000c0)={0xffffffffffffffff}) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_INFO(r2, 0xc10c5541, &(0x7f0000000140)={0x101, 0x4}) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r3, 0x8000000) ioctl$sock_bt_bnep_BNEPGETSUPPFEAT(r3, 0x800442d4, &(0x7f0000000340)=0x80000000) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="adc4867c7ef05c553376ad17549293d2e3515b381cb985e34dff1e7accbe52bf1ff9e52663b846b593010e7712067abf7570d6c79913657382995b616d9968d05a62e14466838f18cb378de787e489189ff0ee6fd7cdccc348b29c45b95eb6a15def2a6e5d3d5a4451913df1"], 0x0, 0x0, 0x0}) 01:07:21 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, 0x0) 01:07:21 executing program 0: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_SET_OPTION(r0, 0x0, 0x0) 01:07:21 executing program 2: socketpair(0x22, 0x0, 0x4701, &(0x7f0000000100)) [ 1440.802465][T16762] binder: 16757:16762 unknown command 2089206957 01:07:21 executing program 4: socketpair(0x2c, 0x0, 0x164, &(0x7f0000000100)) [ 1440.844527][T16762] binder: 16757:16762 ioctl c0306201 20000100 returned -22 [ 1440.884656][T16767] binder: 16757:16767 unknown command 2089206957 01:07:22 executing program 5: ioctl$SNDRV_CTL_IOCTL_ELEM_READ(0xffffffffffffffff, 0xc4c85512, 0x0) 01:07:22 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4]}) [ 1440.897549][T16767] binder: 16757:16767 ioctl c0306201 20000100 returned -22 01:07:22 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x12, 0x0, 0x0}) 01:07:22 executing program 0: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000080)={0xe, 0x18, 0xfa00, @id_afonly={0x0}}, 0x20) 01:07:22 executing program 4: socketpair(0x2c, 0x0, 0x165, &(0x7f0000000100)) 01:07:22 executing program 2: socketpair(0x22, 0x0, 0x4800, &(0x7f0000000100)) 01:07:22 executing program 5: ioctl$SNDRV_CTL_IOCTL_ELEM_READ(0xffffffffffffffff, 0xc4c85512, 0x0) 01:07:22 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000]}) [ 1441.095928][T16781] binder: 16776:16781 unknown command 28 [ 1441.128644][T16781] binder: 16776:16781 ioctl c0306201 20000080 returned -22 01:07:22 executing program 0: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000080)={0xe, 0x18, 0xfa00, @id_afonly={0x0}}, 0x20) 01:07:22 executing program 4: socketpair(0x2c, 0x0, 0x166, &(0x7f0000000100)) 01:07:22 executing program 2: socketpair(0x22, 0x0, 0x4801, &(0x7f0000000100)) 01:07:22 executing program 5: ioctl$SNDRV_CTL_IOCTL_ELEM_READ(0xffffffffffffffff, 0xc4c85512, 0x0) 01:07:22 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r1, 0x8000000) sendmsg$AUDIT_DEL_RULE(r1, &(0x7f0000000800)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f00000007c0)={&(0x7f0000000380)={0x43c, 0x3f4, 0x200, 0x70bd2d, 0x25dfdbfb, {0x0, 0x0, 0x1d, [0x5, 0x0, 0x3, 0xfff, 0x6, 0xffffff01, 0x2, 0x6, 0x1, 0x0, 0x9, 0x200, 0x4, 0x5, 0x9aa, 0x800, 0x2, 0x8, 0x11, 0xfffffff9, 0x38000, 0xffffff7f, 0x7, 0x100, 0x1, 0x39, 0x5000000, 0x1, 0x4, 0x4, 0x1, 0x1, 0x1000, 0x8, 0x5, 0x0, 0x7cbeb366, 0x4, 0x4, 0x10001, 0x4, 0x7fff, 0xfffffff8, 0x81, 0x800, 0x7fff, 0x5f, 0xfffffff9, 0x7, 0x80, 0x2, 0x7, 0x4, 0x4, 0x8, 0x0, 0x7f, 0x3, 0x0, 0x4, 0x6, 0x4, 0x8], [0x3, 0x3, 0x0, 0xffffd1e9, 0x4, 0x3ad, 0x80, 0x3f, 0x0, 0x1000, 0x2, 0x7db9fea2, 0x5, 0x8001, 0x3f, 0x20, 0x6, 0x7ff, 0x3, 0x20, 0x113, 0x5, 0x51, 0x7ff, 0x3, 0x1000, 0x1, 0x4b6, 0x4d7, 0x0, 0x781b, 0x3, 0x3, 0x1, 0x2, 0x80000000, 0x7, 0x1000, 0x6, 0xfff, 0x54, 0xaf, 0x80000001, 0xffff8001, 0x5, 0x5, 0x200, 0xb33, 0x400, 0x4, 0x1ff, 0x8c23, 0x3, 0x401, 0x9d, 0x7, 0x232d, 0x101, 0x1, 0x20, 0x1, 0x2, 0x1, 0x9], [0x401, 0x9, 0x5, 0xffff1f89, 0x7b, 0x7fffffff, 0x6d56048a, 0x4, 0x6, 0x5, 0x7, 0x4736, 0x0, 0x9, 0x561, 0x400, 0x8, 0x5, 0x4, 0x0, 0xffff8001, 0x3, 0xfffffffe, 0x2, 0x7, 0x800, 0x401, 0x2, 0x9, 0x8, 0x8001, 0x6, 0x4, 0x5, 0x8, 0xe7, 0xfffff000, 0x9, 0x4, 0x200, 0x1, 0x0, 0x1, 0x9, 0xffffff7f, 0xd6, 0x8, 0xff, 0x6, 0x0, 0x2, 0x7, 0x199, 0x400, 0x0, 0xa7, 0x101, 0x5, 0xd9a7, 0x1, 0x3ff, 0x5, 0x6, 0x8], [0x40, 0x2, 0x5, 0x5, 0x80000000, 0x7a, 0x4d, 0xebb, 0x8, 0x6, 0x0, 0xb3f, 0x7ff, 0x10001, 0xdda0, 0x0, 0x12, 0x9, 0x3, 0x5, 0x8001, 0x400, 0x80000000, 0x0, 0xfff, 0xfffffffe, 0x5, 0x2843, 0x20, 0x3, 0x2f9, 0x7, 0x9, 0xffffffff, 0x7fff, 0xfffffffb, 0x1, 0x80, 0x7, 0x4, 0x101, 0x4, 0x2, 0xc7c, 0x2, 0x1, 0x1, 0x10000, 0x6, 0xff, 0x0, 0x0, 0x691b, 0x9, 0x4, 0x3f, 0x0, 0x7, 0x2, 0x6, 0xfffffffd, 0x72de, 0x927, 0x1], 0x1c, ['\x00', '\x00', '/dev/binder#\x00', '/dev/binder#\x00']}, ["", "", "", "", "", ""]}, 0x43c}, 0x1, 0x0, 0x0, 0x40d0}, 0x800) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r2, 0x8000000) sendmsg$AUDIT_MAKE_EQUIV(r2, &(0x7f0000000300)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x602080}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x28, 0x3f7, 0x100, 0x70bd26, 0x25dfdbfe, {0x7, 0x7, './file0', './file0'}, ["", "", ""]}, 0x28}, 0x1, 0x0, 0x0, 0x4044000}, 0x50) io_uring_register$IORING_REGISTER_EVENTFD(r1, 0x4, &(0x7f0000000840)=r2, 0x1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB='\x00'], 0x0, 0x0, 0x0}) r3 = syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x8, 0x101000) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_INFO(r3, 0xc10c5541, &(0x7f00000001c0)={0x1, 0x0, 0x1}) 01:07:22 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1]}) 01:07:22 executing program 4: socketpair(0x2c, 0x0, 0x167, &(0x7f0000000100)) 01:07:22 executing program 0: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000080)={0xe, 0x18, 0xfa00, @id_afonly={0x0}}, 0x20) 01:07:22 executing program 5: r0 = syz_open_dev$sndctrl(0x0, 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, 0x0) 01:07:22 executing program 2: socketpair(0x22, 0x0, 0x4900, &(0x7f0000000100)) [ 1441.356999][T16798] binder: 16794:16798 unknown command 0 [ 1441.391712][T16798] binder: 16794:16798 ioctl c0306201 20000100 returned -22 01:07:22 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69]}) [ 1441.447996][T16801] binder: 16794:16801 unknown command 0 [ 1441.455466][T16801] binder: 16794:16801 ioctl c0306201 20000100 returned -22 01:07:22 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r1, 0x8000000) name_to_handle_at(r1, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080)={0x3f, 0x10001, "567109f4e2e3689942b838c1a0538c49d0ca5fd0ab58e47829a5e242b71969a8be0603616f93d56bbaa4eb46cfa60cde967639c78f7a98"}, &(0x7f00000000c0), 0x1400) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x0, 0x0}) 01:07:22 executing program 5: r0 = syz_open_dev$sndctrl(0x0, 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, 0x0) 01:07:22 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4]}) 01:07:22 executing program 2: socketpair(0x22, 0x0, 0x4901, &(0x7f0000000100)) 01:07:22 executing program 0: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000080)={0xe, 0x18, 0xfa00, @id_afonly={&(0x7f0000000140)}}, 0xfffffffffffffdd4) 01:07:22 executing program 4: socketpair(0x2c, 0x0, 0x168, &(0x7f0000000100)) [ 1441.665513][T16813] binder: 16812:16813 unknown command 28 [ 1441.685084][T16813] binder: 16812:16813 ioctl c0306201 20000100 returned -22 01:07:22 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7]}) 01:07:22 executing program 5: r0 = syz_open_dev$sndctrl(0x0, 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, 0x0) [ 1441.736975][T16821] binder: 16812:16821 unknown command 28 [ 1441.768128][T16821] binder: 16812:16821 ioctl c0306201 20000100 returned -22 01:07:22 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r1, 0x8000000) sendmsg$AUDIT_DEL_RULE(r1, &(0x7f0000000800)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f00000007c0)={&(0x7f0000000380)={0x43c, 0x3f4, 0x200, 0x70bd2d, 0x25dfdbfb, {0x0, 0x0, 0x1d, [0x5, 0x0, 0x3, 0xfff, 0x6, 0xffffff01, 0x2, 0x6, 0x1, 0x0, 0x9, 0x200, 0x4, 0x5, 0x9aa, 0x800, 0x2, 0x8, 0x11, 0xfffffff9, 0x38000, 0xffffff7f, 0x7, 0x100, 0x1, 0x39, 0x5000000, 0x1, 0x4, 0x4, 0x1, 0x1, 0x1000, 0x8, 0x5, 0x0, 0x7cbeb366, 0x4, 0x4, 0x10001, 0x4, 0x7fff, 0xfffffff8, 0x81, 0x800, 0x7fff, 0x5f, 0xfffffff9, 0x7, 0x80, 0x2, 0x7, 0x4, 0x4, 0x8, 0x0, 0x7f, 0x3, 0x0, 0x4, 0x6, 0x4, 0x8], [0x3, 0x3, 0x0, 0xffffd1e9, 0x4, 0x3ad, 0x80, 0x3f, 0x0, 0x1000, 0x2, 0x7db9fea2, 0x5, 0x8001, 0x3f, 0x20, 0x6, 0x7ff, 0x3, 0x20, 0x113, 0x5, 0x51, 0x7ff, 0x3, 0x1000, 0x1, 0x4b6, 0x4d7, 0x0, 0x781b, 0x3, 0x3, 0x1, 0x2, 0x80000000, 0x7, 0x1000, 0x6, 0xfff, 0x54, 0xaf, 0x80000001, 0xffff8001, 0x5, 0x5, 0x200, 0xb33, 0x400, 0x4, 0x1ff, 0x8c23, 0x3, 0x401, 0x9d, 0x7, 0x232d, 0x101, 0x1, 0x20, 0x1, 0x2, 0x1, 0x9], [0x401, 0x9, 0x5, 0xffff1f89, 0x7b, 0x7fffffff, 0x6d56048a, 0x4, 0x6, 0x5, 0x7, 0x4736, 0x0, 0x9, 0x561, 0x400, 0x8, 0x5, 0x4, 0x0, 0xffff8001, 0x3, 0xfffffffe, 0x2, 0x7, 0x800, 0x401, 0x2, 0x9, 0x8, 0x8001, 0x6, 0x4, 0x5, 0x8, 0xe7, 0xfffff000, 0x9, 0x4, 0x200, 0x1, 0x0, 0x1, 0x9, 0xffffff7f, 0xd6, 0x8, 0xff, 0x6, 0x0, 0x2, 0x7, 0x199, 0x400, 0x0, 0xa7, 0x101, 0x5, 0xd9a7, 0x1, 0x3ff, 0x5, 0x6, 0x8], [0x40, 0x2, 0x5, 0x5, 0x80000000, 0x7a, 0x4d, 0xebb, 0x8, 0x6, 0x0, 0xb3f, 0x7ff, 0x10001, 0xdda0, 0x0, 0x12, 0x9, 0x3, 0x5, 0x8001, 0x400, 0x80000000, 0x0, 0xfff, 0xfffffffe, 0x5, 0x2843, 0x20, 0x3, 0x2f9, 0x7, 0x9, 0xffffffff, 0x7fff, 0xfffffffb, 0x1, 0x80, 0x7, 0x4, 0x101, 0x4, 0x2, 0xc7c, 0x2, 0x1, 0x1, 0x10000, 0x6, 0xff, 0x0, 0x0, 0x691b, 0x9, 0x4, 0x3f, 0x0, 0x7, 0x2, 0x6, 0xfffffffd, 0x72de, 0x927, 0x1], 0x1c, ['\x00', '\x00', '/dev/binder#\x00', '/dev/binder#\x00']}, ["", "", "", "", "", ""]}, 0x43c}, 0x1, 0x0, 0x0, 0x40d0}, 0x800) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r2, 0x8000000) sendmsg$AUDIT_MAKE_EQUIV(r2, &(0x7f0000000300)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x602080}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x28, 0x3f7, 0x100, 0x70bd26, 0x25dfdbfe, {0x7, 0x7, './file0', './file0'}, ["", "", ""]}, 0x28}, 0x1, 0x0, 0x0, 0x4044000}, 0x50) io_uring_register$IORING_REGISTER_EVENTFD(r1, 0x4, &(0x7f0000000840)=r2, 0x1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB='\x00'], 0x0, 0x0, 0x0}) r3 = syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x8, 0x101000) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_INFO(r3, 0xc10c5541, &(0x7f00000001c0)={0x1, 0x0, 0x1}) 01:07:22 executing program 2: socketpair(0x22, 0x0, 0x4a00, &(0x7f0000000100)) 01:07:23 executing program 4: socketpair(0x2c, 0x0, 0x169, &(0x7f0000000100)) 01:07:23 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x0, 0x0}) r1 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_RX_RING(r1, 0x11b, 0x2, &(0x7f0000001e40)=0x100080, 0x4) ioctl$sock_ifreq(r1, 0x8916, &(0x7f0000000040)={'ip6tnl0\x00', @ifru_names}) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r2, 0x8000000) sendmsg$SMC_PNETID_GET(r2, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f00000000c0)={&(0x7f00000001c0)={0x50, 0x0, 0x100, 0x70bd28, 0x25dfdbfe, {}, [@SMC_PNETID_IBPORT={0x5, 0x4, 0x2}, @SMC_PNETID_NAME={0x9, 0x1, 'syz2\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'syzkaller0\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'macsec0\x00'}]}, 0x50}, 0x1, 0x0, 0x0, 0x4}, 0x4000000) 01:07:23 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}}) 01:07:23 executing program 5: syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(0xffffffffffffffff, 0xc4c85512, 0x0) [ 1441.967091][T16836] binder: 16835:16836 unknown command 28 [ 1441.974025][T16836] binder: 16835:16836 ioctl c0306201 20000100 returned -22 [ 1441.996012][T16831] binder: 16828:16831 unknown command 0 [ 1442.004582][T16831] binder: 16828:16831 ioctl c0306201 20000100 returned -22 01:07:23 executing program 2: socketpair(0x22, 0x0, 0x4a01, &(0x7f0000000100)) [ 1442.027373][T16836] binder: 16835:16836 unknown command 28 01:07:23 executing program 4: socketpair(0x2c, 0x0, 0x16a, &(0x7f0000000100)) [ 1442.068476][T16836] binder: 16835:16836 ioctl c0306201 20000100 returned -22 01:07:23 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r1, 0x8000000) sendmsg$AUDIT_DEL_RULE(r1, &(0x7f0000000800)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f00000007c0)={&(0x7f0000000380)={0x43c, 0x3f4, 0x200, 0x70bd2d, 0x25dfdbfb, {0x0, 0x0, 0x1d, [0x5, 0x0, 0x3, 0xfff, 0x6, 0xffffff01, 0x2, 0x6, 0x1, 0x0, 0x9, 0x200, 0x4, 0x5, 0x9aa, 0x800, 0x2, 0x8, 0x11, 0xfffffff9, 0x38000, 0xffffff7f, 0x7, 0x100, 0x1, 0x39, 0x5000000, 0x1, 0x4, 0x4, 0x1, 0x1, 0x1000, 0x8, 0x5, 0x0, 0x7cbeb366, 0x4, 0x4, 0x10001, 0x4, 0x7fff, 0xfffffff8, 0x81, 0x800, 0x7fff, 0x5f, 0xfffffff9, 0x7, 0x80, 0x2, 0x7, 0x4, 0x4, 0x8, 0x0, 0x7f, 0x3, 0x0, 0x4, 0x6, 0x4, 0x8], [0x3, 0x3, 0x0, 0xffffd1e9, 0x4, 0x3ad, 0x80, 0x3f, 0x0, 0x1000, 0x2, 0x7db9fea2, 0x5, 0x8001, 0x3f, 0x20, 0x6, 0x7ff, 0x3, 0x20, 0x113, 0x5, 0x51, 0x7ff, 0x3, 0x1000, 0x1, 0x4b6, 0x4d7, 0x0, 0x781b, 0x3, 0x3, 0x1, 0x2, 0x80000000, 0x7, 0x1000, 0x6, 0xfff, 0x54, 0xaf, 0x80000001, 0xffff8001, 0x5, 0x5, 0x200, 0xb33, 0x400, 0x4, 0x1ff, 0x8c23, 0x3, 0x401, 0x9d, 0x7, 0x232d, 0x101, 0x1, 0x20, 0x1, 0x2, 0x1, 0x9], [0x401, 0x9, 0x5, 0xffff1f89, 0x7b, 0x7fffffff, 0x6d56048a, 0x4, 0x6, 0x5, 0x7, 0x4736, 0x0, 0x9, 0x561, 0x400, 0x8, 0x5, 0x4, 0x0, 0xffff8001, 0x3, 0xfffffffe, 0x2, 0x7, 0x800, 0x401, 0x2, 0x9, 0x8, 0x8001, 0x6, 0x4, 0x5, 0x8, 0xe7, 0xfffff000, 0x9, 0x4, 0x200, 0x1, 0x0, 0x1, 0x9, 0xffffff7f, 0xd6, 0x8, 0xff, 0x6, 0x0, 0x2, 0x7, 0x199, 0x400, 0x0, 0xa7, 0x101, 0x5, 0xd9a7, 0x1, 0x3ff, 0x5, 0x6, 0x8], [0x40, 0x2, 0x5, 0x5, 0x80000000, 0x7a, 0x4d, 0xebb, 0x8, 0x6, 0x0, 0xb3f, 0x7ff, 0x10001, 0xdda0, 0x0, 0x12, 0x9, 0x3, 0x5, 0x8001, 0x400, 0x80000000, 0x0, 0xfff, 0xfffffffe, 0x5, 0x2843, 0x20, 0x3, 0x2f9, 0x7, 0x9, 0xffffffff, 0x7fff, 0xfffffffb, 0x1, 0x80, 0x7, 0x4, 0x101, 0x4, 0x2, 0xc7c, 0x2, 0x1, 0x1, 0x10000, 0x6, 0xff, 0x0, 0x0, 0x691b, 0x9, 0x4, 0x3f, 0x0, 0x7, 0x2, 0x6, 0xfffffffd, 0x72de, 0x927, 0x1], 0x1c, ['\x00', '\x00', '/dev/binder#\x00', '/dev/binder#\x00']}, ["", "", "", "", "", ""]}, 0x43c}, 0x1, 0x0, 0x0, 0x40d0}, 0x800) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r2, 0x8000000) sendmsg$AUDIT_MAKE_EQUIV(r2, &(0x7f0000000300)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x602080}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x28, 0x3f7, 0x100, 0x70bd26, 0x25dfdbfe, {0x7, 0x7, './file0', './file0'}, ["", "", ""]}, 0x28}, 0x1, 0x0, 0x0, 0x4044000}, 0x50) io_uring_register$IORING_REGISTER_EVENTFD(r1, 0x4, &(0x7f0000000840)=r2, 0x1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB='\x00'], 0x0, 0x0, 0x0}) r3 = syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x8, 0x101000) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_INFO(r3, 0xc10c5541, &(0x7f00000001c0)={0x1, 0x0, 0x1}) 01:07:23 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000080)={0xe, 0x18, 0xfa00, @id_afonly={0x0}}, 0x20) 01:07:23 executing program 5: syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(0xffffffffffffffff, 0xc4c85512, 0x0) 01:07:23 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x1c, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1c", @ANYBLOB="7331467bd6427b2fb56adb726b6738beb9d50bdae60eb69bcd5327721b34a6ec7f5fc77a869993e86f3bad110d7a728f46c940d1f17741"], 0x0, 0x0, 0x0}) 01:07:23 executing program 2: socketpair(0x22, 0x0, 0x4b00, &(0x7f0000000100)) 01:07:23 executing program 4: socketpair(0x2c, 0x0, 0x16b, &(0x7f0000000100)) [ 1442.260768][T16850] binder: 16849:16850 unknown command 0 [ 1442.271682][T16850] binder: 16849:16850 ioctl c0306201 20000100 returned -22 01:07:23 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000080)={0xe, 0x18, 0xfa00, @id_afonly={0x0}}, 0x20) 01:07:23 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r1, 0x8000000) sendmsg$AUDIT_DEL_RULE(r1, &(0x7f0000000800)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f00000007c0)={&(0x7f0000000380)={0x43c, 0x3f4, 0x200, 0x70bd2d, 0x25dfdbfb, {0x0, 0x0, 0x1d, [0x5, 0x0, 0x3, 0xfff, 0x6, 0xffffff01, 0x2, 0x6, 0x1, 0x0, 0x9, 0x200, 0x4, 0x5, 0x9aa, 0x800, 0x2, 0x8, 0x11, 0xfffffff9, 0x38000, 0xffffff7f, 0x7, 0x100, 0x1, 0x39, 0x5000000, 0x1, 0x4, 0x4, 0x1, 0x1, 0x1000, 0x8, 0x5, 0x0, 0x7cbeb366, 0x4, 0x4, 0x10001, 0x4, 0x7fff, 0xfffffff8, 0x81, 0x800, 0x7fff, 0x5f, 0xfffffff9, 0x7, 0x80, 0x2, 0x7, 0x4, 0x4, 0x8, 0x0, 0x7f, 0x3, 0x0, 0x4, 0x6, 0x4, 0x8], [0x3, 0x3, 0x0, 0xffffd1e9, 0x4, 0x3ad, 0x80, 0x3f, 0x0, 0x1000, 0x2, 0x7db9fea2, 0x5, 0x8001, 0x3f, 0x20, 0x6, 0x7ff, 0x3, 0x20, 0x113, 0x5, 0x51, 0x7ff, 0x3, 0x1000, 0x1, 0x4b6, 0x4d7, 0x0, 0x781b, 0x3, 0x3, 0x1, 0x2, 0x80000000, 0x7, 0x1000, 0x6, 0xfff, 0x54, 0xaf, 0x80000001, 0xffff8001, 0x5, 0x5, 0x200, 0xb33, 0x400, 0x4, 0x1ff, 0x8c23, 0x3, 0x401, 0x9d, 0x7, 0x232d, 0x101, 0x1, 0x20, 0x1, 0x2, 0x1, 0x9], [0x401, 0x9, 0x5, 0xffff1f89, 0x7b, 0x7fffffff, 0x6d56048a, 0x4, 0x6, 0x5, 0x7, 0x4736, 0x0, 0x9, 0x561, 0x400, 0x8, 0x5, 0x4, 0x0, 0xffff8001, 0x3, 0xfffffffe, 0x2, 0x7, 0x800, 0x401, 0x2, 0x9, 0x8, 0x8001, 0x6, 0x4, 0x5, 0x8, 0xe7, 0xfffff000, 0x9, 0x4, 0x200, 0x1, 0x0, 0x1, 0x9, 0xffffff7f, 0xd6, 0x8, 0xff, 0x6, 0x0, 0x2, 0x7, 0x199, 0x400, 0x0, 0xa7, 0x101, 0x5, 0xd9a7, 0x1, 0x3ff, 0x5, 0x6, 0x8], [0x40, 0x2, 0x5, 0x5, 0x80000000, 0x7a, 0x4d, 0xebb, 0x8, 0x6, 0x0, 0xb3f, 0x7ff, 0x10001, 0xdda0, 0x0, 0x12, 0x9, 0x3, 0x5, 0x8001, 0x400, 0x80000000, 0x0, 0xfff, 0xfffffffe, 0x5, 0x2843, 0x20, 0x3, 0x2f9, 0x7, 0x9, 0xffffffff, 0x7fff, 0xfffffffb, 0x1, 0x80, 0x7, 0x4, 0x101, 0x4, 0x2, 0xc7c, 0x2, 0x1, 0x1, 0x10000, 0x6, 0xff, 0x0, 0x0, 0x691b, 0x9, 0x4, 0x3f, 0x0, 0x7, 0x2, 0x6, 0xfffffffd, 0x72de, 0x927, 0x1], 0x1c, ['\x00', '\x00', '/dev/binder#\x00', '/dev/binder#\x00']}, ["", "", "", "", "", ""]}, 0x43c}, 0x1, 0x0, 0x0, 0x40d0}, 0x800) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r2, 0x8000000) sendmsg$AUDIT_MAKE_EQUIV(r2, &(0x7f0000000300)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x602080}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x28, 0x3f7, 0x100, 0x70bd26, 0x25dfdbfe, {0x7, 0x7, './file0', './file0'}, ["", "", ""]}, 0x28}, 0x1, 0x0, 0x0, 0x4044000}, 0x50) io_uring_register$IORING_REGISTER_EVENTFD(r1, 0x4, &(0x7f0000000840)=r2, 0x1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB='\x00'], 0x0, 0x0, 0x0}) r3 = syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x8, 0x101000) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_INFO(r3, 0xc10c5541, &(0x7f00000001c0)={0x1, 0x0, 0x1}) [ 1442.313373][T16856] binder: 16853:16856 unknown command 1177645852 [ 1442.350678][T16856] binder: 16853:16856 ioctl c0306201 20000080 returned -22 01:07:23 executing program 2: socketpair(0x22, 0x0, 0x4b01, &(0x7f0000000100)) 01:07:23 executing program 5: syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(0xffffffffffffffff, 0xc4c85512, 0x0) 01:07:23 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0xfffffefc, 0x0, 0x0}) 01:07:23 executing program 4: socketpair(0x2c, 0x0, 0x16c, &(0x7f0000000100)) 01:07:23 executing program 2: socketpair(0x22, 0x0, 0x4c00, &(0x7f0000000100)) 01:07:23 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000080)={0xe, 0x18, 0xfa00, @id_afonly={0x0}}, 0x20) [ 1442.512331][T16866] binder: 16864:16866 unknown command 0 [ 1442.532864][T16866] binder: 16864:16866 ioctl c0306201 20000100 returned -22 01:07:23 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x0, 0x0}) r1 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_RX_RING(r1, 0x11b, 0x2, &(0x7f0000001e40)=0x100080, 0x4) ioctl$sock_ifreq(r1, 0x8916, &(0x7f0000000040)={'ip6tnl0\x00', @ifru_names}) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r2, 0x8000000) sendmsg$SMC_PNETID_GET(r2, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f00000000c0)={&(0x7f00000001c0)={0x50, 0x0, 0x100, 0x70bd28, 0x25dfdbfe, {}, [@SMC_PNETID_IBPORT={0x5, 0x4, 0x2}, @SMC_PNETID_NAME={0x9, 0x1, 'syz2\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'syzkaller0\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'macsec0\x00'}]}, 0x50}, 0x1, 0x0, 0x0, 0x4}, 0x4000000) [ 1442.567940][T16871] binder: 16868:16871 unknown command 28 [ 1442.601820][T16871] binder: 16868:16871 ioctl c0306201 20000100 returned -22 01:07:23 executing program 4: socketpair(0x2c, 0x0, 0x16d, &(0x7f0000000100)) 01:07:23 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r1, 0x8000000) sendmsg$AUDIT_DEL_RULE(r1, &(0x7f0000000800)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f00000007c0)={&(0x7f0000000380)={0x43c, 0x3f4, 0x200, 0x70bd2d, 0x25dfdbfb, {0x0, 0x0, 0x1d, [0x5, 0x0, 0x3, 0xfff, 0x6, 0xffffff01, 0x2, 0x6, 0x1, 0x0, 0x9, 0x200, 0x4, 0x5, 0x9aa, 0x800, 0x2, 0x8, 0x11, 0xfffffff9, 0x38000, 0xffffff7f, 0x7, 0x100, 0x1, 0x39, 0x5000000, 0x1, 0x4, 0x4, 0x1, 0x1, 0x1000, 0x8, 0x5, 0x0, 0x7cbeb366, 0x4, 0x4, 0x10001, 0x4, 0x7fff, 0xfffffff8, 0x81, 0x800, 0x7fff, 0x5f, 0xfffffff9, 0x7, 0x80, 0x2, 0x7, 0x4, 0x4, 0x8, 0x0, 0x7f, 0x3, 0x0, 0x4, 0x6, 0x4, 0x8], [0x3, 0x3, 0x0, 0xffffd1e9, 0x4, 0x3ad, 0x80, 0x3f, 0x0, 0x1000, 0x2, 0x7db9fea2, 0x5, 0x8001, 0x3f, 0x20, 0x6, 0x7ff, 0x3, 0x20, 0x113, 0x5, 0x51, 0x7ff, 0x3, 0x1000, 0x1, 0x4b6, 0x4d7, 0x0, 0x781b, 0x3, 0x3, 0x1, 0x2, 0x80000000, 0x7, 0x1000, 0x6, 0xfff, 0x54, 0xaf, 0x80000001, 0xffff8001, 0x5, 0x5, 0x200, 0xb33, 0x400, 0x4, 0x1ff, 0x8c23, 0x3, 0x401, 0x9d, 0x7, 0x232d, 0x101, 0x1, 0x20, 0x1, 0x2, 0x1, 0x9], [0x401, 0x9, 0x5, 0xffff1f89, 0x7b, 0x7fffffff, 0x6d56048a, 0x4, 0x6, 0x5, 0x7, 0x4736, 0x0, 0x9, 0x561, 0x400, 0x8, 0x5, 0x4, 0x0, 0xffff8001, 0x3, 0xfffffffe, 0x2, 0x7, 0x800, 0x401, 0x2, 0x9, 0x8, 0x8001, 0x6, 0x4, 0x5, 0x8, 0xe7, 0xfffff000, 0x9, 0x4, 0x200, 0x1, 0x0, 0x1, 0x9, 0xffffff7f, 0xd6, 0x8, 0xff, 0x6, 0x0, 0x2, 0x7, 0x199, 0x400, 0x0, 0xa7, 0x101, 0x5, 0xd9a7, 0x1, 0x3ff, 0x5, 0x6, 0x8], [0x40, 0x2, 0x5, 0x5, 0x80000000, 0x7a, 0x4d, 0xebb, 0x8, 0x6, 0x0, 0xb3f, 0x7ff, 0x10001, 0xdda0, 0x0, 0x12, 0x9, 0x3, 0x5, 0x8001, 0x400, 0x80000000, 0x0, 0xfff, 0xfffffffe, 0x5, 0x2843, 0x20, 0x3, 0x2f9, 0x7, 0x9, 0xffffffff, 0x7fff, 0xfffffffb, 0x1, 0x80, 0x7, 0x4, 0x101, 0x4, 0x2, 0xc7c, 0x2, 0x1, 0x1, 0x10000, 0x6, 0xff, 0x0, 0x0, 0x691b, 0x9, 0x4, 0x3f, 0x0, 0x7, 0x2, 0x6, 0xfffffffd, 0x72de, 0x927, 0x1], 0x1c, ['\x00', '\x00', '/dev/binder#\x00', '/dev/binder#\x00']}, ["", "", "", "", "", ""]}, 0x43c}, 0x1, 0x0, 0x0, 0x40d0}, 0x800) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r2, 0x8000000) sendmsg$AUDIT_MAKE_EQUIV(r2, &(0x7f0000000300)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x602080}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x28, 0x3f7, 0x100, 0x70bd26, 0x25dfdbfe, {0x7, 0x7, './file0', './file0'}, ["", "", ""]}, 0x28}, 0x1, 0x0, 0x0, 0x4044000}, 0x50) io_uring_register$IORING_REGISTER_EVENTFD(r1, 0x4, &(0x7f0000000840)=r2, 0x1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB='\x00'], 0x0, 0x0, 0x0}) syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x8, 0x101000) 01:07:23 executing program 2: socketpair(0x22, 0x0, 0x4c01, &(0x7f0000000100)) [ 1442.697824][T16878] binder: 16877:16878 unknown command 28 [ 1442.720460][T16878] binder: 16877:16878 ioctl c0306201 20000100 returned -22 01:07:23 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/route\x00') ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000080)={&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, 0x1000}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="80"], 0x0, 0x0, 0x0}) 01:07:23 executing program 3: write$RDMA_USER_CM_CMD_SET_OPTION(0xffffffffffffffff, &(0x7f0000000080)={0xe, 0x18, 0xfa00, @id_afonly={0x0}}, 0x20) 01:07:23 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5]}) 01:07:24 executing program 2: socketpair(0x22, 0x0, 0x4d00, &(0x7f0000000100)) 01:07:24 executing program 4: socketpair(0x2c, 0x0, 0x16e, &(0x7f0000000100)) [ 1442.833960][T16883] binder: 16881:16883 unknown command 0 [ 1442.846738][T16886] binder: 16884:16886 unknown command 128 [ 1442.866746][T16886] binder: 16884:16886 ioctl c0306201 20000100 returned -22 [ 1442.872398][T16883] binder: 16881:16883 ioctl c0306201 20000100 returned -22 01:07:24 executing program 3: write$RDMA_USER_CM_CMD_SET_OPTION(0xffffffffffffffff, &(0x7f0000000080)={0xe, 0x18, 0xfa00, @id_afonly={0x0}}, 0x20) 01:07:24 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) write$rfkill(0xffffffffffffffff, &(0x7f0000000040)={0x7fff, 0x1, 0x2, 0x0, 0x1}, 0x8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x0, 0x0}) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r1, 0x8000000) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r1, 0xc4c85512, &(0x7f00000001c0)={{0x1, 0x3, 0x4, 0x2c, 'syz1\x00', 0x6}, 0x1, [0x7ff800, 0x3, 0x5, 0x91, 0x7ff, 0xaa, 0xffff, 0x4, 0x2, 0x0, 0x8, 0xe8c5, 0x9, 0x0, 0x4, 0x10000, 0xfffffffffffffff9, 0x57, 0x8, 0x7, 0x7f, 0x2234, 0x100000001, 0x4256, 0x1, 0x0, 0x4, 0x2, 0x100000001, 0x2, 0x5, 0x8001, 0x89, 0x0, 0x3, 0xcb, 0x9, 0x5, 0x4, 0x6, 0x1, 0x81, 0x1, 0x1000, 0x5, 0x401, 0x7fff, 0x5, 0xffffffc000000000, 0x9, 0xde, 0x1f, 0x6, 0x3, 0x150, 0xfff, 0xfffffffffffffe01, 0x1, 0x3, 0x0, 0x5, 0x7, 0x80, 0x40ec, 0x3, 0x3ff, 0x5, 0x1000, 0x31eb, 0x800, 0x101, 0x534, 0x81, 0x101, 0x3, 0x7, 0x5, 0xffffffffffffff81, 0x401, 0xde2, 0x10000, 0x1000, 0x8, 0x4, 0x7ff, 0x1, 0x4, 0x12, 0x99, 0x101, 0x1, 0x20, 0x7, 0x9, 0x8, 0x5, 0x4ec8, 0x7fffffff, 0xef6, 0x4, 0x1995, 0x7fffffff, 0xb1, 0x5, 0x140, 0x1fffe000000, 0x800, 0x3, 0x5, 0x5, 0x0, 0x1ff, 0x4, 0x8, 0x5, 0x4, 0x8, 0xffffffffffff83de, 0x1c00000000000000, 0x0, 0x81, 0x2, 0x3a, 0x3, 0x8000, 0x2, 0x9, 0x9]}) 01:07:24 executing program 0: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r0, 0x8000000) sendmsg$AUDIT_DEL_RULE(r0, &(0x7f0000000800)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f00000007c0)={&(0x7f0000000380)={0x43c, 0x3f4, 0x200, 0x70bd2d, 0x25dfdbfb, {0x0, 0x0, 0x1d, [0x5, 0x0, 0x3, 0xfff, 0x6, 0xffffff01, 0x2, 0x6, 0x1, 0x0, 0x9, 0x200, 0x4, 0x5, 0x9aa, 0x800, 0x2, 0x8, 0x11, 0xfffffff9, 0x38000, 0xffffff7f, 0x7, 0x100, 0x1, 0x39, 0x5000000, 0x1, 0x4, 0x4, 0x1, 0x1, 0x1000, 0x8, 0x5, 0x0, 0x7cbeb366, 0x4, 0x4, 0x10001, 0x4, 0x7fff, 0xfffffff8, 0x81, 0x800, 0x7fff, 0x5f, 0xfffffff9, 0x7, 0x80, 0x2, 0x7, 0x4, 0x4, 0x8, 0x0, 0x7f, 0x3, 0x0, 0x4, 0x6, 0x4, 0x8], [0x3, 0x3, 0x0, 0xffffd1e9, 0x4, 0x3ad, 0x80, 0x3f, 0x0, 0x1000, 0x2, 0x7db9fea2, 0x5, 0x8001, 0x3f, 0x20, 0x6, 0x7ff, 0x3, 0x20, 0x113, 0x5, 0x51, 0x7ff, 0x3, 0x1000, 0x1, 0x4b6, 0x4d7, 0x0, 0x781b, 0x3, 0x3, 0x1, 0x2, 0x80000000, 0x7, 0x1000, 0x6, 0xfff, 0x54, 0xaf, 0x80000001, 0xffff8001, 0x5, 0x5, 0x200, 0xb33, 0x400, 0x4, 0x1ff, 0x8c23, 0x3, 0x401, 0x9d, 0x7, 0x232d, 0x101, 0x1, 0x20, 0x1, 0x2, 0x1, 0x9], [0x401, 0x9, 0x5, 0xffff1f89, 0x7b, 0x7fffffff, 0x6d56048a, 0x4, 0x6, 0x5, 0x7, 0x4736, 0x0, 0x9, 0x561, 0x400, 0x8, 0x5, 0x4, 0x0, 0xffff8001, 0x3, 0xfffffffe, 0x2, 0x7, 0x800, 0x401, 0x2, 0x9, 0x8, 0x8001, 0x6, 0x4, 0x5, 0x8, 0xe7, 0xfffff000, 0x9, 0x4, 0x200, 0x1, 0x0, 0x1, 0x9, 0xffffff7f, 0xd6, 0x8, 0xff, 0x6, 0x0, 0x2, 0x7, 0x199, 0x400, 0x0, 0xa7, 0x101, 0x5, 0xd9a7, 0x1, 0x3ff, 0x5, 0x6, 0x8], [0x40, 0x2, 0x5, 0x5, 0x80000000, 0x7a, 0x4d, 0xebb, 0x8, 0x6, 0x0, 0xb3f, 0x7ff, 0x10001, 0xdda0, 0x0, 0x12, 0x9, 0x3, 0x5, 0x8001, 0x400, 0x80000000, 0x0, 0xfff, 0xfffffffe, 0x5, 0x2843, 0x20, 0x3, 0x2f9, 0x7, 0x9, 0xffffffff, 0x7fff, 0xfffffffb, 0x1, 0x80, 0x7, 0x4, 0x101, 0x4, 0x2, 0xc7c, 0x2, 0x1, 0x1, 0x10000, 0x6, 0xff, 0x0, 0x0, 0x691b, 0x9, 0x4, 0x3f, 0x0, 0x7, 0x2, 0x6, 0xfffffffd, 0x72de, 0x927, 0x1], 0x1c, ['\x00', '\x00', '/dev/binder#\x00', '/dev/binder#\x00']}, ["", "", "", "", "", ""]}, 0x43c}, 0x1, 0x0, 0x0, 0x40d0}, 0x800) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r1, 0x8000000) sendmsg$AUDIT_MAKE_EQUIV(r1, &(0x7f0000000300)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x602080}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x28, 0x3f7, 0x100, 0x70bd26, 0x25dfdbfe, {0x7, 0x7, './file0', './file0'}, ["", "", ""]}, 0x28}, 0x1, 0x0, 0x0, 0x4044000}, 0x50) io_uring_register$IORING_REGISTER_EVENTFD(r0, 0x4, &(0x7f0000000840)=r1, 0x1) syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x8, 0x101000) 01:07:24 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='attr/exec\x00') ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="1dedccbd43c3a0a05787629184027dd68a93c828fff71b7aa41f94a8ba93a39336a081f8f1c9a6152492fa5926017cd374cd44f64f1595d13927e07cef69e759486d19a300dc809480322ae2ade200dcb056f084dd78c2c332e505a7e305c9893d7529a0cf25fa8ba0fb88d6c2cdea01dcc648ecac6bc18ebecb3af0f7c7a7707ac9"], 0x0, 0x0, 0x0}) 01:07:24 executing program 2: socketpair(0x22, 0x0, 0x4d01, &(0x7f0000000100)) 01:07:24 executing program 4: socketpair(0x2c, 0x0, 0x16f, &(0x7f0000000100)) 01:07:24 executing program 3: write$RDMA_USER_CM_CMD_SET_OPTION(0xffffffffffffffff, &(0x7f0000000080)={0xe, 0x18, 0xfa00, @id_afonly={0x0}}, 0x20) [ 1443.116699][T16900] binder: 16898:16900 unknown command 28 [ 1443.143628][T16903] binder: 16901:16903 unknown command -1110643427 [ 1443.146884][T16900] binder: 16898:16900 ioctl c0306201 20000100 returned -22 [ 1443.170830][T16903] binder: 16901:16903 ioctl c0306201 20000100 returned -22 [ 1443.187558][T16908] binder: 16898:16908 unknown command 28 01:07:24 executing program 0: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r0, 0x8000000) sendmsg$AUDIT_DEL_RULE(r0, &(0x7f0000000800)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f00000007c0)={&(0x7f0000000380)={0x43c, 0x3f4, 0x200, 0x70bd2d, 0x25dfdbfb, {0x0, 0x0, 0x1d, [0x5, 0x0, 0x3, 0xfff, 0x6, 0xffffff01, 0x2, 0x6, 0x1, 0x0, 0x9, 0x200, 0x4, 0x5, 0x9aa, 0x800, 0x2, 0x8, 0x11, 0xfffffff9, 0x38000, 0xffffff7f, 0x7, 0x100, 0x1, 0x39, 0x5000000, 0x1, 0x4, 0x4, 0x1, 0x1, 0x1000, 0x8, 0x5, 0x0, 0x7cbeb366, 0x4, 0x4, 0x10001, 0x4, 0x7fff, 0xfffffff8, 0x81, 0x800, 0x7fff, 0x5f, 0xfffffff9, 0x7, 0x80, 0x2, 0x7, 0x4, 0x4, 0x8, 0x0, 0x7f, 0x3, 0x0, 0x4, 0x6, 0x4, 0x8], [0x3, 0x3, 0x0, 0xffffd1e9, 0x4, 0x3ad, 0x80, 0x3f, 0x0, 0x1000, 0x2, 0x7db9fea2, 0x5, 0x8001, 0x3f, 0x20, 0x6, 0x7ff, 0x3, 0x20, 0x113, 0x5, 0x51, 0x7ff, 0x3, 0x1000, 0x1, 0x4b6, 0x4d7, 0x0, 0x781b, 0x3, 0x3, 0x1, 0x2, 0x80000000, 0x7, 0x1000, 0x6, 0xfff, 0x54, 0xaf, 0x80000001, 0xffff8001, 0x5, 0x5, 0x200, 0xb33, 0x400, 0x4, 0x1ff, 0x8c23, 0x3, 0x401, 0x9d, 0x7, 0x232d, 0x101, 0x1, 0x20, 0x1, 0x2, 0x1, 0x9], [0x401, 0x9, 0x5, 0xffff1f89, 0x7b, 0x7fffffff, 0x6d56048a, 0x4, 0x6, 0x5, 0x7, 0x4736, 0x0, 0x9, 0x561, 0x400, 0x8, 0x5, 0x4, 0x0, 0xffff8001, 0x3, 0xfffffffe, 0x2, 0x7, 0x800, 0x401, 0x2, 0x9, 0x8, 0x8001, 0x6, 0x4, 0x5, 0x8, 0xe7, 0xfffff000, 0x9, 0x4, 0x200, 0x1, 0x0, 0x1, 0x9, 0xffffff7f, 0xd6, 0x8, 0xff, 0x6, 0x0, 0x2, 0x7, 0x199, 0x400, 0x0, 0xa7, 0x101, 0x5, 0xd9a7, 0x1, 0x3ff, 0x5, 0x6, 0x8], [0x40, 0x2, 0x5, 0x5, 0x80000000, 0x7a, 0x4d, 0xebb, 0x8, 0x6, 0x0, 0xb3f, 0x7ff, 0x10001, 0xdda0, 0x0, 0x12, 0x9, 0x3, 0x5, 0x8001, 0x400, 0x80000000, 0x0, 0xfff, 0xfffffffe, 0x5, 0x2843, 0x20, 0x3, 0x2f9, 0x7, 0x9, 0xffffffff, 0x7fff, 0xfffffffb, 0x1, 0x80, 0x7, 0x4, 0x101, 0x4, 0x2, 0xc7c, 0x2, 0x1, 0x1, 0x10000, 0x6, 0xff, 0x0, 0x0, 0x691b, 0x9, 0x4, 0x3f, 0x0, 0x7, 0x2, 0x6, 0xfffffffd, 0x72de, 0x927, 0x1], 0x1c, ['\x00', '\x00', '/dev/binder#\x00', '/dev/binder#\x00']}, ["", "", "", "", "", ""]}, 0x43c}, 0x1, 0x0, 0x0, 0x40d0}, 0x800) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r1, 0x8000000) sendmsg$AUDIT_MAKE_EQUIV(r1, &(0x7f0000000300)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x602080}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x28, 0x3f7, 0x100, 0x70bd26, 0x25dfdbfe, {0x7, 0x7, './file0', './file0'}, ["", "", ""]}, 0x28}, 0x1, 0x0, 0x0, 0x4044000}, 0x50) syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x8, 0x101000) [ 1443.216728][T16908] binder: 16898:16908 ioctl c0306201 20000100 returned -22 01:07:24 executing program 4: socketpair(0x2c, 0x0, 0x170, &(0x7f0000000100)) 01:07:24 executing program 2: socketpair(0x22, 0x0, 0x4e00, &(0x7f0000000100)) 01:07:24 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7]}) 01:07:24 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000080)={0xe, 0x18, 0xfa00, @id_afonly={0x0}}, 0x20) 01:07:24 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="00000000005849bd42178f003558d866ac0000"], 0x0, 0x0, 0x0}) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r1, 0x8000000) sendmsg$AUDIT_USER_TTY(r1, &(0x7f0000000240)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f00000000c0)={&(0x7f0000000140)={0xd4, 0x464, 0x400, 0x70bd2b, 0x25dfdbff, "de66c3dd5fbd02425a0bddd02ab3dbb6ba75f6ff7a44a5db73fd0dac0e73d4f160994f7f1e76e5f1f5fad6e751f18a9e1ff99c2fbe2c5c0cbdc140af58406192f037b168ec786e2f3667ba0044743ac41eed03f537a12d68b8fc1841b9c230005bb9892bc73cdec319a19e6352815cdf0032299d538eff9d288c4f98919d92ed0ec3302047485d12f5d4d458a92ea17a0f251bb95b7c9be68372a3949380e2ad65286163ed2eb19ebc026d3437ba27aa960c2ca4517968c32a2b8b03fc5a42e3eb69", ["", "", "", "", "", "", "", ""]}, 0xd4}, 0x1, 0x0, 0x0, 0x80}, 0x20000041) 01:07:24 executing program 0: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r0, 0x8000000) sendmsg$AUDIT_DEL_RULE(r0, &(0x7f0000000800)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f00000007c0)={&(0x7f0000000380)={0x43c, 0x3f4, 0x200, 0x70bd2d, 0x25dfdbfb, {0x0, 0x0, 0x1d, [0x5, 0x0, 0x3, 0xfff, 0x6, 0xffffff01, 0x2, 0x6, 0x1, 0x0, 0x9, 0x200, 0x4, 0x5, 0x9aa, 0x800, 0x2, 0x8, 0x11, 0xfffffff9, 0x38000, 0xffffff7f, 0x7, 0x100, 0x1, 0x39, 0x5000000, 0x1, 0x4, 0x4, 0x1, 0x1, 0x1000, 0x8, 0x5, 0x0, 0x7cbeb366, 0x4, 0x4, 0x10001, 0x4, 0x7fff, 0xfffffff8, 0x81, 0x800, 0x7fff, 0x5f, 0xfffffff9, 0x7, 0x80, 0x2, 0x7, 0x4, 0x4, 0x8, 0x0, 0x7f, 0x3, 0x0, 0x4, 0x6, 0x4, 0x8], [0x3, 0x3, 0x0, 0xffffd1e9, 0x4, 0x3ad, 0x80, 0x3f, 0x0, 0x1000, 0x2, 0x7db9fea2, 0x5, 0x8001, 0x3f, 0x20, 0x6, 0x7ff, 0x3, 0x20, 0x113, 0x5, 0x51, 0x7ff, 0x3, 0x1000, 0x1, 0x4b6, 0x4d7, 0x0, 0x781b, 0x3, 0x3, 0x1, 0x2, 0x80000000, 0x7, 0x1000, 0x6, 0xfff, 0x54, 0xaf, 0x80000001, 0xffff8001, 0x5, 0x5, 0x200, 0xb33, 0x400, 0x4, 0x1ff, 0x8c23, 0x3, 0x401, 0x9d, 0x7, 0x232d, 0x101, 0x1, 0x20, 0x1, 0x2, 0x1, 0x9], [0x401, 0x9, 0x5, 0xffff1f89, 0x7b, 0x7fffffff, 0x6d56048a, 0x4, 0x6, 0x5, 0x7, 0x4736, 0x0, 0x9, 0x561, 0x400, 0x8, 0x5, 0x4, 0x0, 0xffff8001, 0x3, 0xfffffffe, 0x2, 0x7, 0x800, 0x401, 0x2, 0x9, 0x8, 0x8001, 0x6, 0x4, 0x5, 0x8, 0xe7, 0xfffff000, 0x9, 0x4, 0x200, 0x1, 0x0, 0x1, 0x9, 0xffffff7f, 0xd6, 0x8, 0xff, 0x6, 0x0, 0x2, 0x7, 0x199, 0x400, 0x0, 0xa7, 0x101, 0x5, 0xd9a7, 0x1, 0x3ff, 0x5, 0x6, 0x8], [0x40, 0x2, 0x5, 0x5, 0x80000000, 0x7a, 0x4d, 0xebb, 0x8, 0x6, 0x0, 0xb3f, 0x7ff, 0x10001, 0xdda0, 0x0, 0x12, 0x9, 0x3, 0x5, 0x8001, 0x400, 0x80000000, 0x0, 0xfff, 0xfffffffe, 0x5, 0x2843, 0x20, 0x3, 0x2f9, 0x7, 0x9, 0xffffffff, 0x7fff, 0xfffffffb, 0x1, 0x80, 0x7, 0x4, 0x101, 0x4, 0x2, 0xc7c, 0x2, 0x1, 0x1, 0x10000, 0x6, 0xff, 0x0, 0x0, 0x691b, 0x9, 0x4, 0x3f, 0x0, 0x7, 0x2, 0x6, 0xfffffffd, 0x72de, 0x927, 0x1], 0x1c, ['\x00', '\x00', '/dev/binder#\x00', '/dev/binder#\x00']}, ["", "", "", "", "", ""]}, 0x43c}, 0x1, 0x0, 0x0, 0x40d0}, 0x800) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r1, 0x8000000) syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x8, 0x101000) 01:07:24 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000080)={0xe, 0x18, 0xfa00, @id_afonly={0x0}}, 0x20) 01:07:24 executing program 2: socketpair(0x22, 0x0, 0x4e01, &(0x7f0000000100)) 01:07:24 executing program 4: socketpair(0x2c, 0x0, 0x171, &(0x7f0000000100)) [ 1443.482759][T16924] binder: 16923:16924 unknown command 0 [ 1443.501467][T16924] binder: 16923:16924 ioctl c0306201 20000100 returned -22 01:07:24 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3]}) [ 1443.535082][T16924] binder: 16923:16924 unknown command 0 01:07:24 executing program 0: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r0, 0x8000000) sendmsg$AUDIT_DEL_RULE(r0, &(0x7f0000000800)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f00000007c0)={&(0x7f0000000380)={0x43c, 0x3f4, 0x200, 0x70bd2d, 0x25dfdbfb, {0x0, 0x0, 0x1d, [0x5, 0x0, 0x3, 0xfff, 0x6, 0xffffff01, 0x2, 0x6, 0x1, 0x0, 0x9, 0x200, 0x4, 0x5, 0x9aa, 0x800, 0x2, 0x8, 0x11, 0xfffffff9, 0x38000, 0xffffff7f, 0x7, 0x100, 0x1, 0x39, 0x5000000, 0x1, 0x4, 0x4, 0x1, 0x1, 0x1000, 0x8, 0x5, 0x0, 0x7cbeb366, 0x4, 0x4, 0x10001, 0x4, 0x7fff, 0xfffffff8, 0x81, 0x800, 0x7fff, 0x5f, 0xfffffff9, 0x7, 0x80, 0x2, 0x7, 0x4, 0x4, 0x8, 0x0, 0x7f, 0x3, 0x0, 0x4, 0x6, 0x4, 0x8], [0x3, 0x3, 0x0, 0xffffd1e9, 0x4, 0x3ad, 0x80, 0x3f, 0x0, 0x1000, 0x2, 0x7db9fea2, 0x5, 0x8001, 0x3f, 0x20, 0x6, 0x7ff, 0x3, 0x20, 0x113, 0x5, 0x51, 0x7ff, 0x3, 0x1000, 0x1, 0x4b6, 0x4d7, 0x0, 0x781b, 0x3, 0x3, 0x1, 0x2, 0x80000000, 0x7, 0x1000, 0x6, 0xfff, 0x54, 0xaf, 0x80000001, 0xffff8001, 0x5, 0x5, 0x200, 0xb33, 0x400, 0x4, 0x1ff, 0x8c23, 0x3, 0x401, 0x9d, 0x7, 0x232d, 0x101, 0x1, 0x20, 0x1, 0x2, 0x1, 0x9], [0x401, 0x9, 0x5, 0xffff1f89, 0x7b, 0x7fffffff, 0x6d56048a, 0x4, 0x6, 0x5, 0x7, 0x4736, 0x0, 0x9, 0x561, 0x400, 0x8, 0x5, 0x4, 0x0, 0xffff8001, 0x3, 0xfffffffe, 0x2, 0x7, 0x800, 0x401, 0x2, 0x9, 0x8, 0x8001, 0x6, 0x4, 0x5, 0x8, 0xe7, 0xfffff000, 0x9, 0x4, 0x200, 0x1, 0x0, 0x1, 0x9, 0xffffff7f, 0xd6, 0x8, 0xff, 0x6, 0x0, 0x2, 0x7, 0x199, 0x400, 0x0, 0xa7, 0x101, 0x5, 0xd9a7, 0x1, 0x3ff, 0x5, 0x6, 0x8], [0x40, 0x2, 0x5, 0x5, 0x80000000, 0x7a, 0x4d, 0xebb, 0x8, 0x6, 0x0, 0xb3f, 0x7ff, 0x10001, 0xdda0, 0x0, 0x12, 0x9, 0x3, 0x5, 0x8001, 0x400, 0x80000000, 0x0, 0xfff, 0xfffffffe, 0x5, 0x2843, 0x20, 0x3, 0x2f9, 0x7, 0x9, 0xffffffff, 0x7fff, 0xfffffffb, 0x1, 0x80, 0x7, 0x4, 0x101, 0x4, 0x2, 0xc7c, 0x2, 0x1, 0x1, 0x10000, 0x6, 0xff, 0x0, 0x0, 0x691b, 0x9, 0x4, 0x3f, 0x0, 0x7, 0x2, 0x6, 0xfffffffd, 0x72de, 0x927, 0x1], 0x1c, ['\x00', '\x00', '/dev/binder#\x00', '/dev/binder#\x00']}, ["", "", "", "", "", ""]}, 0x43c}, 0x1, 0x0, 0x0, 0x40d0}, 0x800) openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x8, 0x101000) 01:07:24 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000080)={0xe, 0x18, 0xfa00, @id_afonly={0x0}}, 0x20) [ 1443.580540][T16924] binder: 16923:16924 ioctl c0306201 20000100 returned -22 01:07:24 executing program 4: socketpair(0x2c, 0x0, 0x172, &(0x7f0000000100)) 01:07:24 executing program 2: socketpair(0x22, 0x0, 0x4f00, &(0x7f0000000100)) 01:07:24 executing program 1: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r0, 0x8000000) write$RDMA_USER_CM_CMD_DESTROY_ID(r0, &(0x7f0000000080)={0x1, 0x10, 0xfa00, {&(0x7f0000000040)}}, 0x18) r1 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x0, 0x0}) r2 = openat$ipvs(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/sys/net/ipv4/vs/am_droprate\x00', 0x2, 0x0) sendmsg$AUDIT_USER(r2, &(0x7f0000000340)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000300)={&(0x7f00000001c0)={0x104, 0x3ed, 0x100, 0x70bd25, 0x25dfdbfe, "eb8a9e01d54986d752ad236fb32c2d38905d743dc26d33aacf4e6c13ce4acdc5994f186ea1724fa897f2dc497f9c78732629425289335f5554c816e033c76ce56bcebc6307806ea74904153fcf158ca200ccee4123af493ffe39168eb8e0653c077b8991f7059fca8222975bbc94c2b631e5545aa246db1458cd9c80d42eb5b37f795316136e572052b33afc22075d364c5f31a4aa7d6e1670408e010f533f8ca063a78bf59bb88669210d28f85ca7e74095c53eb78ed6f6d958bc04ea439b5195a5371d0f6a7f77b4bd01e3df0d68b8ed94c8682a05a29c680d0702f53a251d633f6faa7aaff56cf1d2bc4e94d3039daa99", ["", "", "", "", "", "", "", ""]}, 0x104}, 0x1, 0x0, 0x0, 0x10}, 0x94) 01:07:24 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_RX_RING(r1, 0x11b, 0x2, &(0x7f0000001e40)=0x100080, 0x4) r2 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_RX_RING(r2, 0x11b, 0x2, &(0x7f0000001e40)=0x100080, 0x4) r3 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_RX_RING(r3, 0x11b, 0x2, &(0x7f0000001e40)=0x100080, 0x4) r4 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_RX_RING(r4, 0x11b, 0x2, &(0x7f0000001e40)=0x100080, 0x4) r5 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_RX_RING(r5, 0x11b, 0x2, &(0x7f0000001e40)=0x100080, 0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="adab188c6f7f70e0ded9b3bc6471321f0afcf881136f2a0876dff138f28b55dab377", @ANYRES32=r2, @ANYRES32, @ANYRESDEC=r1, @ANYRES64=r3, @ANYRES16, @ANYRESDEC=r4, @ANYRESDEC=r3, @ANYRESDEC=r5, @ANYBLOB="326f5091fe6821b42184249a85417ea132335ba2b93de7175dd59bdecaae38dcf511100a01795f37af0590559d56df445ec82a36a46bace7d29ddc985ed9da6924594b32010e6677a13fe7ff7f201c4c71d5f77b50f26482eba446c0a99f8dc3d3f78efd311ba1645f3f1a3ad17b2d241e8eced870ff688a2d7c3ff8b1dcbbc2765fab10"], 0x0, 0x0, 0x0}) getsockopt$XDP_STATISTICS(r1, 0x11b, 0x7, &(0x7f0000000040), &(0x7f0000000140)=0x30) seccomp$SECCOMP_SET_MODE_FILTER(0x1, 0x2, &(0x7f00000000c0)={0x4, &(0x7f0000000080)=[{0x5, 0x5d, 0xd4, 0xfff}, {0x2, 0xfc, 0x2, 0x3}, {0x6, 0xff, 0x1, 0x8}, {0xdc65, 0x1, 0x40, 0x81}]}) 01:07:24 executing program 0: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r0, 0x8000000) sendmsg$AUDIT_DEL_RULE(r0, &(0x7f0000000800)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f00000007c0)={&(0x7f0000000380)={0x43c, 0x3f4, 0x200, 0x70bd2d, 0x25dfdbfb, {0x0, 0x0, 0x1d, [0x5, 0x0, 0x3, 0xfff, 0x6, 0xffffff01, 0x2, 0x6, 0x1, 0x0, 0x9, 0x200, 0x4, 0x5, 0x9aa, 0x800, 0x2, 0x8, 0x11, 0xfffffff9, 0x38000, 0xffffff7f, 0x7, 0x100, 0x1, 0x39, 0x5000000, 0x1, 0x4, 0x4, 0x1, 0x1, 0x1000, 0x8, 0x5, 0x0, 0x7cbeb366, 0x4, 0x4, 0x10001, 0x4, 0x7fff, 0xfffffff8, 0x81, 0x800, 0x7fff, 0x5f, 0xfffffff9, 0x7, 0x80, 0x2, 0x7, 0x4, 0x4, 0x8, 0x0, 0x7f, 0x3, 0x0, 0x4, 0x6, 0x4, 0x8], [0x3, 0x3, 0x0, 0xffffd1e9, 0x4, 0x3ad, 0x80, 0x3f, 0x0, 0x1000, 0x2, 0x7db9fea2, 0x5, 0x8001, 0x3f, 0x20, 0x6, 0x7ff, 0x3, 0x20, 0x113, 0x5, 0x51, 0x7ff, 0x3, 0x1000, 0x1, 0x4b6, 0x4d7, 0x0, 0x781b, 0x3, 0x3, 0x1, 0x2, 0x80000000, 0x7, 0x1000, 0x6, 0xfff, 0x54, 0xaf, 0x80000001, 0xffff8001, 0x5, 0x5, 0x200, 0xb33, 0x400, 0x4, 0x1ff, 0x8c23, 0x3, 0x401, 0x9d, 0x7, 0x232d, 0x101, 0x1, 0x20, 0x1, 0x2, 0x1, 0x9], [0x401, 0x9, 0x5, 0xffff1f89, 0x7b, 0x7fffffff, 0x6d56048a, 0x4, 0x6, 0x5, 0x7, 0x4736, 0x0, 0x9, 0x561, 0x400, 0x8, 0x5, 0x4, 0x0, 0xffff8001, 0x3, 0xfffffffe, 0x2, 0x7, 0x800, 0x401, 0x2, 0x9, 0x8, 0x8001, 0x6, 0x4, 0x5, 0x8, 0xe7, 0xfffff000, 0x9, 0x4, 0x200, 0x1, 0x0, 0x1, 0x9, 0xffffff7f, 0xd6, 0x8, 0xff, 0x6, 0x0, 0x2, 0x7, 0x199, 0x400, 0x0, 0xa7, 0x101, 0x5, 0xd9a7, 0x1, 0x3ff, 0x5, 0x6, 0x8], [0x40, 0x2, 0x5, 0x5, 0x80000000, 0x7a, 0x4d, 0xebb, 0x8, 0x6, 0x0, 0xb3f, 0x7ff, 0x10001, 0xdda0, 0x0, 0x12, 0x9, 0x3, 0x5, 0x8001, 0x400, 0x80000000, 0x0, 0xfff, 0xfffffffe, 0x5, 0x2843, 0x20, 0x3, 0x2f9, 0x7, 0x9, 0xffffffff, 0x7fff, 0xfffffffb, 0x1, 0x80, 0x7, 0x4, 0x101, 0x4, 0x2, 0xc7c, 0x2, 0x1, 0x1, 0x10000, 0x6, 0xff, 0x0, 0x0, 0x691b, 0x9, 0x4, 0x3f, 0x0, 0x7, 0x2, 0x6, 0xfffffffd, 0x72de, 0x927, 0x1], 0x1c, ['\x00', '\x00', '/dev/binder#\x00', '/dev/binder#\x00']}, ["", "", "", "", "", ""]}, 0x43c}, 0x1, 0x0, 0x0, 0x40d0}, 0x800) syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x8, 0x101000) 01:07:24 executing program 3: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_SET_OPTION(0xffffffffffffffff, &(0x7f0000000080)={0xe, 0x18, 0xfa00, @id_afonly={0x0}}, 0x20) 01:07:24 executing program 4: socketpair(0x2c, 0x0, 0x173, &(0x7f0000000100)) 01:07:25 executing program 2: socketpair(0x22, 0x0, 0x4f01, &(0x7f0000000100)) [ 1443.843076][T16947] binder: 16944:16947 unknown command 28 [ 1443.854866][T16948] binder: 16945:16948 unknown command -1944540243 [ 1443.871291][T16947] binder: 16944:16947 ioctl c0306201 20000100 returned -22 [ 1443.889047][T16948] binder: 16945:16948 ioctl c0306201 20000100 returned -22 01:07:25 executing program 0: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r0, 0x8000000) syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x8, 0x101000) 01:07:25 executing program 3: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_SET_OPTION(0xffffffffffffffff, &(0x7f0000000080)={0xe, 0x18, 0xfa00, @id_afonly={0x0}}, 0x20) [ 1443.922661][T16956] binder: 16944:16956 unknown command 28 [ 1443.943100][T16956] binder: 16944:16956 ioctl c0306201 20000100 returned -22 01:07:25 executing program 4: socketpair(0x2c, 0x0, 0x174, &(0x7f0000000100)) 01:07:25 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_RX_RING(r1, 0x11b, 0x2, &(0x7f0000001e40)=0x100080, 0x4) r2 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_RX_RING(r2, 0x11b, 0x2, &(0x7f0000001e40)=0x100080, 0x4) r3 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_RX_RING(r3, 0x11b, 0x2, &(0x7f0000001e40)=0x100080, 0x4) r4 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_RX_RING(r4, 0x11b, 0x2, &(0x7f0000001e40)=0x100080, 0x4) r5 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_RX_RING(r5, 0x11b, 0x2, &(0x7f0000001e40)=0x100080, 0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="adab188c6f7f70e0ded9b3bc6471321f0afcf881136f2a0876dff138f28b55dab377", @ANYRES32=r2, @ANYRES32, @ANYRESDEC=r1, @ANYRES64=r3, @ANYRES16, @ANYRESDEC=r4, @ANYRESDEC=r3, @ANYRESDEC=r5, @ANYBLOB="326f5091fe6821b42184249a85417ea132335ba2b93de7175dd59bdecaae38dcf511100a01795f37af0590559d56df445ec82a36a46bace7d29ddc985ed9da6924594b32010e6677a13fe7ff7f201c4c71d5f77b50f26482eba446c0a99f8dc3d3f78efd311ba1645f3f1a3ad17b2d241e8eced870ff688a2d7c3ff8b1dcbbc2765fab10"], 0x0, 0x0, 0x0}) getsockopt$XDP_STATISTICS(r1, 0x11b, 0x7, &(0x7f0000000040), &(0x7f0000000140)=0x30) seccomp$SECCOMP_SET_MODE_FILTER(0x1, 0x2, &(0x7f00000000c0)={0x4, &(0x7f0000000080)=[{0x5, 0x5d, 0xd4, 0xfff}, {0x2, 0xfc, 0x2, 0x3}, {0x6, 0xff, 0x1, 0x8}, {0xdc65, 0x1, 0x40, 0x81}]}) 01:07:25 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_RX_RING(r1, 0x11b, 0x2, &(0x7f0000001e40)=0x100080, 0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="1ea0fd996ca45817f1d9d6f3eae58d58a01f18ef277d45b1631c46f3f61a0bdd1136ae50a635c944629a0b0e3c21115fc2dc3ff1709f4a1706b07287372b2374d0c132ca32b38b8d8ad448c69cd18d08208e087d9e4aad2824694e8dac9bf8627fd9a7a9c66ffff9c10a2de535afd1d1f677aaaf4173a6ece4f3568fbe0c8b0c0e998350bf59f5289f839bb9af5c3c0a14c7d398e64a0816a57e75c50600000000000000acc4c3e9962287bd48179533e32a3be339", @ANYRESHEX=r0, @ANYRES64=r1, @ANYRES32], 0x0, 0x0, 0x0}) 01:07:25 executing program 2: socketpair(0x22, 0x0, 0x5000, &(0x7f0000000100)) 01:07:25 executing program 4: socketpair(0x2c, 0x0, 0x175, &(0x7f0000000100)) 01:07:25 executing program 0: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x8, 0x101000) [ 1444.110678][T16966] binder: 16964:16966 unknown command -1944540243 [ 1444.126933][T16966] binder: 16964:16966 ioctl c0306201 20000100 returned -22 01:07:25 executing program 3: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_SET_OPTION(0xffffffffffffffff, &(0x7f0000000080)={0xe, 0x18, 0xfa00, @id_afonly={0x0}}, 0x20) [ 1444.186801][T16970] binder: 16968:16970 unknown command -1711431650 01:07:25 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_RX_RING(r1, 0x11b, 0x2, &(0x7f0000001e40)=0x100080, 0x4) r2 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_RX_RING(r2, 0x11b, 0x2, &(0x7f0000001e40)=0x100080, 0x4) r3 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_RX_RING(r3, 0x11b, 0x2, &(0x7f0000001e40)=0x100080, 0x4) r4 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_RX_RING(r4, 0x11b, 0x2, &(0x7f0000001e40)=0x100080, 0x4) r5 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_RX_RING(r5, 0x11b, 0x2, &(0x7f0000001e40)=0x100080, 0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="adab188c6f7f70e0ded9b3bc6471321f0afcf881136f2a0876dff138f28b55dab377", @ANYRES32=r2, @ANYRES32, @ANYRESDEC=r1, @ANYRES64=r3, @ANYRES16, @ANYRESDEC=r4, @ANYRESDEC=r3, @ANYRESDEC=r5, @ANYBLOB="326f5091fe6821b42184249a85417ea132335ba2b93de7175dd59bdecaae38dcf511100a01795f37af0590559d56df445ec82a36a46bace7d29ddc985ed9da6924594b32010e6677a13fe7ff7f201c4c71d5f77b50f26482eba446c0a99f8dc3d3f78efd311ba1645f3f1a3ad17b2d241e8eced870ff688a2d7c3ff8b1dcbbc2765fab10"], 0x0, 0x0, 0x0}) getsockopt$XDP_STATISTICS(r1, 0x11b, 0x7, &(0x7f0000000040), &(0x7f0000000140)=0x30) seccomp$SECCOMP_SET_MODE_FILTER(0x1, 0x2, &(0x7f00000000c0)={0x4, &(0x7f0000000080)=[{0x5, 0x5d, 0xd4, 0xfff}, {0x2, 0xfc, 0x2, 0x3}, {0x6, 0xff, 0x1, 0x8}, {0xdc65, 0x1, 0x40, 0x81}]}) 01:07:25 executing program 2: socketpair(0x22, 0x0, 0x5001, &(0x7f0000000100)) [ 1444.233388][T16970] binder: 16968:16970 ioctl c0306201 20000100 returned -22 01:07:25 executing program 4: socketpair(0x2c, 0x0, 0x176, &(0x7f0000000100)) 01:07:25 executing program 0: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x8, 0x101000) 01:07:25 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="1cc604faa4a0c6a8b49c9642f9940df53d8e61b30b0000ad4e2767dc1c00"], 0x0, 0x0, 0x0}) 01:07:25 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_SET_OPTION(r0, 0x0, 0x0) [ 1444.391056][T16983] binder: 16981:16983 unknown command -1944540243 [ 1444.406331][T16983] binder: 16981:16983 ioctl c0306201 20000100 returned -22 01:07:25 executing program 2: socketpair(0x22, 0x0, 0x5100, &(0x7f0000000100)) 01:07:25 executing program 5: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r0, 0x8000000) sendmsg$AUDIT_DEL_RULE(r0, &(0x7f0000000800)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f00000007c0)={&(0x7f0000000380)={0x43c, 0x3f4, 0x200, 0x70bd2d, 0x25dfdbfb, {0x0, 0x0, 0x1d, [0x5, 0x0, 0x3, 0xfff, 0x6, 0xffffff01, 0x2, 0x6, 0x1, 0x0, 0x9, 0x200, 0x4, 0x5, 0x9aa, 0x800, 0x2, 0x8, 0x11, 0xfffffff9, 0x38000, 0xffffff7f, 0x7, 0x100, 0x1, 0x39, 0x5000000, 0x1, 0x4, 0x4, 0x1, 0x1, 0x1000, 0x8, 0x5, 0x0, 0x7cbeb366, 0x4, 0x4, 0x10001, 0x4, 0x7fff, 0xfffffff8, 0x81, 0x800, 0x7fff, 0x5f, 0xfffffff9, 0x7, 0x80, 0x2, 0x7, 0x4, 0x4, 0x8, 0x0, 0x7f, 0x3, 0x0, 0x4, 0x6, 0x4, 0x8], [0x3, 0x3, 0x0, 0xffffd1e9, 0x4, 0x3ad, 0x80, 0x3f, 0x0, 0x1000, 0x2, 0x7db9fea2, 0x5, 0x8001, 0x3f, 0x20, 0x6, 0x7ff, 0x3, 0x20, 0x113, 0x5, 0x51, 0x7ff, 0x3, 0x1000, 0x1, 0x4b6, 0x4d7, 0x0, 0x781b, 0x3, 0x3, 0x1, 0x2, 0x80000000, 0x7, 0x1000, 0x6, 0xfff, 0x54, 0xaf, 0x80000001, 0xffff8001, 0x5, 0x5, 0x200, 0xb33, 0x400, 0x4, 0x1ff, 0x8c23, 0x3, 0x401, 0x9d, 0x7, 0x232d, 0x101, 0x1, 0x20, 0x1, 0x2, 0x1, 0x9], [0x401, 0x9, 0x5, 0xffff1f89, 0x7b, 0x7fffffff, 0x6d56048a, 0x4, 0x6, 0x5, 0x7, 0x4736, 0x0, 0x9, 0x561, 0x400, 0x8, 0x5, 0x4, 0x0, 0xffff8001, 0x3, 0xfffffffe, 0x2, 0x7, 0x800, 0x401, 0x2, 0x9, 0x8, 0x8001, 0x6, 0x4, 0x5, 0x8, 0xe7, 0xfffff000, 0x9, 0x4, 0x200, 0x1, 0x0, 0x1, 0x9, 0xffffff7f, 0xd6, 0x8, 0xff, 0x6, 0x0, 0x2, 0x7, 0x199, 0x400, 0x0, 0xa7, 0x101, 0x5, 0xd9a7, 0x1, 0x3ff, 0x5, 0x6, 0x8], [0x40, 0x2, 0x5, 0x5, 0x80000000, 0x7a, 0x4d, 0xebb, 0x8, 0x6, 0x0, 0xb3f, 0x7ff, 0x10001, 0xdda0, 0x0, 0x12, 0x9, 0x3, 0x5, 0x8001, 0x400, 0x80000000, 0x0, 0xfff, 0xfffffffe, 0x5, 0x2843, 0x20, 0x3, 0x2f9, 0x7, 0x9, 0xffffffff, 0x7fff, 0xfffffffb, 0x1, 0x80, 0x7, 0x4, 0x101, 0x4, 0x2, 0xc7c, 0x2, 0x1, 0x1, 0x10000, 0x6, 0xff, 0x0, 0x0, 0x691b, 0x9, 0x4, 0x3f, 0x0, 0x7, 0x2, 0x6, 0xfffffffd, 0x72de, 0x927, 0x1], 0x1c, ['\x00', '\x00', '/dev/binder#\x00', '/dev/binder#\x00']}, ["", "", "", "", "", ""]}, 0x43c}, 0x1, 0x0, 0x0, 0x40d0}, 0x800) openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x8, 0x101000) 01:07:25 executing program 4: socketpair(0x2c, 0x0, 0x177, &(0x7f0000000100)) [ 1444.500896][T16990] binder: 16989:16990 unknown command -100350436 01:07:25 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_SET_OPTION(r0, 0x0, 0x0) 01:07:25 executing program 0: syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x8, 0x101000) [ 1444.546573][T16990] binder: 16989:16990 ioctl c0306201 20000100 returned -22 01:07:25 executing program 1: rt_sigpending(&(0x7f0000000040), 0x8) syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r0, 0x8000000) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x52, 0x0, 0x0}) 01:07:25 executing program 2: socketpair(0x22, 0x0, 0x5101, &(0x7f0000000100)) 01:07:25 executing program 4: socketpair(0x2c, 0x0, 0x178, &(0x7f0000000100)) 01:07:25 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_SET_OPTION(r0, 0x0, 0x0) 01:07:25 executing program 0: syz_open_dev$sndctrl(0x0, 0x8, 0x101000) 01:07:25 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff]}) 01:07:25 executing program 4: socketpair(0x2c, 0x0, 0x179, &(0x7f0000000100)) 01:07:26 executing program 0: syz_open_dev$sndctrl(0x0, 0x8, 0x101000) 01:07:26 executing program 2: socketpair(0x22, 0x0, 0x5200, &(0x7f0000000100)) 01:07:26 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ubi_ctrl\x00', 0x519000, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x28, 0x0, &(0x7f0000000080)=[@enter_looper, @decrefs, @increfs_done, @increfs={0x40046304, 0x2}], 0x30, 0x0, &(0x7f00000000c0)="f07d6431f5edbf80b5fbab688785122b93833fd2530d3f2acec8cfe0638d21dfaab9ebb0bddf5fe52708bc3b9afd936a"}) r2 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_RX_RING(r2, 0x11b, 0x2, &(0x7f0000001e40)=0x100080, 0x4) setsockopt$XDP_UMEM_REG(r2, 0x11b, 0x4, &(0x7f0000000280)={&(0x7f00000001c0)=""/167, 0x20000, 0x800, 0x9}, 0x20) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x0, 0x0}) 01:07:26 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2]}) 01:07:26 executing program 5: socketpair(0x22, 0x0, 0x1f00, &(0x7f0000000100)) 01:07:26 executing program 0: syz_open_dev$sndctrl(0x0, 0x8, 0x101000) [ 1445.009584][T17024] binder: 17020:17024 unknown command 28 01:07:26 executing program 2: socketpair(0x22, 0x0, 0x5201, &(0x7f0000000100)) 01:07:26 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9]}) 01:07:26 executing program 4: socketpair(0x2c, 0x0, 0x17a, &(0x7f0000000100)) [ 1445.063961][T17024] binder: 17020:17024 ioctl c0306201 20000100 returned -22 01:07:26 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1]}) [ 1445.125023][T17028] binder: 17020:17028 unknown command 28 [ 1445.150130][T17028] binder: 17020:17028 ioctl c0306201 20000100 returned -22 01:07:26 executing program 2: socketpair(0x22, 0x0, 0x5300, &(0x7f0000000100)) 01:07:26 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x0, 0x0}) socket$bt_bnep(0x1f, 0x3, 0x4) 01:07:26 executing program 0: syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x0, 0x101000) 01:07:26 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="e91cd5026203576bb3c862a659339fd50b9baaffca91fd26fa82f38aece03486c432a60f960e3b8099765ca6e30580d29d35fe3ca0e021ee5036cb4f87250a6cd64a52e5684a092f15792f9d4eb445bc1b8496d7790e7fc3c5da2c7cb16d56001bbfcb62276549dd59a2005477a1a667d571305493e43a4e79bf6980381ba9821b55ec813cfbf923f890b73e42f3db04d3987769fefe26f86a6997ece555c60926d96fc25045048b7b243ba838e70dbcdd08d2d1f4e477ad3f09d7ad3fe18c2a557095bc8b2a796911d6bfa488a2f778a02f3f78fc72220f60556526cd994fad1ec0f67b481da443ede3017654e7934cf741e1e16034a13aa368f98a2e70913aab11f68a5e8c54f8454289397d2521f7f8a89efb8c0387af15690000"], 0x0, 0x0, 0x0}) r1 = syz_open_procfs(0x0, &(0x7f0000000040)='net/ipx\x00') r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000140)='/dev/zero\x00', 0x101a00, 0x0) read$rfkill(r3, &(0x7f0000000180), 0x8) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r2, 0x8000000) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f00000000c0)={0x2000, &(0x7f0000000080), 0x4, r2, 0x1}) 01:07:26 executing program 4: socketpair(0x2c, 0x0, 0x17b, &(0x7f0000000100)) 01:07:26 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f]}) [ 1445.354174][T17045] binder: 17042:17045 unknown command 28 [ 1445.373739][T17045] binder: 17042:17045 ioctl c0306201 20000100 returned -22 [ 1445.380055][T17046] binder: 17040:17046 unknown command 47521001 [ 1445.389898][T17046] binder: 17040:17046 ioctl c0306201 20000100 returned -22 01:07:26 executing program 2: socketpair(0x22, 0x0, 0x5301, &(0x7f0000000100)) 01:07:26 executing program 0: syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x0, 0x101000) 01:07:26 executing program 4: socketpair(0x2c, 0x0, 0x17c, &(0x7f0000000100)) [ 1445.409695][T17045] binder: 17042:17045 unknown command 28 [ 1445.433127][T17045] binder: 17042:17045 ioctl c0306201 20000100 returned -22 01:07:26 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9]}) 01:07:26 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="e91cd5026203576bb3c862a659339fd50b9baaffca91fd26fa82f38aece03486c432a60f960e3b8099765ca6e30580d29d35fe3ca0e021ee5036cb4f87250a6cd64a52e5684a092f15792f9d4eb445bc1b8496d7790e7fc3c5da2c7cb16d56001bbfcb62276549dd59a2005477a1a667d571305493e43a4e79bf6980381ba9821b55ec813cfbf923f890b73e42f3db04d3987769fefe26f86a6997ece555c60926d96fc25045048b7b243ba838e70dbcdd08d2d1f4e477ad3f09d7ad3fe18c2a557095bc8b2a796911d6bfa488a2f778a02f3f78fc72220f60556526cd994fad1ec0f67b481da443ede3017654e7934cf741e1e16034a13aa368f98a2e70913aab11f68a5e8c54f8454289397d2521f7f8a89efb8c0387af15690000"], 0x0, 0x0, 0x0}) r1 = syz_open_procfs(0x0, &(0x7f0000000040)='net/ipx\x00') r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000140)='/dev/zero\x00', 0x101a00, 0x0) read$rfkill(r3, &(0x7f0000000180), 0x8) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r2, 0x8000000) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f00000000c0)={0x2000, &(0x7f0000000080), 0x4, r2, 0x1}) 01:07:26 executing program 1: r0 = socket(0x1b, 0x80000, 0x3) sendmsg$AUDIT_SET(r0, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x38, 0x3e9, 0x400, 0x70bd29, 0x25dfdbfd, {0x41, 0x1, 0x1, 0x0, 0x80000000, 0x80000001, 0x7fff, 0xffff, 0x0, 0x6}, ["", "", "", "", "", "", "", "", ""]}, 0x38}, 0x1, 0x0, 0x0, 0x4008834}, 0x801) r1 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x0, 0x0}) 01:07:26 executing program 2: socketpair(0x22, 0x0, 0x5400, &(0x7f0000000100)) [ 1445.604538][T17060] binder: 17056:17060 unknown command 47521001 [ 1445.638397][T17060] binder: 17056:17060 ioctl c0306201 20000100 returned -22 01:07:26 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x0, 0x0}) socket$bt_bnep(0x1f, 0x3, 0x4) 01:07:26 executing program 4: socketpair(0x2c, 0x0, 0x17d, &(0x7f0000000100)) 01:07:26 executing program 0: syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x0, 0x101000) 01:07:26 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="e91cd5026203576bb3c862a659339fd50b9baaffca91fd26fa82f38aece03486c432a60f960e3b8099765ca6e30580d29d35fe3ca0e021ee5036cb4f87250a6cd64a52e5684a092f15792f9d4eb445bc1b8496d7790e7fc3c5da2c7cb16d56001bbfcb62276549dd59a2005477a1a667d571305493e43a4e79bf6980381ba9821b55ec813cfbf923f890b73e42f3db04d3987769fefe26f86a6997ece555c60926d96fc25045048b7b243ba838e70dbcdd08d2d1f4e477ad3f09d7ad3fe18c2a557095bc8b2a796911d6bfa488a2f778a02f3f78fc72220f60556526cd994fad1ec0f67b481da443ede3017654e7934cf741e1e16034a13aa368f98a2e70913aab11f68a5e8c54f8454289397d2521f7f8a89efb8c0387af15690000"], 0x0, 0x0, 0x0}) r1 = syz_open_procfs(0x0, &(0x7f0000000040)='net/ipx\x00') r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000140)='/dev/zero\x00', 0x101a00, 0x0) read$rfkill(r3, &(0x7f0000000180), 0x8) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r2, 0x8000000) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f00000000c0)={0x2000, &(0x7f0000000080), 0x4, r2, 0x1}) [ 1445.737958][T17067] binder: 17061:17067 unknown command 28 [ 1445.762033][T17067] binder: 17061:17067 ioctl c0306201 20000100 returned -22 01:07:26 executing program 2: socketpair(0x22, 0x0, 0x5401, &(0x7f0000000100)) [ 1445.793273][T17071] binder: 17068:17071 unknown command 28 [ 1445.821886][T17071] binder: 17068:17071 ioctl c0306201 20000100 returned -22 [ 1445.822307][T17076] binder: 17072:17076 unknown command 47521001 01:07:27 executing program 4: socketpair(0x2c, 0x0, 0x17e, &(0x7f0000000100)) 01:07:27 executing program 0: syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x8, 0x0) [ 1445.881493][T17076] binder: 17072:17076 ioctl c0306201 20000100 returned -22 01:07:27 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/ipv6_route\x00') ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000240)={0x3000, &(0x7f0000000200)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x0, 0x0}) sendmsg$AUDIT_TTY_SET(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x18, 0x3f9, 0x20, 0x70bd2c, 0x25dfdbff, {0x0, 0x1}, ["", "", "", ""]}, 0x18}, 0x1, 0x0, 0x0, 0x4000}, 0xc040) setsockopt$bt_BT_POWER(r1, 0x112, 0x9, &(0x7f0000000280)=0x7, 0x1) 01:07:27 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="e91cd5026203576bb3c862a659339fd50b9baaffca91fd26fa82f38aece03486c432a60f960e3b8099765ca6e30580d29d35fe3ca0e021ee5036cb4f87250a6cd64a52e5684a092f15792f9d4eb445bc1b8496d7790e7fc3c5da2c7cb16d56001bbfcb62276549dd59a2005477a1a667d571305493e43a4e79bf6980381ba9821b55ec813cfbf923f890b73e42f3db04d3987769fefe26f86a6997ece555c60926d96fc25045048b7b243ba838e70dbcdd08d2d1f4e477ad3f09d7ad3fe18c2a557095bc8b2a796911d6bfa488a2f778a02f3f78fc72220f60556526cd994fad1ec0f67b481da443ede3017654e7934cf741e1e16034a13aa368f98a2e70913aab11f68a5e8c54f8454289397d2521f7f8a89efb8c0387af15690000"], 0x0, 0x0, 0x0}) syz_open_procfs(0x0, &(0x7f0000000040)='net/ipx\x00') r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000140)='/dev/zero\x00', 0x101a00, 0x0) read$rfkill(r2, &(0x7f0000000180), 0x8) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r1, 0x8000000) 01:07:27 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x0, 0x0}) socket$bt_bnep(0x1f, 0x3, 0x4) 01:07:27 executing program 2: socketpair(0x22, 0x0, 0x5500, &(0x7f0000000100)) 01:07:27 executing program 4: socketpair(0x2c, 0x0, 0x17f, &(0x7f0000000100)) 01:07:27 executing program 0: syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x0, 0x101000) [ 1446.087591][T17090] binder: 17087:17090 unknown command 28 [ 1446.095676][T17089] binder: 17086:17089 unknown command 28 [ 1446.100802][T17092] binder: 17088:17092 unknown command 47521001 [ 1446.111650][T17090] binder: 17087:17090 ioctl c0306201 20000100 returned -22 [ 1446.119616][T17089] binder: 17086:17089 ioctl c0306201 20000100 returned -22 [ 1446.123664][T17092] binder: 17088:17092 ioctl c0306201 20000100 returned -22 01:07:27 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="e91cd5026203576bb3c862a659339fd50b9baaffca91fd26fa82f38aece03486c432a60f960e3b8099765ca6e30580d29d35fe3ca0e021ee5036cb4f87250a6cd64a52e5684a092f15792f9d4eb445bc1b8496d7790e7fc3c5da2c7cb16d56001bbfcb62276549dd59a2005477a1a667d571305493e43a4e79bf6980381ba9821b55ec813cfbf923f890b73e42f3db04d3987769fefe26f86a6997ece555c60926d96fc25045048b7b243ba838e70dbcdd08d2d1f4e477ad3f09d7ad3fe18c2a557095bc8b2a796911d6bfa488a2f778a02f3f78fc72220f60556526cd994fad1ec0f67b481da443ede3017654e7934cf741e1e16034a13aa368f98a2e70913aab11f68a5e8c54f8454289397d2521f7f8a89efb8c0387af15690000"], 0x0, 0x0, 0x0}) syz_open_procfs(0x0, &(0x7f0000000040)='net/ipx\x00') openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000140)='/dev/zero\x00', 0x101a00, 0x0) read$rfkill(r1, &(0x7f0000000180), 0x8) 01:07:27 executing program 2: socketpair(0x22, 0x0, 0x5501, &(0x7f0000000100)) [ 1446.186626][T17095] binder: 17086:17095 unknown command 28 [ 1446.198798][T17095] binder: 17086:17095 ioctl c0306201 20000100 returned -22 01:07:27 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="e91cd5026203576bb3c862a659339fd50b9baaffca91fd26fa82f38aece03486c432a60f960e3b8099765ca6e30580d29d35fe3ca0e021ee5036cb4f87250a6cd64a52e5684a092f15792f9d4eb445bc1b8496d7790e7fc3c5da2c7cb16d56001bbfcb62276549dd59a2005477a1a667d571305493e43a4e79bf6980381ba9821b55ec813cfbf923f890b73e42f3db04d3987769fefe26f86a6997ece555c60926d96fc25045048b7b243ba838e70dbcdd08d2d1f4e477ad3f09d7ad3fe18c2a557095bc8b2a796911d6bfa488a2f778a02f3f78fc72220f60556526cd994fad1ec0f67b481da443ede3017654e7934cf741e1e16034a13aa368f98a2e70913aab11f68a5e8c54f8454289397d2521f7f8a89efb8c0387af15690000"], 0x0, 0x0, 0x0}) syz_open_procfs(0x0, &(0x7f0000000040)='net/ipx\x00') r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000140)='/dev/zero\x00', 0x101a00, 0x0) read$rfkill(r2, &(0x7f0000000180), 0x8) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r1, 0x8000000) 01:07:27 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000180)='/dev/binder#\x00', 0x0, 0x1000) r1 = socket$xdp(0x2c, 0x3, 0x0) renameat2(0xffffffffffffffff, &(0x7f0000000280)='./file0\x00', 0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', 0x2) setsockopt$XDP_RX_RING(r1, 0x11b, 0x2, &(0x7f0000001e40)=0x100080, 0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000000)=ANY=[@ANYRES64=r1], 0x0, 0x0, 0x0}) r2 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r3, 0x8000000) syz_kvm_setup_cpu$x86(r2, r3, &(0x7f0000fe5000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f00000001c0)="67f30fc730f3440f096444f6013a0fc77521b9800000c00f3235002000000f30ddc8f3450fc730c7442400f3b60000c744240212000000c7442406000000000f011c240f013066baf80cb8f2358f85ef66bafc0cb0f8ee", 0x57}], 0x1, 0x0, &(0x7f0000000240)=[@cstype3={0x5, 0xd}, @vmwrite={0x8, 0x0, 0x7, 0x0, 0x1, 0x0, 0x2, 0x0, 0x400}], 0x2) r4 = socket$xdp(0x2c, 0x3, 0x0) r5 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ubi_ctrl\x00', 0x10200, 0x0) getsockopt$bt_BT_SNDMTU(r5, 0x112, 0xc, &(0x7f0000000340)=0x8, &(0x7f0000000380)=0x2) getpeername(r4, &(0x7f0000000040)=@sco={0x1f, @fixed}, &(0x7f00000000c0)=0x80) 01:07:27 executing program 0: syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x0, 0x101000) 01:07:27 executing program 4: socketpair(0x2c, 0x0, 0x180, &(0x7f0000000100)) [ 1446.326616][T17104] binder: 17101:17104 unknown command 47521001 [ 1446.366382][T17104] binder: 17101:17104 ioctl c0306201 20000100 returned -22 01:07:27 executing program 2: socketpair(0x22, 0x0, 0x5600, &(0x7f0000000100)) 01:07:27 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="e91cd5026203576bb3c862a659339fd50b9baaffca91fd26fa82f38aece03486c432a60f960e3b8099765ca6e30580d29d35fe3ca0e021ee5036cb4f87250a6cd64a52e5684a092f15792f9d4eb445bc1b8496d7790e7fc3c5da2c7cb16d56001bbfcb62276549dd59a2005477a1a667d571305493e43a4e79bf6980381ba9821b55ec813cfbf923f890b73e42f3db04d3987769fefe26f86a6997ece555c60926d96fc25045048b7b243ba838e70dbcdd08d2d1f4e477ad3f09d7ad3fe18c2a557095bc8b2a796911d6bfa488a2f778a02f3f78fc72220f60556526cd994fad1ec0f67b481da443ede3017654e7934cf741e1e16034a13aa368f98a2e70913aab11f68a5e8c54f8454289397d2521f7f8a89efb8c0387af15690000"], 0x0, 0x0, 0x0}) syz_open_procfs(0x0, &(0x7f0000000040)='net/ipx\x00') openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000140)='/dev/zero\x00', 0x101a00, 0x0) [ 1446.384731][T17106] binder: 17105:17106 unknown command 47521001 [ 1446.405472][T17106] binder: 17105:17106 ioctl c0306201 20000100 returned -22 01:07:27 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40]}) 01:07:27 executing program 4: socketpair(0x2c, 0x0, 0x181, &(0x7f0000000100)) [ 1446.466684][T17113] binder: 17108:17113 unknown command 4 [ 1446.498888][T17113] binder: 17108:17113 ioctl c0306201 20000100 returned -22 01:07:27 executing program 0: syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x0, 0x101000) [ 1446.555730][T17118] binder: 17115:17118 unknown command 47521001 [ 1446.565139][T17119] binder: 17108:17119 unknown command 4 [ 1446.573071][T17118] binder: 17115:17118 ioctl c0306201 20000100 returned -22 [ 1446.590057][T17119] binder: 17108:17119 ioctl c0306201 20000100 returned -22 01:07:27 executing program 2: socketpair(0x22, 0x0, 0x5601, &(0x7f0000000100)) 01:07:27 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94]}) 01:07:27 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="e91cd5026203576bb3c862a659339fd50b9baaffca91fd26fa82f38aece03486c432a60f960e3b8099765ca6e30580d29d35fe3ca0e021ee5036cb4f87250a6cd64a52e5684a092f15792f9d4eb445bc1b8496d7790e7fc3c5da2c7cb16d56001bbfcb62276549dd59a2005477a1a667d571305493e43a4e79bf6980381ba9821b55ec813cfbf923f890b73e42f3db04d3987769fefe26f86a6997ece555c60926d96fc25045048b7b243ba838e70dbcdd08d2d1f4e477ad3f09d7ad3fe18c2a557095bc8b2a796911d6bfa488a2f778a02f3f78fc72220f60556526cd994fad1ec0f67b481da443ede3017654e7934cf741e1e16034a13aa368f98a2e70913aab11f68a5e8c54f8454289397d2521f7f8a89efb8c0387af15690000"], 0x0, 0x0, 0x0}) syz_open_procfs(0x0, &(0x7f0000000040)='net/ipx\x00') openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) 01:07:27 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r1, 0x8000000) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x30, 0x0, &(0x7f0000000040)=[@release={0x40046306, 0x1}, @release, @dead_binder_done, @acquire_done={0x40106309, 0x2}], 0x8, 0x0, &(0x7f0000000080)="6f8740565469632c"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x0, 0x0}) 01:07:27 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000180)='/dev/binder#\x00', 0x0, 0x1000) r1 = socket$xdp(0x2c, 0x3, 0x0) renameat2(0xffffffffffffffff, &(0x7f0000000280)='./file0\x00', 0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', 0x2) setsockopt$XDP_RX_RING(r1, 0x11b, 0x2, &(0x7f0000001e40)=0x100080, 0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000000)=ANY=[@ANYRES64=r1], 0x0, 0x0, 0x0}) r2 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r3, 0x8000000) syz_kvm_setup_cpu$x86(r2, r3, &(0x7f0000fe5000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f00000001c0)="67f30fc730f3440f096444f6013a0fc77521b9800000c00f3235002000000f30ddc8f3450fc730c7442400f3b60000c744240212000000c7442406000000000f011c240f013066baf80cb8f2358f85ef66bafc0cb0f8ee", 0x57}], 0x1, 0x0, &(0x7f0000000240)=[@cstype3={0x5, 0xd}, @vmwrite={0x8, 0x0, 0x7, 0x0, 0x1, 0x0, 0x2, 0x0, 0x400}], 0x2) r4 = socket$xdp(0x2c, 0x3, 0x0) r5 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ubi_ctrl\x00', 0x10200, 0x0) getsockopt$bt_BT_SNDMTU(r5, 0x112, 0xc, &(0x7f0000000340)=0x8, &(0x7f0000000380)=0x2) getpeername(r4, &(0x7f0000000040)=@sco={0x1f, @fixed}, &(0x7f00000000c0)=0x80) 01:07:27 executing program 4: socketpair(0x2c, 0x0, 0x182, &(0x7f0000000100)) 01:07:27 executing program 2: socketpair(0x22, 0x0, 0x5700, &(0x7f0000000100)) [ 1446.813317][T17133] binder: 17131:17133 unknown command 28 [ 1446.819515][T17134] binder: 17129:17134 unknown command 4 [ 1446.829855][T17133] binder: 17131:17133 ioctl c0306201 20000100 returned -22 [ 1446.850101][T17137] binder: 17132:17137 unknown command 47521001 01:07:28 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff]}) [ 1446.861789][T17134] binder: 17129:17134 ioctl c0306201 20000100 returned -22 [ 1446.870349][T17139] binder: 17131:17139 unknown command 28 [ 1446.889397][T17137] binder: 17132:17137 ioctl c0306201 20000100 returned -22 [ 1446.893905][T17139] binder: 17131:17139 ioctl c0306201 20000100 returned -22 01:07:28 executing program 4: socketpair(0x2c, 0x0, 0x183, &(0x7f0000000100)) 01:07:28 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x400000000000000, 0x0}) 01:07:28 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="e91cd5026203576bb3c862a659339fd50b9baaffca91fd26fa82f38aece03486c432a60f960e3b8099765ca6e30580d29d35fe3ca0e021ee5036cb4f87250a6cd64a52e5684a092f15792f9d4eb445bc1b8496d7790e7fc3c5da2c7cb16d56001bbfcb62276549dd59a2005477a1a667d571305493e43a4e79bf6980381ba9821b55ec813cfbf923f890b73e42f3db04d3987769fefe26f86a6997ece555c60926d96fc25045048b7b243ba838e70dbcdd08d2d1f4e477ad3f09d7ad3fe18c2a557095bc8b2a796911d6bfa488a2f778a02f3f78fc72220f60556526cd994fad1ec0f67b481da443ede3017654e7934cf741e1e16034a13aa368f98a2e70913aab11f68a5e8c54f8454289397d2521f7f8a89efb8c0387af15690000"], 0x0, 0x0, 0x0}) syz_open_procfs(0x0, &(0x7f0000000040)='net/ipx\x00') 01:07:28 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="9c7551a5f427c1997135f546c1ce92b3aad3ea9f7ee6605ef7725e80b19e747594f9316f257127b2e389697eb4aee3ac7bbfae48b8c4f0c48a1dea30dfc6f4bda46fe4aba92a1e0433c15f6579a370f3ad07239fe1e142b5e2d9f3268756447ee12ad204ca312c504c09962cd0f8c793647b3e8414e68d48467f2caea704adaf1db7b79bec00f78719ebc07778fb9a9514f71ab6e51eeef70d00f66e2227332cb8ac255f0520e1e2a63c6a9eaeea3dc12f9eb8e581ab250ae89c2579d5a07da6395df6dbb8c307fa860db215bf731a2523319254c17debfa1278f7d68ad8c7be1d804bfd5f724992318e6047785bcf7660bbc29f0791e04da4650dc4119234269bfd982403c837268bf588636c5325416532cf97eaf10c14125975c14424caa617ae20c0c0604b840ca0757863dd811f415fa74beac923bc670aa4f975f1b6bf24abb10230b52fb106b67335ec66ec9613202778c3"], 0x0, 0x0, 0x0}) 01:07:28 executing program 2: socketpair(0x22, 0x0, 0x5701, &(0x7f0000000100)) 01:07:28 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613]}) 01:07:28 executing program 4: socketpair(0x2c, 0x0, 0x184, &(0x7f0000000100)) [ 1447.102593][T17149] binder: 17148:17149 unknown command 28 [ 1447.127576][T17153] binder: 17150:17153 unknown command 47521001 [ 1447.144668][T17153] binder: 17150:17153 ioctl c0306201 20000100 returned -22 01:07:28 executing program 2: socketpair(0x22, 0x0, 0x5800, &(0x7f0000000100)) [ 1447.154223][T17149] binder: 17148:17149 ioctl c0306201 20000100 returned -22 [ 1447.181377][T17155] binder: 17152:17155 unknown command -1521388132 [ 1447.218557][T17155] binder: 17152:17155 ioctl c0306201 20000100 returned -22 01:07:28 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7]}) 01:07:28 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="e91cd5026203576bb3c862a659339fd50b9baaffca91fd26fa82f38aece03486c432a60f960e3b8099765ca6e30580d29d35fe3ca0e021ee5036cb4f87250a6cd64a52e5684a092f15792f9d4eb445bc1b8496d7790e7fc3c5da2c7cb16d56001bbfcb62276549dd59a2005477a1a667d571305493e43a4e79bf6980381ba9821b55ec813cfbf923f890b73e42f3db04d3987769fefe26f86a6997ece555c60926d96fc25045048b7b243ba838e70dbcdd08d2d1f4e477ad3f09d7ad3fe18c2a557095bc8b2a796911d6bfa488a2f778a02f3f78fc72220f60556526cd994fad1ec0f67b481da443ede3017654e7934cf741e1e16034a13aa368f98a2e70913aab11f68a5e8c54f8454289397d2521f7f8a89efb8c0387af15690000"], 0x0, 0x0, 0x0}) 01:07:28 executing program 5: socketpair(0x22, 0x0, 0x301, &(0x7f0000000100)) 01:07:28 executing program 4: socketpair(0x2c, 0x0, 0x185, &(0x7f0000000100)) 01:07:28 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x2) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x0, 0x0}) 01:07:28 executing program 2: socketpair(0x22, 0x0, 0x5801, &(0x7f0000000100)) 01:07:28 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x60000000, 0x0}) [ 1447.398835][T17165] binder: 17163:17165 unknown command 47521001 [ 1447.431992][T17165] binder: 17163:17165 ioctl c0306201 20000100 returned -22 01:07:28 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x57150000, 0x0}) 01:07:28 executing program 3: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="e91cd5026203576bb3c862a659339fd50b9baaffca91fd26fa82f38aece03486c432a60f960e3b8099765ca6e30580d29d35fe3ca0e021ee5036cb4f87250a6cd64a52e5684a092f15792f9d4eb445bc1b8496d7790e7fc3c5da2c7cb16d56001bbfcb62276549dd59a2005477a1a667d571305493e43a4e79bf6980381ba9821b55ec813cfbf923f890b73e42f3db04d3987769fefe26f86a6997ece555c60926d96fc25045048b7b243ba838e70dbcdd08d2d1f4e477ad3f09d7ad3fe18c2a557095bc8b2a796911d6bfa488a2f778a02f3f78fc72220f60556526cd994fad1ec0f67b481da443ede3017654e7934cf741e1e16034a13aa368f98a2e70913aab11f68a5e8c54f8454289397d2521f7f8a89efb8c0387af15690000"], 0x0, 0x0, 0x0}) 01:07:28 executing program 4: socketpair(0x2c, 0x0, 0x186, &(0x7f0000000100)) [ 1447.502394][T17173] binder: 17170:17173 unknown command 28 [ 1447.520214][T17173] binder: 17170:17173 ioctl c0306201 20000100 returned -22 01:07:28 executing program 2: socketpair(0x22, 0x0, 0x5900, &(0x7f0000000100)) [ 1447.560037][T17175] binder: 17174:17175 unknown command 28 [ 1447.574770][T17175] binder: 17174:17175 ioctl c0306201 20000100 returned -22 [ 1447.586855][T17177] binder: 17170:17177 unknown command 28 [ 1447.604386][T17177] binder: 17170:17177 ioctl c0306201 20000100 returned -22 [ 1447.629881][T17181] binder: 17178:17181 unknown command 28 [ 1447.647436][T17181] binder: 17178:17181 ioctl c0306201 20000100 returned -22 01:07:28 executing program 3: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="e91cd5026203576bb3c862a659339fd50b9baaffca91fd26fa82f38aece03486c432a60f960e3b8099765ca6e30580d29d35fe3ca0e021ee5036cb4f87250a6cd64a52e5684a092f15792f9d4eb445bc1b8496d7790e7fc3c5da2c7cb16d56001bbfcb62276549dd59a2005477a1a667d571305493e43a4e79bf6980381ba9821b55ec813cfbf923f890b73e42f3db04d3987769fefe26f86a6997ece555c60926d96fc25045048b7b243ba838e70dbcdd08d2d1f4e477ad3f09d7ad3fe18c2a557095bc8b2a796911d6bfa488a2f778a02f3f78fc72220f60556526cd994fad1ec0f67b481da443ede3017654e7934cf741e1e16034a13aa368f98a2e70913aab11f68a5e8c54f8454289397d2521f7f8a89efb8c0387af15690000"], 0x0, 0x0, 0x0}) 01:07:28 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x4c000000, 0x0}) 01:07:28 executing program 0: socketpair(0x2c, 0x0, 0xd4, &(0x7f0000000100)) 01:07:28 executing program 4: socketpair(0x2c, 0x0, 0x187, &(0x7f0000000100)) 01:07:28 executing program 1: pipe(&(0x7f0000000040)={0xffffffffffffffff}) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f0000000080)={r0, 0x1, 0x4000, 0x1000000000000}) r1 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) getitimer(0x1, &(0x7f0000000000)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x0, 0x0}) 01:07:28 executing program 2: socketpair(0x22, 0x0, 0x5901, &(0x7f0000000100)) [ 1447.812020][T17191] binder: 17188:17191 unknown command 28 [ 1447.820770][T17193] binder: 17186:17193 unknown command 28 [ 1447.834213][T17191] binder: 17188:17191 ioctl c0306201 20000100 returned -22 [ 1447.846417][T17193] binder: 17186:17193 ioctl c0306201 20000100 returned -22 01:07:29 executing program 3: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="e91cd5026203576bb3c862a659339fd50b9baaffca91fd26fa82f38aece03486c432a60f960e3b8099765ca6e30580d29d35fe3ca0e021ee5036cb4f87250a6cd64a52e5684a092f15792f9d4eb445bc1b8496d7790e7fc3c5da2c7cb16d56001bbfcb62276549dd59a2005477a1a667d571305493e43a4e79bf6980381ba9821b55ec813cfbf923f890b73e42f3db04d3987769fefe26f86a6997ece555c60926d96fc25045048b7b243ba838e70dbcdd08d2d1f4e477ad3f09d7ad3fe18c2a557095bc8b2a796911d6bfa488a2f778a02f3f78fc72220f60556526cd994fad1ec0f67b481da443ede3017654e7934cf741e1e16034a13aa368f98a2e70913aab11f68a5e8c54f8454289397d2521f7f8a89efb8c0387af15690000"], 0x0, 0x0, 0x0}) 01:07:29 executing program 4: socketpair(0x2c, 0x0, 0x188, &(0x7f0000000100)) 01:07:29 executing program 0: socketpair(0x22, 0x0, 0x1f0, &(0x7f0000000100)) [ 1447.892277][T17197] binder: 17188:17197 unknown command 28 [ 1447.908361][T17197] binder: 17188:17197 ioctl c0306201 20000100 returned -22 01:07:29 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x1000000, 0x0}) 01:07:29 executing program 2: socketpair(0x22, 0x0, 0x5a00, &(0x7f0000000100)) 01:07:29 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x0, 0x0}) pipe(&(0x7f0000000040)) 01:07:29 executing program 3: r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="e91cd5026203576bb3c862a659339fd50b9baaffca91fd26fa82f38aece03486c432a60f960e3b8099765ca6e30580d29d35fe3ca0e021ee5036cb4f87250a6cd64a52e5684a092f15792f9d4eb445bc1b8496d7790e7fc3c5da2c7cb16d56001bbfcb62276549dd59a2005477a1a667d571305493e43a4e79bf6980381ba9821b55ec813cfbf923f890b73e42f3db04d3987769fefe26f86a6997ece555c60926d96fc25045048b7b243ba838e70dbcdd08d2d1f4e477ad3f09d7ad3fe18c2a557095bc8b2a796911d6bfa488a2f778a02f3f78fc72220f60556526cd994fad1ec0f67b481da443ede3017654e7934cf741e1e16034a13aa368f98a2e70913aab11f68a5e8c54f8454289397d2521f7f8a89efb8c0387af15690000"], 0x0, 0x0, 0x0}) 01:07:29 executing program 0: pipe(&(0x7f0000000040)={0xffffffffffffffff}) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f0000000080)={r0, 0x1, 0x4000, 0x1000000000000}) r1 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) getitimer(0x1, &(0x7f0000000000)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x0, 0x0}) 01:07:29 executing program 4: socketpair(0x2c, 0x0, 0x189, &(0x7f0000000100)) 01:07:29 executing program 2: socketpair(0x22, 0x0, 0x5a01, &(0x7f0000000100)) [ 1448.132297][T17208] binder: 17206:17208 unknown command 28 [ 1448.140431][T17208] binder: 17206:17208 ioctl c0306201 20000100 returned -22 [ 1448.168405][T17209] binder: 17207:17209 unknown command 28 [ 1448.195191][T17209] binder: 17207:17209 ioctl c0306201 20000100 returned -22 [ 1448.213188][T17214] binder: 17211:17214 unknown command 28 01:07:29 executing program 5: socketpair(0x22, 0x0, 0x1e7, &(0x7f0000000100)) 01:07:29 executing program 3: r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="e91cd5026203576bb3c862a659339fd50b9baaffca91fd26fa82f38aece03486c432a60f960e3b8099765ca6e30580d29d35fe3ca0e021ee5036cb4f87250a6cd64a52e5684a092f15792f9d4eb445bc1b8496d7790e7fc3c5da2c7cb16d56001bbfcb62276549dd59a2005477a1a667d571305493e43a4e79bf6980381ba9821b55ec813cfbf923f890b73e42f3db04d3987769fefe26f86a6997ece555c60926d96fc25045048b7b243ba838e70dbcdd08d2d1f4e477ad3f09d7ad3fe18c2a557095bc8b2a796911d6bfa488a2f778a02f3f78fc72220f60556526cd994fad1ec0f67b481da443ede3017654e7934cf741e1e16034a13aa368f98a2e70913aab11f68a5e8c54f8454289397d2521f7f8a89efb8c0387af15690000"], 0x0, 0x0, 0x0}) [ 1448.241993][T17214] binder: 17211:17214 ioctl c0306201 20000100 returned -22 01:07:29 executing program 2: socketpair(0x22, 0x0, 0x5b00, &(0x7f0000000100)) 01:07:29 executing program 4: socketpair(0x2c, 0x0, 0x18a, &(0x7f0000000100)) 01:07:29 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1e"], 0x0, 0x0, 0x0}) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(0xffffffffffffffff, 0xc4c85512, &(0x7f00000001c0)={{0x7, 0x5, 0x5, 0xfffffffa, 'syz0\x00', 0x3f}, 0x1, [0x2, 0xff, 0x3, 0x10001, 0x3, 0x9, 0x820, 0x1aeab14d, 0x0, 0x6, 0x40, 0x7f000, 0x8, 0x5, 0x1, 0x1000, 0x8, 0xffff, 0x3f, 0x5, 0xffffffff7fffffff, 0x9, 0x740, 0x4, 0x2, 0x6, 0x2, 0x4, 0x100000001, 0x8, 0x40, 0x7, 0x1e4f, 0x3, 0x6, 0x0, 0x7fff, 0x3, 0x3, 0x36, 0x401, 0x5, 0xffffffffffffffdf, 0x771, 0x576, 0xabd, 0x1, 0x40, 0x80000000, 0x2, 0x100, 0x8, 0x1, 0x7, 0x100, 0x1f, 0x3, 0x10000, 0x1, 0x6, 0x0, 0x3, 0xb378, 0x7, 0x3, 0x5, 0xf5, 0x6, 0x4, 0x9, 0x4, 0x5, 0x5, 0x1, 0x4, 0x2, 0x9, 0xfffffffffffffff8, 0xeb8f, 0x8000, 0x6, 0x7, 0xfffffffffffffffe, 0x9, 0x10001, 0x7ff, 0x5, 0x1, 0x6, 0xffffffffffffff7f, 0x9, 0xaf, 0x7f, 0x7fff, 0x8, 0x3ce675ce, 0x1, 0xfffffffffffffffc, 0x3, 0x6, 0x5, 0x200, 0xfffffffffffffefe, 0x1, 0x2, 0x2, 0x0, 0x2604, 0x2, 0x9, 0x6, 0x7fffffff, 0x5, 0x229f, 0x0, 0x5, 0x8, 0x6, 0x1f, 0xa9, 0x80000001, 0x8, 0x3, 0x3, 0x6, 0x1ff, 0x498, 0x9]}) 01:07:29 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1]}) 01:07:29 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8, 0x0, 0x2, 0x39, 0x6, 0x9, 0x1, 0x7]}) 01:07:29 executing program 3: r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="e91cd5026203576bb3c862a659339fd50b9baaffca91fd26fa82f38aece03486c432a60f960e3b8099765ca6e30580d29d35fe3ca0e021ee5036cb4f87250a6cd64a52e5684a092f15792f9d4eb445bc1b8496d7790e7fc3c5da2c7cb16d56001bbfcb62276549dd59a2005477a1a667d571305493e43a4e79bf6980381ba9821b55ec813cfbf923f890b73e42f3db04d3987769fefe26f86a6997ece555c60926d96fc25045048b7b243ba838e70dbcdd08d2d1f4e477ad3f09d7ad3fe18c2a557095bc8b2a796911d6bfa488a2f778a02f3f78fc72220f60556526cd994fad1ec0f67b481da443ede3017654e7934cf741e1e16034a13aa368f98a2e70913aab11f68a5e8c54f8454289397d2521f7f8a89efb8c0387af15690000"], 0x0, 0x0, 0x0}) [ 1448.432370][T17229] binder: 17224:17229 unknown command 30 [ 1448.462980][T17229] binder: 17224:17229 ioctl c0306201 20000100 returned -22 01:07:29 executing program 2: socketpair(0x22, 0x0, 0x5b01, &(0x7f0000000100)) 01:07:29 executing program 4: socketpair(0x2c, 0x0, 0x18b, &(0x7f0000000100)) 01:07:29 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8]}) 01:07:29 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8]}) 01:07:29 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ubi_ctrl\x00', 0x2a0100, 0x0) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r1, &(0x7f00000000c0)={0x10, 0x30, 0xfa00, {&(0x7f0000000080), 0x2, {0xa, 0x4e24, 0xca, @mcast2, 0x4e40}}}, 0x38) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x0, 0x0}) 01:07:29 executing program 3: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="e91cd5026203576bb3c862a659339fd50b9baaffca91fd26fa82f38aece03486c432a60f960e3b8099765ca6e30580d29d35fe3ca0e021ee5036cb4f87250a6cd64a52e5684a092f15792f9d4eb445bc1b8496d7790e7fc3c5da2c7cb16d56001bbfcb62276549dd59a2005477a1a667d571305493e43a4e79bf6980381ba9821b55ec813cfbf923f890b73e42f3db04d3987769fefe26f86a6997ece555c60926d96fc25045048b7b243ba838e70dbcdd08d2d1f4e477ad3f09d7ad3fe18c2a557095bc8b2a796911d6bfa488a2f778a02f3f78fc72220f60556526cd994fad1ec0f67b481da443ede3017654e7934cf741e1e16034a13aa368f98a2e70913aab11f68a5e8c54f8454289397d2521f7f8a89efb8c0387af15690000"], 0x0, 0x0, 0x0}) 01:07:29 executing program 2: socketpair(0x22, 0x0, 0x5c00, &(0x7f0000000100)) 01:07:29 executing program 4: socketpair(0x2c, 0x0, 0x18c, &(0x7f0000000100)) 01:07:29 executing program 5: r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="e91cd5026203576bb3c862a659339fd50b9baaffca91fd26fa82f38aece03486c432a60f960e3b8099765ca6e30580d29d35fe3ca0e021ee5036cb4f87250a6cd64a52e5684a092f15792f9d4eb445bc1b8496d7790e7fc3c5da2c7cb16d56001bbfcb62276549dd59a2005477a1a667d571305493e43a4e79bf6980381ba9821b55ec813cfbf923f890b73e42f3db04d3987769fefe26f86a6997ece555c60926d96fc25045048b7b243ba838e70dbcdd08d2d1f4e477ad3f09d7ad3fe18c2a557095bc8b2a796911d6bfa488a2f778a02f3f78fc72220f60556526cd994fad1ec0f67b481da443ede3017654e7934cf741e1e16034a13aa368f98a2e70913aab11f68a5e8c54f8454289397d2521f7f8a89efb8c0387af15690000"], 0x0, 0x0, 0x0}) 01:07:29 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8, 0x0, 0x2]}) [ 1448.706532][T17245] binder: 17243:17245 unknown command 28 [ 1448.727565][T17245] binder: 17243:17245 ioctl c0306201 20000100 returned -22 01:07:29 executing program 4: socketpair(0x2c, 0x0, 0x18d, &(0x7f0000000100)) 01:07:29 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x800) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x0, 0x0}) 01:07:30 executing program 3: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="e91cd5026203576bb3c862a659339fd50b9baaffca91fd26fa82f38aece03486c432a60f960e3b8099765ca6e30580d29d35fe3ca0e021ee5036cb4f87250a6cd64a52e5684a092f15792f9d4eb445bc1b8496d7790e7fc3c5da2c7cb16d56001bbfcb62276549dd59a2005477a1a667d571305493e43a4e79bf6980381ba9821b55ec813cfbf923f890b73e42f3db04d3987769fefe26f86a6997ece555c60926d96fc25045048b7b243ba838e70dbcdd08d2d1f4e477ad3f09d7ad3fe18c2a557095bc8b2a796911d6bfa488a2f778a02f3f78fc72220f60556526cd994fad1ec0f67b481da443ede3017654e7934cf741e1e16034a13aa368f98a2e70913aab11f68a5e8c54f8454289397d2521f7f8a89efb8c0387af15690000"], 0x0, 0x0, 0x0}) 01:07:30 executing program 2: socketpair(0x22, 0x0, 0x5c01, &(0x7f0000000100)) 01:07:30 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x3, 0xa2, 0x80000000, 'syz0\x00', 0x8}, 0x1, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8, 0x0, 0x2, 0x39, 0x6, 0x9, 0x1, 0x7, 0x7, 0x6]}) 01:07:30 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x48, 0x0}) 01:07:30 executing program 4: socketpair(0x2c, 0x0, 0x18e, &(0x7f0000000100)) [ 1448.944039][T17261] binder: 17258:17261 unknown command 28 [ 1448.977099][T17261] binder: 17258:17261 ioctl c0306201 20000100 returned -22 01:07:30 executing program 3: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="e91cd5026203576bb3c862a659339fd50b9baaffca91fd26fa82f38aece03486c432a60f960e3b8099765ca6e30580d29d35fe3ca0e021ee5036cb4f87250a6cd64a52e5684a092f15792f9d4eb445bc1b8496d7790e7fc3c5da2c7cb16d56001bbfcb62276549dd59a2005477a1a667d571305493e43a4e79bf6980381ba9821b55ec813cfbf923f890b73e42f3db04d3987769fefe26f86a6997ece555c60926d96fc25045048b7b243ba838e70dbcdd08d2d1f4e477ad3f09d7ad3fe18c2a557095bc8b2a796911d6bfa488a2f778a02f3f78fc72220f60556526cd994fad1ec0f67b481da443ede3017654e7934cf741e1e16034a13aa368f98a2e70913aab11f68a5e8c54f8454289397d2521f7f8a89efb8c0387af15690000"], 0x0, 0x0, 0x0}) 01:07:30 executing program 1: ioctl$SNDRV_CTL_IOCTL_ELEM_READ(0xffffffffffffffff, 0xc4c85512, &(0x7f00000001c0)={{0x8, 0x5, 0xffffff36, 0x4, 'syz1\x00', 0x10001}, 0x0, [0x5, 0x101, 0x4, 0x3, 0xf1e6, 0xffffffffffffffc1, 0x2, 0xf8, 0x5, 0x4, 0xe4, 0x2, 0xffffffffffffceb7, 0x6, 0x7, 0x5, 0x0, 0x6, 0x3, 0x8, 0xff, 0x1, 0x800, 0xff, 0x101, 0x4, 0x1ff, 0x5, 0x5, 0x0, 0x9, 0x6, 0x96f8000000000000, 0x1, 0x100000000, 0x3, 0x2, 0x100, 0x1, 0x4, 0x101, 0x800, 0x7fff, 0x1000, 0xd9, 0x7, 0x4, 0x80, 0x0, 0x0, 0xfa, 0x19, 0x7fffffff, 0x67, 0xffffffff, 0xfdaa561, 0x0, 0x3ff, 0x6, 0x43, 0x3, 0x1, 0x8, 0x2f, 0x6, 0x6, 0x80, 0x4, 0x6, 0x0, 0x2, 0x29, 0x101, 0x48f87734, 0x7, 0xc9b2, 0x0, 0x10000, 0x3, 0x7c377f1f, 0x8, 0x1, 0x8, 0x6, 0x5, 0xfffffffffffffffb, 0x9, 0x521, 0x0, 0x3, 0x9, 0x1f, 0x8, 0x3, 0x4, 0x8, 0x7d90, 0x9, 0x4, 0xd6a, 0x2, 0x6, 0x1, 0x3f, 0x0, 0xff, 0x3, 0x6, 0x7, 0x1, 0x1000, 0x401, 0x7fff, 0x7, 0x5, 0x80000001, 0x9, 0x3, 0x9, 0x0, 0x8, 0x303, 0x3, 0x6, 0x2, 0x5, 0x40, 0x3]}) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x0, 0x0}) ioctl$SNDRV_CTL_IOCTL_TLV_COMMAND(0xffffffffffffffff, 0xc008551c, &(0x7f0000000040)={0x200, 0x1c, [0x2, 0x1000, 0x6, 0x401, 0x1, 0x9, 0x40]}) 01:07:30 executing program 2: socketpair(0x22, 0x0, 0x5d00, &(0x7f0000000100)) 01:07:30 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x3, 0xa2, 0x80000000, 'syz0\x00', 0x8}, 0x1, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8, 0x0, 0x2, 0x39, 0x6, 0x9, 0x1, 0x7, 0x7, 0x6]}) [ 1449.109441][T17270] binder: 17268:17270 unknown command 28 [ 1449.120003][T17270] binder: 17268:17270 ioctl c0306201 20000100 returned -22 01:07:30 executing program 4: socketpair(0x2c, 0x0, 0x18f, &(0x7f0000000100)) 01:07:30 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x7, 0x0}) 01:07:30 executing program 2: socketpair(0x22, 0x0, 0x5d01, &(0x7f0000000100)) 01:07:30 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) [ 1449.217396][T17276] binder: 17274:17276 unknown command 28 [ 1449.237217][T17276] binder: 17274:17276 ioctl c0306201 20000100 returned -22 [ 1449.291527][T17281] binder: 17274:17281 unknown command 28 [ 1449.320186][T17281] binder: 17274:17281 ioctl c0306201 20000100 returned -22 [ 1449.334329][T17283] binder: 17282:17283 unknown command 28 01:07:30 executing program 4: socketpair(0x2c, 0x0, 0x190, &(0x7f0000000100)) 01:07:30 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x3, 0xa2, 0x80000000, 'syz0\x00', 0x8}, 0x1, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8, 0x0, 0x2, 0x39, 0x6, 0x9, 0x1, 0x7, 0x7, 0x6]}) [ 1449.355943][T17283] binder: 17282:17283 ioctl c0306201 20000100 returned -22 [ 1449.384695][T17286] binder: 17284:17286 ioctl c0306201 0 returned -14 01:07:30 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x0, 0x0}) r1 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x800) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080), 0x84, 0x0, &(0x7f00000001c0)="8c6b955ca5ea5fd694b827f2b503b768318ae5571aa4af98fcfb797ef401458b59a642ba70a1e8acfb83f9d5e4ebce1d6aec5ccbe3701c12ec8729147d7b734e7c973fc3def16c3898fadf32f6e1dac91d717cf039230218cdfce6ffcd024a43559ed532b1465ad4792319e2a85ce21184dd703438a91056e87d908e8477f1cadf81f08e"}) 01:07:30 executing program 2: socketpair(0x22, 0x0, 0x5e00, &(0x7f0000000100)) 01:07:30 executing program 0: socketpair(0x22, 0x0, 0x5d01, &(0x7f0000000100)) 01:07:30 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 01:07:30 executing program 4: socketpair(0x2c, 0x0, 0x191, &(0x7f0000000100)) 01:07:30 executing program 5: ioctl$SNDRV_CTL_IOCTL_ELEM_READ(0xffffffffffffffff, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x3, 0xa2, 0x80000000, 'syz0\x00', 0x8}, 0x1, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8, 0x0, 0x2, 0x39, 0x6, 0x9, 0x1, 0x7, 0x7, 0x6]}) 01:07:30 executing program 2: socketpair(0x22, 0x0, 0x5e01, &(0x7f0000000100)) [ 1449.558816][T17295] binder: 17291:17295 unknown command 28 [ 1449.590053][T17295] binder: 17291:17295 ioctl c0306201 20000100 returned -22 01:07:30 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 01:07:30 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="a749a79c0700000000000000"], 0x0, 0x0, 0x0}) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) read$eventfd(r1, &(0x7f0000000140), 0x8) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r1, 0x8000000) getsockopt$bt_BT_RCVMTU(r1, 0x112, 0xd, &(0x7f0000000080)=0x3, &(0x7f00000000c0)=0x2) 01:07:30 executing program 4: socketpair(0x2c, 0x0, 0x192, &(0x7f0000000100)) [ 1449.680963][T17303] binder: 17298:17303 ioctl c0306201 0 returned -14 01:07:30 executing program 5: ioctl$SNDRV_CTL_IOCTL_ELEM_READ(0xffffffffffffffff, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x3, 0xa2, 0x80000000, 'syz0\x00', 0x8}, 0x1, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8, 0x0, 0x2, 0x39, 0x6, 0x9, 0x1, 0x7, 0x7, 0x6]}) 01:07:30 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) [ 1449.755877][T17308] binder: 17306:17308 ioctl c0306201 0 returned -14 01:07:30 executing program 2: socketpair(0x22, 0x0, 0x5f00, &(0x7f0000000100)) 01:07:31 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(r0, 0xc1205531, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x8, [], [], [], 0x401, 0x80000000, 0x4, 0x3, "989df9a5985bb3d432e8bc62db5372bc"}) [ 1449.828704][T17310] binder: 17309:17310 unknown command -1666758233 [ 1449.846663][T17310] binder: 17309:17310 ioctl c0306201 20000100 returned -22 [ 1449.884681][T17310] binder: 17309:17310 unknown command -1666758233 [ 1449.894409][T17316] binder: 17314:17316 ioctl c0306201 0 returned -14 [ 1449.906928][T17310] binder: 17309:17310 ioctl c0306201 20000100 returned -22 01:07:31 executing program 4: socketpair(0x2c, 0x0, 0x193, &(0x7f0000000100)) 01:07:31 executing program 5: ioctl$SNDRV_CTL_IOCTL_ELEM_READ(0xffffffffffffffff, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x3, 0xa2, 0x80000000, 'syz0\x00', 0x8}, 0x1, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8, 0x0, 0x2, 0x39, 0x6, 0x9, 0x1, 0x7, 0x7, 0x6]}) 01:07:31 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, 0x0, 0x0, 0x0, 0x0}) 01:07:31 executing program 1: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r0, 0x8000000) syz_kvm_setup_cpu$x86(r0, 0xffffffffffffffff, &(0x7f0000fe5000/0x18000)=nil, &(0x7f0000000080)=[@text16={0x10, &(0x7f0000000040)="f26d0f07baa100ec2ef30f52d59ad22cb2009a9f00f60066b9850a000066b883a02d4b66bad849f2470f30c90f194bbd0fc79affff", 0x35}], 0x1, 0x48, &(0x7f00000000c0), 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x0, 0x0}) 01:07:31 executing program 2: socketpair(0x22, 0x0, 0x5f01, &(0x7f0000000100)) 01:07:31 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(r0, 0xc1205531, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x8, [], [], [], 0x401, 0x80000000, 0x4, 0x3, "989df9a5985bb3d432e8bc62db5372bc"}) 01:07:31 executing program 4: socketpair(0x2c, 0x0, 0x194, &(0x7f0000000100)) [ 1450.128664][T17333] binder: 17327:17333 ioctl c0306201 20000100 returned -14 01:07:31 executing program 2: socketpair(0x22, 0x0, 0x6000, &(0x7f0000000100)) 01:07:31 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(r0, 0xc1205531, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x8, [], [], [], 0x401, 0x80000000, 0x4, 0x3, "989df9a5985bb3d432e8bc62db5372bc"}) 01:07:31 executing program 5: r0 = syz_open_dev$sndctrl(0x0, 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x3, 0xa2, 0x80000000, 'syz0\x00', 0x8}, 0x1, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8, 0x0, 0x2, 0x39, 0x6, 0x9, 0x1, 0x7, 0x7, 0x6]}) [ 1450.191044][T17332] binder: 17325:17332 unknown command 28 01:07:31 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, 0x0, 0x0, 0x0, 0x0}) 01:07:31 executing program 4: socketpair(0x2c, 0x0, 0x195, &(0x7f0000000100)) [ 1450.242345][T17332] binder: 17325:17332 ioctl c0306201 20000100 returned -22 01:07:31 executing program 0: ioctl$SNDRV_CTL_IOCTL_PCM_INFO(0xffffffffffffffff, 0xc1205531, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x8, [], [], [], 0x401, 0x80000000, 0x4, 0x3, "989df9a5985bb3d432e8bc62db5372bc"}) 01:07:31 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_RX_RING(r1, 0x11b, 0x2, &(0x7f0000001e40)=0x100080, 0x4) r2 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_RX_RING(r2, 0x11b, 0x2, &(0x7f0000001e40)=0x100080, 0x4) r3 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_RX_RING(r3, 0x11b, 0x2, &(0x7f0000001e40)=0x100080, 0x4) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x111, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_INIT_QP_ATTR(0xffffffffffffffff, &(0x7f00000001c0)={0xb, 0x10, 0xfa00, {&(0x7f0000000040), r4, 0x403d}}, 0x18) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x0, 0x0}) mmap$binder(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x7) 01:07:31 executing program 5: r0 = syz_open_dev$sndctrl(0x0, 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x3, 0xa2, 0x80000000, 'syz0\x00', 0x8}, 0x1, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8, 0x0, 0x2, 0x39, 0x6, 0x9, 0x1, 0x7, 0x7, 0x6]}) [ 1450.402373][T17347] binder: 17344:17347 ioctl c0306201 20000100 returned -14 01:07:31 executing program 4: socketpair(0x2c, 0x0, 0x196, &(0x7f0000000100)) 01:07:31 executing program 2: socketpair(0x22, 0x0, 0x6001, &(0x7f0000000100)) 01:07:31 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, 0x0, 0x0, 0x0, 0x0}) 01:07:31 executing program 0: ioctl$SNDRV_CTL_IOCTL_PCM_INFO(0xffffffffffffffff, 0xc1205531, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x8, [], [], [], 0x401, 0x80000000, 0x4, 0x3, "989df9a5985bb3d432e8bc62db5372bc"}) 01:07:31 executing program 5: r0 = syz_open_dev$sndctrl(0x0, 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x3, 0xa2, 0x80000000, 'syz0\x00', 0x8}, 0x1, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8, 0x0, 0x2, 0x39, 0x6, 0x9, 0x1, 0x7, 0x7, 0x6]}) [ 1450.533466][T17353] binder: 17349:17353 unknown command 0 01:07:31 executing program 4: socketpair(0x2c, 0x0, 0x197, &(0x7f0000000100)) [ 1450.583625][T17353] binder: 17349:17353 ioctl c0306201 20000100 returned -22 [ 1450.609846][T17359] binder: 17356:17359 ioctl c0306201 20000100 returned -14 01:07:31 executing program 2: socketpair(0x22, 0x0, 0x6100, &(0x7f0000000100)) 01:07:31 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x3, 0xa2, 0x80000000, 'syz0\x00', 0x8}, 0x1, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8, 0x0, 0x2, 0x39, 0x6, 0x9, 0x1, 0x7, 0x7, 0x6]}) 01:07:31 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) pipe(&(0x7f0000000040)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x0, 0x0}) 01:07:31 executing program 0: ioctl$SNDRV_CTL_IOCTL_PCM_INFO(0xffffffffffffffff, 0xc1205531, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x8, [], [], [], 0x401, 0x80000000, 0x4, 0x3, "989df9a5985bb3d432e8bc62db5372bc"}) 01:07:31 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f00000002c0)=ANY=[], 0x0, 0x0, 0x0}) 01:07:31 executing program 4: socketpair(0x2c, 0x0, 0x198, &(0x7f0000000100)) 01:07:31 executing program 2: socketpair(0x22, 0x0, 0x6101, &(0x7f0000000100)) [ 1450.814840][T17375] binder: 17372:17375 unknown command 28 [ 1450.832752][T17375] binder: 17372:17375 ioctl c0306201 20000080 returned -22 01:07:32 executing program 0: r0 = syz_open_dev$sndctrl(0x0, 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(r0, 0xc1205531, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x8, [], [], [], 0x401, 0x80000000, 0x4, 0x3, "989df9a5985bb3d432e8bc62db5372bc"}) 01:07:32 executing program 4: socketpair(0x2c, 0x0, 0x199, &(0x7f0000000100)) [ 1450.861378][T17378] binder: 17374:17378 unknown command 0 [ 1450.870662][T17380] binder: 17372:17380 unknown command 28 [ 1450.877638][T17378] binder: 17374:17378 ioctl c0306201 20000100 returned -22 [ 1450.892736][T17380] binder: 17372:17380 ioctl c0306201 20000080 returned -22 01:07:32 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x3, 0xa2, 0x80000000, 'syz0\x00', 0x8}, 0x1, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8, 0x0, 0x2, 0x39, 0x6, 0x9, 0x1, 0x7, 0x7, 0x6]}) 01:07:32 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f00000002c0)=ANY=[], 0x0, 0x0, 0x0}) 01:07:32 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x0, 0x0}) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(0xffffffffffffffff, 0xc1205531, &(0x7f00000001c0)={0x4, 0xa9, 0x8001, 0x1ff, [], [], [], 0x4, 0x6cd9642d, 0x9, 0x16d, "6fc5f262265c8797ec4f18077118a7b9"}) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ubi_ctrl\x00', 0x20643, 0x0) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_INFO(r1, 0xc10c5541, &(0x7f0000000300)={0x2, 0xf0, 0x1}) 01:07:32 executing program 2: socketpair(0x22, 0x0, 0x6200, &(0x7f0000000100)) 01:07:32 executing program 0: r0 = syz_open_dev$sndctrl(0x0, 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(r0, 0xc1205531, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x8, [], [], [], 0x401, 0x80000000, 0x4, 0x3, "989df9a5985bb3d432e8bc62db5372bc"}) 01:07:32 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x3, 0xa2, 0x80000000, 'syz0\x00', 0x8}, 0x1, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8, 0x0, 0x2, 0x39, 0x6, 0x9, 0x1, 0x7, 0x7, 0x6]}) 01:07:32 executing program 4: socketpair(0x2c, 0x0, 0x19a, &(0x7f0000000100)) [ 1451.082457][T17390] binder: 17389:17390 unknown command 0 [ 1451.109808][T17390] binder: 17389:17390 ioctl c0306201 20000100 returned -22 01:07:32 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f00000002c0)=ANY=[], 0x0, 0x0, 0x0}) [ 1451.152696][T17394] binder: 17391:17394 unknown command 28 [ 1451.176576][T17394] binder: 17391:17394 ioctl c0306201 20000100 returned -22 01:07:32 executing program 2: socketpair(0x22, 0x0, 0x6201, &(0x7f0000000100)) 01:07:32 executing program 0: r0 = syz_open_dev$sndctrl(0x0, 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(r0, 0xc1205531, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x8, [], [], [], 0x401, 0x80000000, 0x4, 0x3, "989df9a5985bb3d432e8bc62db5372bc"}) [ 1451.243559][T17394] binder: 17391:17394 unknown command 28 01:07:32 executing program 5: syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(0xffffffffffffffff, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x3, 0xa2, 0x80000000, 'syz0\x00', 0x8}, 0x1, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8, 0x0, 0x2, 0x39, 0x6, 0x9, 0x1, 0x7, 0x7, 0x6]}) 01:07:32 executing program 4: socketpair(0x2c, 0x0, 0x19b, &(0x7f0000000100)) [ 1451.284795][T17394] binder: 17391:17394 ioctl c0306201 20000100 returned -22 [ 1451.305630][T17405] binder: 17403:17405 unknown command 0 [ 1451.326522][T17405] binder: 17403:17405 ioctl c0306201 20000100 returned -22 01:07:32 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="1c", @ANYRESDEC=r0, @ANYRES64=r0, @ANYRES32=r0], 0x0, 0x0, 0x0}) 01:07:32 executing program 2: socketpair(0x22, 0x0, 0x6300, &(0x7f0000000100)) 01:07:32 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) 01:07:32 executing program 0: syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(0xffffffffffffffff, 0xc1205531, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x8, [], [], [], 0x401, 0x80000000, 0x4, 0x3, "989df9a5985bb3d432e8bc62db5372bc"}) 01:07:32 executing program 4: socketpair(0x2c, 0x0, 0x19c, &(0x7f0000000100)) 01:07:32 executing program 5: syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(0xffffffffffffffff, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x3, 0xa2, 0x80000000, 'syz0\x00', 0x8}, 0x1, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8, 0x0, 0x2, 0x39, 0x6, 0x9, 0x1, 0x7, 0x7, 0x6]}) [ 1451.501371][T17416] binder: 17413:17416 unknown command 0 [ 1451.506981][T17416] binder: 17413:17416 ioctl c0306201 20000100 returned -22 [ 1451.521870][T17418] binder: 17415:17418 unknown command 808464412 [ 1451.538410][T17418] binder: 17415:17418 ioctl c0306201 20000100 returned -22 01:07:32 executing program 2: socketpair(0x22, 0x0, 0x6301, &(0x7f0000000100)) 01:07:32 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) 01:07:32 executing program 4: socketpair(0x2c, 0x0, 0x19d, &(0x7f0000000100)) 01:07:32 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x2) r2 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_RX_RING(r2, 0x11b, 0x2, &(0x7f0000001e40)=0x100080, 0x4) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc0, 0x0, &(0x7f00000002c0)=[@increfs={0x40046304, 0x1}, @dead_binder_done, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x60, 0x18, &(0x7f00000001c0)={@flat=@weak_binder={0x77622a85, 0x1901}, @fda={0x66646185, 0x3, 0x0, 0x35}, @ptr={0x70742a85, 0x0, &(0x7f0000000080)=""/19, 0x13, 0x0, 0x1}}, &(0x7f00000000c0)={0x0, 0x18, 0x38}}}, @dead_binder_done, @request_death={0x400c630e, 0x2}, @release, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000240)={@flat=@binder={0x73622a85, 0x1000, 0x2}, @flat=@binder={0x73622a85, 0x1, 0x1}, @fd={0x66642a85, 0x0, r2}}, &(0x7f0000000140)={0x0, 0x18, 0x30}}}], 0xf9, 0x0, &(0x7f0000000380)="228ed981a14615abbf9e37807dbf204a3c9b6a2fdb0f63917a90cc351279fc723311e5c9893a38e67b3c59185438461ec773bf9decb45be25b7256b208c6c5044b54c3cb14d0a3a864b3e15ee2d99d6005f4f601c298308f83912181dd85dbef7e17adb255444413190c09ce0eb99ace039f0be712f6b12421974a6033a27dc16b3e16ae170c7904b8d962c020fc55b2aaffa703928e52b51a01713cbbebc4b5224635c632775272a4389a0a4bf226a1aded4387d3e84cac0360107c6f2139bdaee20dbe51e0747d46c5d132dd52b4cb07d2ae84f6476a3ace21f1509eb07cd9e8310eb7d5f088a61496bcc6e9985db776ea46224d9860a75d"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x0, 0x0}) 01:07:32 executing program 5: syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(0xffffffffffffffff, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x3, 0xa2, 0x80000000, 'syz0\x00', 0x8}, 0x1, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8, 0x0, 0x2, 0x39, 0x6, 0x9, 0x1, 0x7, 0x7, 0x6]}) 01:07:32 executing program 0: syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(0xffffffffffffffff, 0xc1205531, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x8, [], [], [], 0x401, 0x80000000, 0x4, 0x3, "989df9a5985bb3d432e8bc62db5372bc"}) 01:07:32 executing program 2: socketpair(0x22, 0x0, 0x6400, &(0x7f0000000100)) [ 1451.760370][T17431] binder: 17429:17431 unknown command 0 [ 1451.784096][T17433] binder: 17428:17433 unknown command 28 [ 1451.789431][T17431] binder: 17429:17431 ioctl c0306201 20000100 returned -22 01:07:32 executing program 4: socketpair(0x2c, 0x0, 0x19e, &(0x7f0000000100)) 01:07:32 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, 0x0) [ 1451.808834][T17433] binder: 17428:17433 ioctl c0306201 20000100 returned -22 01:07:33 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) 01:07:33 executing program 0: syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(0xffffffffffffffff, 0xc1205531, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x8, [], [], [], 0x401, 0x80000000, 0x4, 0x3, "989df9a5985bb3d432e8bc62db5372bc"}) 01:07:33 executing program 2: socketpair(0x22, 0x0, 0x6401, &(0x7f0000000100)) 01:07:33 executing program 1: syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(0xffffffffffffffff, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x3, 0xa2, 0x80000000, 'syz0\x00', 0x8}, 0x1, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8, 0x0, 0x2, 0x39, 0x6, 0x9, 0x1, 0x7, 0x7, 0x6]}) 01:07:33 executing program 4: socketpair(0x2c, 0x0, 0x19f, &(0x7f0000000100)) [ 1452.012554][T17449] binder: 17443:17449 unknown command 0 [ 1452.018176][T17449] binder: 17443:17449 ioctl c0306201 20000100 returned -22 01:07:33 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, 0x0) 01:07:33 executing program 1: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x3, 0xa2, 0x80000000, 'syz0\x00', 0x8}, 0x1, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8, 0x0, 0x2, 0x39, 0x6, 0x9, 0x1, 0x7, 0x7, 0x6]}) 01:07:33 executing program 2: socketpair(0x22, 0x0, 0x6500, &(0x7f0000000100)) 01:07:33 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(r0, 0xc1205531, 0x0) 01:07:33 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="e91cd5026203576bb3c862a659339fd50b9baaffca91fd26fa82f38aece03486c432a60f960e3b8099765ca6e30580d29d35fe3ca0e021ee5036cb4f87250a6cd64a52e5684a092f15792f9d4eb445bc1b8496d7790e7fc3c5da2c7cb16d56001bbfcb62276549dd59a2005477a1a667d571305493e43a4e79bf6980381ba9821b55ec813cfbf923f890b73e42f3"], 0x0, 0x0, 0x0}) 01:07:33 executing program 4: socketpair(0x2c, 0x0, 0x1a0, &(0x7f0000000100)) 01:07:33 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, 0x0) 01:07:33 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(r0, 0xc1205531, 0x0) 01:07:33 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) pipe(&(0x7f0000000040)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x0, 0x0}) 01:07:33 executing program 2: socketpair(0x22, 0x0, 0x6501, &(0x7f0000000100)) [ 1452.264451][T17463] binder: 17462:17463 unknown command 47521001 [ 1452.292310][T17463] binder: 17462:17463 ioctl c0306201 20000100 returned -22 01:07:33 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) 01:07:33 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x0, 0xa2, 0x80000000, 'syz0\x00', 0x8}, 0x1, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8, 0x0, 0x2, 0x39, 0x6, 0x9, 0x1, 0x7, 0x7, 0x6]}) 01:07:33 executing program 4: socketpair(0x2c, 0x0, 0x1a1, &(0x7f0000000100)) [ 1452.414036][T17471] binder: 17468:17471 unknown command 28 [ 1452.431579][T17471] binder: 17468:17471 ioctl c0306201 20000080 returned -22 01:07:33 executing program 2: socketpair(0x22, 0x0, 0x6600, &(0x7f0000000100)) 01:07:33 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(r0, 0xc1205531, 0x0) [ 1452.471313][T17476] binder: 17474:17476 unknown command 0 [ 1452.496302][T17476] binder: 17474:17476 ioctl c0306201 20000100 returned -22 01:07:33 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 01:07:33 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x0, 0x0, 0x80000000, 'syz0\x00', 0x8}, 0x1, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8, 0x0, 0x2, 0x39, 0x6, 0x9, 0x1, 0x7, 0x7, 0x6]}) 01:07:33 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) 01:07:33 executing program 4: socketpair(0x2c, 0x0, 0x1a2, &(0x7f0000000100)) 01:07:33 executing program 2: socketpair(0x22, 0x0, 0x6601, &(0x7f0000000100)) [ 1452.646489][T17484] binder: 17481:17484 ioctl c0306201 0 returned -14 01:07:33 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(r0, 0xc1205531, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, [], [], [], 0x401, 0x80000000, 0x4, 0x3, "989df9a5985bb3d432e8bc62db5372bc"}) 01:07:33 executing program 1: r0 = syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(r0, 0xc1205531, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x8, [], [], [], 0x401, 0x80000000, 0x4, 0x3, "989df9a5985bb3d432e8bc62db5372bc"}) [ 1452.707321][T17490] binder: 17487:17490 unknown command 0 [ 1452.742706][T17490] binder: 17487:17490 ioctl c0306201 20000100 returned -22 01:07:33 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00', 0x8}, 0x1, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8, 0x0, 0x2, 0x39, 0x6, 0x9, 0x1, 0x7, 0x7, 0x6]}) 01:07:33 executing program 4: socketpair(0x2c, 0x0, 0x1a3, &(0x7f0000000100)) 01:07:33 executing program 2: socketpair(0x22, 0x0, 0x6700, &(0x7f0000000100)) 01:07:34 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) 01:07:34 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x1, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8, 0x0, 0x2, 0x39, 0x6, 0x9, 0x1, 0x7, 0x7, 0x6]}) 01:07:34 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(r0, 0xc1205531, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, [], [], [], 0x0, 0x80000000, 0x4, 0x3, "989df9a5985bb3d432e8bc62db5372bc"}) 01:07:34 executing program 1: r0 = syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(r0, 0xc1205531, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x8, [], [], [], 0x401, 0x80000000, 0x4, 0x3, "989df9a5985bb3d432e8bc62db5372bc"}) 01:07:34 executing program 4: socketpair(0x2c, 0x0, 0x1a4, &(0x7f0000000100)) 01:07:34 executing program 2: socketpair(0x22, 0x0, 0x6701, &(0x7f0000000100)) [ 1453.019727][T17506] binder: 17503:17506 unknown command 0 [ 1453.025350][T17506] binder: 17503:17506 ioctl c0306201 20000100 returned -22 01:07:34 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8, 0x0, 0x2, 0x39, 0x6, 0x9, 0x1, 0x7, 0x7, 0x6]}) 01:07:34 executing program 1: r0 = syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(r0, 0xc1205531, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x8, [], [], [], 0x401, 0x80000000, 0x4, 0x3, "989df9a5985bb3d432e8bc62db5372bc"}) 01:07:34 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="e91cd5026203576bb3c862a659339fd50b9baaffca91fd26fa82f38aece03486c432a60f960e3b8099765ca6e30580d29d35fe3ca0e021ee5036cb4f87250a6cd64a52e5684a09"], 0x0, 0x0, 0x0}) 01:07:34 executing program 4: socketpair(0x2c, 0x0, 0x1a5, &(0x7f0000000100)) 01:07:34 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(r0, 0xc1205531, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, [], [], [], 0x0, 0x0, 0x4, 0x3, "989df9a5985bb3d432e8bc62db5372bc"}) 01:07:34 executing program 2: socketpair(0x22, 0x0, 0x6800, &(0x7f0000000100)) 01:07:34 executing program 1: ioctl$SNDRV_CTL_IOCTL_PCM_INFO(0xffffffffffffffff, 0xc1205531, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x8, [], [], [], 0x401, 0x80000000, 0x4, 0x3, "989df9a5985bb3d432e8bc62db5372bc"}) [ 1453.232489][T17521] binder: 17519:17521 unknown command 47521001 [ 1453.262687][T17521] binder: 17519:17521 ioctl c0306201 20000100 returned -22 01:07:34 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8, 0x0, 0x2, 0x39, 0x6, 0x9, 0x1, 0x7, 0x7]}) 01:07:34 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) 01:07:34 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(r0, 0xc1205531, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, [], [], [], 0x0, 0x0, 0x0, 0x3, "989df9a5985bb3d432e8bc62db5372bc"}) 01:07:34 executing program 4: socketpair(0x2c, 0x0, 0x1a6, &(0x7f0000000100)) 01:07:34 executing program 2: socketpair(0x22, 0x0, 0x6801, &(0x7f0000000100)) 01:07:34 executing program 1: ioctl$SNDRV_CTL_IOCTL_PCM_INFO(0xffffffffffffffff, 0xc1205531, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x8, [], [], [], 0x401, 0x80000000, 0x4, 0x3, "989df9a5985bb3d432e8bc62db5372bc"}) 01:07:34 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8, 0x0, 0x2, 0x39, 0x6, 0x9, 0x1, 0x7]}) [ 1453.476614][T17535] binder: 17531:17535 unknown command 0 01:07:34 executing program 4: socketpair(0x2c, 0x0, 0x1a7, &(0x7f0000000100)) 01:07:34 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(r0, 0xc1205531, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, [], [], [], 0x0, 0x0, 0x0, 0x0, "989df9a5985bb3d432e8bc62db5372bc"}) [ 1453.524269][T17535] binder: 17531:17535 ioctl c0306201 20000100 returned -22 01:07:34 executing program 2: socketpair(0x22, 0x0, 0x6900, &(0x7f0000000100)) 01:07:34 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) 01:07:34 executing program 1: ioctl$SNDRV_CTL_IOCTL_PCM_INFO(0xffffffffffffffff, 0xc1205531, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x8, [], [], [], 0x401, 0x80000000, 0x4, 0x3, "989df9a5985bb3d432e8bc62db5372bc"}) 01:07:34 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8, 0x0, 0x2, 0x39, 0x6, 0x9, 0x1]}) 01:07:34 executing program 4: socketpair(0x2c, 0x0, 0x1a8, &(0x7f0000000100)) 01:07:34 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(r0, 0xc1205531, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, [], [], [], 0x0, 0x0, 0x4, 0x3, "989df9a5985bb3d432e8bc62db5372bc"}) 01:07:34 executing program 2: socketpair(0x22, 0x0, 0x6901, &(0x7f0000000100)) [ 1453.735385][T17551] binder: 17550:17551 unknown command 0 [ 1453.758061][T17551] binder: 17550:17551 ioctl c0306201 20000100 returned -22 01:07:34 executing program 1: r0 = syz_open_dev$sndctrl(0x0, 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(r0, 0xc1205531, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x8, [], [], [], 0x401, 0x80000000, 0x4, 0x3, "989df9a5985bb3d432e8bc62db5372bc"}) 01:07:34 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8, 0x0, 0x2, 0x39, 0x6, 0x9]}) 01:07:35 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) 01:07:35 executing program 4: socketpair(0x2c, 0x0, 0x1a9, &(0x7f0000000100)) 01:07:35 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(r0, 0xc1205531, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, [], [], [], 0x0, 0x80000000, 0x4, 0x3, "989df9a5985bb3d432e8bc62db5372bc"}) 01:07:35 executing program 1: r0 = syz_open_dev$sndctrl(0x0, 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(r0, 0xc1205531, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x8, [], [], [], 0x401, 0x80000000, 0x4, 0x3, "989df9a5985bb3d432e8bc62db5372bc"}) 01:07:35 executing program 2: socketpair(0x22, 0x0, 0x6a00, &(0x7f0000000100)) 01:07:35 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8, 0x0, 0x2, 0x39, 0x6]}) [ 1453.999227][T17568] binder: 17565:17568 unknown command 0 [ 1454.022896][T17568] binder: 17565:17568 ioctl c0306201 20000100 returned -22 01:07:35 executing program 4: socketpair(0x2c, 0x0, 0x1aa, &(0x7f0000000100)) 01:07:35 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="e91cd5026203576bb3c862a659339fd50b9baaffca91fd26fa82f38aece03486c432a60f"], 0x0, 0x0, 0x0}) 01:07:35 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(r0, 0xc1205531, 0x0) 01:07:35 executing program 1: r0 = syz_open_dev$sndctrl(0x0, 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(r0, 0xc1205531, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x8, [], [], [], 0x401, 0x80000000, 0x4, 0x3, "989df9a5985bb3d432e8bc62db5372bc"}) 01:07:35 executing program 2: socketpair(0x22, 0x0, 0x6a01, &(0x7f0000000100)) 01:07:35 executing program 4: socketpair(0x2c, 0x0, 0x1ab, &(0x7f0000000100)) 01:07:35 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8, 0x0, 0x2, 0x39]}) [ 1454.266227][T17583] binder: 17581:17583 unknown command 47521001 01:07:35 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(r0, 0xc1205531, 0x0) [ 1454.310668][T17583] binder: 17581:17583 ioctl c0306201 20000100 returned -22 01:07:35 executing program 1: syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(0xffffffffffffffff, 0xc1205531, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x8, [], [], [], 0x401, 0x80000000, 0x4, 0x3, "989df9a5985bb3d432e8bc62db5372bc"}) 01:07:35 executing program 2: socketpair(0x22, 0x0, 0x6b00, &(0x7f0000000100)) 01:07:35 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="e9"], 0x0, 0x0, 0x0}) 01:07:35 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8, 0x0, 0x2]}) 01:07:35 executing program 4: socketpair(0x2c, 0x0, 0x1ac, &(0x7f0000000100)) 01:07:35 executing program 1: syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(0xffffffffffffffff, 0xc1205531, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x8, [], [], [], 0x401, 0x80000000, 0x4, 0x3, "989df9a5985bb3d432e8bc62db5372bc"}) [ 1454.502868][T17600] binder: 17593:17600 unknown command 233 01:07:35 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(r0, 0xc1205531, 0x0) 01:07:35 executing program 2: socketpair(0x22, 0x0, 0x6b01, &(0x7f0000000100)) [ 1454.527877][T17600] binder: 17593:17600 ioctl c0306201 20000100 returned -22 01:07:35 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681, 0x8]}) 01:07:35 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="e9"], 0x0, 0x0, 0x0}) 01:07:35 executing program 4: socketpair(0x2c, 0x0, 0x1ad, &(0x7f0000000100)) 01:07:35 executing program 0: ioctl$SNDRV_CTL_IOCTL_PCM_INFO(0xffffffffffffffff, 0xc1205531, 0x0) 01:07:35 executing program 1: syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(0xffffffffffffffff, 0xc1205531, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x8, [], [], [], 0x401, 0x80000000, 0x4, 0x3, "989df9a5985bb3d432e8bc62db5372bc"}) 01:07:35 executing program 2: socketpair(0x22, 0x0, 0x6c00, &(0x7f0000000100)) [ 1454.728748][T17613] binder: 17612:17613 unknown command 233 [ 1454.751566][T17613] binder: 17612:17613 ioctl c0306201 20000100 returned -22 01:07:35 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="e9"], 0x0, 0x0, 0x0}) 01:07:35 executing program 4: socketpair(0x2c, 0x0, 0x1ae, &(0x7f0000000100)) 01:07:35 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40, 0x681]}) 01:07:36 executing program 1: r0 = syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(r0, 0xc1205531, 0x0) 01:07:36 executing program 0: ioctl$SNDRV_CTL_IOCTL_PCM_INFO(0xffffffffffffffff, 0xc1205531, 0x0) 01:07:36 executing program 2: socketpair(0x22, 0x0, 0x6c01, &(0x7f0000000100)) 01:07:36 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7, 0x40]}) [ 1454.962142][T17628] binder: 17625:17628 unknown command 233 [ 1454.979053][T17628] binder: 17625:17628 ioctl c0306201 20000100 returned -22 01:07:36 executing program 4: socketpair(0x2c, 0x0, 0x1af, &(0x7f0000000100)) 01:07:36 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="e91cd5026203576bb3c862a659339fd50b9baa"], 0x0, 0x0, 0x0}) 01:07:36 executing program 1: r0 = syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(r0, 0xc1205531, 0x0) 01:07:36 executing program 0: ioctl$SNDRV_CTL_IOCTL_PCM_INFO(0xffffffffffffffff, 0xc1205531, 0x0) 01:07:36 executing program 2: socketpair(0x22, 0x0, 0x6d00, &(0x7f0000000100)) 01:07:36 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8, 0x7]}) 01:07:36 executing program 4: socketpair(0x2c, 0x0, 0x1b0, &(0x7f0000000100)) 01:07:36 executing program 0: r0 = syz_open_dev$sndctrl(0x0, 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(r0, 0xc1205531, 0x0) [ 1455.210020][T17641] binder: 17640:17641 unknown command 47521001 [ 1455.248436][T17641] binder: 17640:17641 ioctl c0306201 20000100 returned -22 01:07:36 executing program 1: r0 = syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(r0, 0xc1205531, 0x0) 01:07:36 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="e91c"], 0x0, 0x0, 0x0}) 01:07:36 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000, 0x8]}) 01:07:36 executing program 4: socketpair(0x2c, 0x0, 0x1b1, &(0x7f0000000100)) 01:07:36 executing program 2: socketpair(0x22, 0x0, 0x6d01, &(0x7f0000000100)) 01:07:36 executing program 0: r0 = syz_open_dev$sndctrl(0x0, 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(r0, 0xc1205531, 0x0) [ 1455.445303][T17656] binder: 17654:17656 unknown command 7401 [ 1455.452034][T17656] binder: 17654:17656 ioctl c0306201 20000100 returned -22 01:07:36 executing program 1: r0 = syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(r0, 0xc1205531, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, [], [], [], 0x401, 0x80000000, 0x4, 0x3, "989df9a5985bb3d432e8bc62db5372bc"}) 01:07:36 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="e91c"], 0x0, 0x0, 0x0}) 01:07:36 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100, 0xffffffffffff8000]}) 01:07:36 executing program 2: socketpair(0x22, 0x0, 0x6e00, &(0x7f0000000100)) 01:07:36 executing program 4: socketpair(0x2c, 0x0, 0x1b2, &(0x7f0000000100)) 01:07:36 executing program 0: r0 = syz_open_dev$sndctrl(0x0, 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(r0, 0xc1205531, 0x0) [ 1455.641027][T17668] binder: 17667:17668 unknown command 7401 [ 1455.658359][T17668] binder: 17667:17668 ioctl c0306201 20000100 returned -22 01:07:36 executing program 1: r0 = syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(r0, 0xc1205531, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, [], [], [], 0x0, 0x80000000, 0x4, 0x3, "989df9a5985bb3d432e8bc62db5372bc"}) 01:07:36 executing program 4: socketpair(0x2c, 0x0, 0x1b3, &(0x7f0000000100)) 01:07:36 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff, 0x100]}) 01:07:36 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="e91c"], 0x0, 0x0, 0x0}) 01:07:36 executing program 2: socketpair(0x22, 0x0, 0x6e01, &(0x7f0000000100)) 01:07:37 executing program 0: syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(0xffffffffffffffff, 0xc1205531, 0x0) 01:07:37 executing program 4: socketpair(0x2c, 0x0, 0x1b4, &(0x7f0000000100)) 01:07:37 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff]}) [ 1455.886988][T17683] binder: 17682:17683 unknown command 7401 01:07:37 executing program 1: r0 = syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(r0, 0xc1205531, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, [], [], [], 0x0, 0x0, 0x4, 0x3, "989df9a5985bb3d432e8bc62db5372bc"}) 01:07:37 executing program 2: socketpair(0x22, 0x0, 0x6f00, &(0x7f0000000100)) [ 1455.930736][T17683] binder: 17682:17683 ioctl c0306201 20000100 returned -22 01:07:37 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="e91cd5026203576bb3c862"], 0x0, 0x0, 0x0}) 01:07:37 executing program 4: socketpair(0x2c, 0x0, 0x1b5, &(0x7f0000000100)) 01:07:37 executing program 0: syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(0xffffffffffffffff, 0xc1205531, 0x0) 01:07:37 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5]}) 01:07:37 executing program 1: r0 = syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(r0, 0xc1205531, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, [], [], [], 0x0, 0x0, 0x0, 0x3, "989df9a5985bb3d432e8bc62db5372bc"}) 01:07:37 executing program 2: socketpair(0x22, 0x0, 0x6f01, &(0x7f0000000100)) [ 1456.145882][T17700] binder: 17697:17700 unknown command 47521001 [ 1456.162436][T17700] binder: 17697:17700 ioctl c0306201 20000100 returned -22 01:07:37 executing program 4: socketpair(0x2c, 0x0, 0x1b6, &(0x7f0000000100)) 01:07:37 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="e91cd5"], 0x0, 0x0, 0x0}) 01:07:37 executing program 0: syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(0xffffffffffffffff, 0xc1205531, 0x0) 01:07:37 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1]}) 01:07:37 executing program 1: r0 = syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(r0, 0xc1205531, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, [], [], [], 0x0, 0x0, 0x0, 0x0, "989df9a5985bb3d432e8bc62db5372bc"}) 01:07:37 executing program 2: socketpair(0x22, 0x0, 0x7000, &(0x7f0000000100)) 01:07:37 executing program 4: socketpair(0x2c, 0x0, 0x1b7, &(0x7f0000000100)) [ 1456.368841][T17714] binder: 17711:17714 unknown command 13966569 [ 1456.385476][T17714] binder: 17711:17714 ioctl c0306201 20000100 returned -22 01:07:37 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1, 0x5, 0x7ff]}) 01:07:37 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5]}) 01:07:37 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="e9"], 0x0, 0x0, 0x0}) 01:07:37 executing program 2: socketpair(0x22, 0x0, 0x7001, &(0x7f0000000100)) 01:07:37 executing program 1: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5, 0x5, 0x1]}) 01:07:37 executing program 4: socketpair(0x2c, 0x0, 0x1b8, &(0x7f0000000100)) 01:07:37 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000040)='/dev/zero\x00', 0x1, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x2, &(0x7f00000000c0)={0xffffffffffffffff}, 0x106, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r1, &(0x7f0000000140)={0x10, 0x30, 0xfa00, {&(0x7f0000000080), 0x3, {0xa, 0x4e21, 0x400, @mcast1, 0x3}, r2}}, 0x38) ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f00000024c0)={0x2, 0x0, 0x0, 0x0, 0x0, 0x0}) 01:07:37 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175, 0x5]}) [ 1456.644833][T17729] binder: 17725:17729 unknown command 233 [ 1456.668493][T17729] binder: 17725:17729 ioctl c0306201 20000100 returned -22 01:07:37 executing program 2: socketpair(0x22, 0x0, 0x7100, &(0x7f0000000100)) 01:07:37 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="e9"], 0x0, 0x0, 0x0}) 01:07:37 executing program 1: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x800) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r1, 0x1f) ioctl$FS_IOC_GET_ENCRYPTION_PWSALT(r0, 0x40106614, &(0x7f0000000040)) 01:07:37 executing program 4: socketpair(0x2c, 0x0, 0x1b9, &(0x7f0000000100)) 01:07:37 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r1, 0x8000000) write$RDMA_USER_CM_CMD_RESOLVE_IP(r1, &(0x7f0000000080)={0x3, 0x40, 0xfa00, {{0xa, 0x4e23, 0x2, @ipv4={[], [], @loopback}, 0x6e}, {0xa, 0x4e20, 0x3, @dev={0xfe, 0x80, [], 0x17}, 0x7fffffff}, 0xffffffffffffffff, 0x20}}, 0x48) mmap$usbfs(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x2000000, 0x100010, r1, 0xf678) pipe(&(0x7f0000000100)={0xffffffffffffffff}) syz_io_uring_setup(0x666c, &(0x7f0000000140)={0x0, 0x6a53, 0x8, 0x1, 0x3e, 0x0, r2}, &(0x7f0000ff2000/0xe000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f00000001c0), &(0x7f0000000200)) ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f00000024c0)={0x2, 0x0, 0x0, 0x0, 0x0, 0x0}) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ubi_ctrl\x00', 0x24002, 0x0) 01:07:37 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6, 0x5175]}) 01:07:38 executing program 2: socketpair(0x22, 0x0, 0x7101, &(0x7f0000000100)) [ 1456.855427][T17743] binder: 17740:17743 unknown command 233 [ 1456.883109][T17743] binder: 17740:17743 ioctl c0306201 20000100 returned -22 01:07:38 executing program 4: socketpair(0x2c, 0x0, 0x1ba, &(0x7f0000000100)) 01:07:38 executing program 1: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r0, 0x8000000) r1 = io_uring_setup(0xc42, &(0x7f0000000080)={0x0, 0x14a2, 0x1, 0x3, 0x4, 0x0, r0}) r2 = io_uring_setup(0x7e05, &(0x7f0000000100)={0x0, 0x2d53, 0x20, 0x3, 0x3f, 0x0, r1}) r3 = openat$zero(0xffffffffffffff9c, &(0x7f00000007c0)='/dev/zero\x00', 0x7f187f66c4f689d0, 0x0) setsockopt$XDP_UMEM_FILL_RING(r3, 0x11b, 0x5, &(0x7f0000000800)=0x200400, 0x4) r4 = syz_io_uring_setup(0x65ec, &(0x7f0000000600)={0x0, 0x36fd, 0x4, 0x3, 0x147, 0x0, r3}, &(0x7f0000ff9000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000540), &(0x7f0000000680)) syz_io_uring_setup(0x6787, &(0x7f00000002c0)={0x0, 0x10066d5, 0x2b, 0x2, 0x42, 0x0, r4}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) r5 = io_uring_setup(0x51d5, &(0x7f0000000180)={0x0, 0x6119, 0x10, 0x2, 0x251, 0x0, r2}) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='mounts\x00') r6 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r6, 0x8000000) io_uring_setup(0xbdb, &(0x7f0000000580)={0x0, 0xdabc, 0x10, 0x0, 0x24, 0x0, r6}) syz_io_uring_setup(0x6478, &(0x7f0000000200)={0x0, 0xbc58, 0x4, 0x0, 0x14f, 0x0, r5}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x3000)=nil, &(0x7f0000000000), &(0x7f0000000280)) r7 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r7, 0x8000000) syz_io_uring_setup(0x1b7f, &(0x7f0000000440)={0x0, 0x86d3, 0x2, 0x2, 0x69, 0x0, r7}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) io_uring_setup(0x75d8, &(0x7f00000003c0)={0x0, 0x2187, 0x0, 0x2, 0x65, 0x0, r7}) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x0, 0x80010, r0, 0x8000000) socket$kcm(0x29, 0x5, 0x0) 01:07:38 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="e9"], 0x0, 0x0, 0x0}) 01:07:38 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4, 0x6]}) 01:07:38 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x4020940d, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x0, 0x0}) 01:07:38 executing program 2: socketpair(0x22, 0x0, 0x7200, &(0x7f0000000100)) 01:07:38 executing program 4: socketpair(0x2c, 0x0, 0x1bb, &(0x7f0000000100)) [ 1457.120261][T17761] binder: 17756:17761 unknown command 233 [ 1457.137934][T17761] binder: 17756:17761 ioctl c0306201 20000100 returned -22 01:07:38 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x4020940d, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x0, 0x0}) 01:07:38 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="e91c"], 0x0, 0x0, 0x0}) 01:07:38 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4, 0x4]}) 01:07:38 executing program 1: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r0, 0x8000000) r1 = io_uring_setup(0xc42, &(0x7f0000000080)={0x0, 0x14a2, 0x1, 0x3, 0x4, 0x0, r0}) r2 = io_uring_setup(0x7e05, &(0x7f0000000100)={0x0, 0x2d53, 0x20, 0x3, 0x3f, 0x0, r1}) r3 = openat$zero(0xffffffffffffff9c, &(0x7f00000007c0)='/dev/zero\x00', 0x7f187f66c4f689d0, 0x0) setsockopt$XDP_UMEM_FILL_RING(r3, 0x11b, 0x5, &(0x7f0000000800)=0x200400, 0x4) r4 = syz_io_uring_setup(0x65ec, &(0x7f0000000600)={0x0, 0x36fd, 0x4, 0x3, 0x147, 0x0, r3}, &(0x7f0000ff9000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000540), &(0x7f0000000680)) syz_io_uring_setup(0x6787, &(0x7f00000002c0)={0x0, 0x10066d5, 0x2b, 0x2, 0x42, 0x0, r4}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) r5 = io_uring_setup(0x51d5, &(0x7f0000000180)={0x0, 0x6119, 0x10, 0x2, 0x251, 0x0, r2}) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='mounts\x00') r6 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r6, 0x8000000) io_uring_setup(0xbdb, &(0x7f0000000580)={0x0, 0xdabc, 0x10, 0x0, 0x24, 0x0, r6}) syz_io_uring_setup(0x6478, &(0x7f0000000200)={0x0, 0xbc58, 0x4, 0x0, 0x14f, 0x0, r5}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x3000)=nil, &(0x7f0000000000), &(0x7f0000000280)) r7 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r7, 0x8000000) syz_io_uring_setup(0x1b7f, &(0x7f0000000440)={0x0, 0x86d3, 0x2, 0x2, 0x69, 0x0, r7}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) io_uring_setup(0x75d8, &(0x7f00000003c0)={0x0, 0x2187, 0x0, 0x2, 0x65, 0x0, r7}) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x0, 0x80010, r0, 0x8000000) socket$kcm(0x29, 0x5, 0x0) 01:07:38 executing program 4: socketpair(0x2c, 0x0, 0x1bc, &(0x7f0000000100)) 01:07:38 executing program 2: socketpair(0x22, 0x0, 0x7201, &(0x7f0000000100)) [ 1457.297781][T17770] binder: 17769:17770 unknown command 7401 [ 1457.324807][T17770] binder: 17769:17770 ioctl c0306201 20000100 returned -22 01:07:38 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="e91c"], 0x0, 0x0, 0x0}) 01:07:38 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x4020940d, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x0, 0x0}) 01:07:38 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff, 0x4]}) 01:07:38 executing program 4: socketpair(0x2c, 0x0, 0x1bd, &(0x7f0000000100)) 01:07:38 executing program 2: socketpair(0x22, 0x0, 0x7300, &(0x7f0000000100)) 01:07:38 executing program 1: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r0, 0x8000000) r1 = io_uring_setup(0xc42, &(0x7f0000000080)={0x0, 0x14a2, 0x1, 0x3, 0x4, 0x0, r0}) r2 = io_uring_setup(0x7e05, &(0x7f0000000100)={0x0, 0x2d53, 0x20, 0x3, 0x3f, 0x0, r1}) r3 = openat$zero(0xffffffffffffff9c, &(0x7f00000007c0)='/dev/zero\x00', 0x7f187f66c4f689d0, 0x0) setsockopt$XDP_UMEM_FILL_RING(r3, 0x11b, 0x5, &(0x7f0000000800)=0x200400, 0x4) r4 = syz_io_uring_setup(0x65ec, &(0x7f0000000600)={0x0, 0x36fd, 0x4, 0x3, 0x147, 0x0, r3}, &(0x7f0000ff9000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000540), &(0x7f0000000680)) syz_io_uring_setup(0x6787, &(0x7f00000002c0)={0x0, 0x10066d5, 0x2b, 0x2, 0x42, 0x0, r4}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) r5 = io_uring_setup(0x51d5, &(0x7f0000000180)={0x0, 0x6119, 0x10, 0x2, 0x251, 0x0, r2}) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='mounts\x00') r6 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r6, 0x8000000) io_uring_setup(0xbdb, &(0x7f0000000580)={0x0, 0xdabc, 0x10, 0x0, 0x24, 0x0, r6}) syz_io_uring_setup(0x6478, &(0x7f0000000200)={0x0, 0xbc58, 0x4, 0x0, 0x14f, 0x0, r5}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x3000)=nil, &(0x7f0000000000), &(0x7f0000000280)) r7 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r7, 0x8000000) syz_io_uring_setup(0x1b7f, &(0x7f0000000440)={0x0, 0x86d3, 0x2, 0x2, 0x69, 0x0, r7}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) io_uring_setup(0x75d8, &(0x7f00000003c0)={0x0, 0x2187, 0x0, 0x2, 0x65, 0x0, r7}) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x0, 0x80010, r0, 0x8000000) socket$kcm(0x29, 0x5, 0x0) [ 1457.562781][T17783] binder: 17782:17783 unknown command 7401 [ 1457.568754][T17783] binder: 17782:17783 ioctl c0306201 20000100 returned -22 01:07:38 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="e91c"], 0x0, 0x0, 0x0}) 01:07:38 executing program 4: socketpair(0x2c, 0x0, 0x1be, &(0x7f0000000100)) 01:07:38 executing program 2: socketpair(0x22, 0x0, 0x7301, &(0x7f0000000100)) 01:07:38 executing program 0: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0x4020940d, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x0, 0x0}) 01:07:38 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2, 0xffffffffffff7fff]}) 01:07:38 executing program 1: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r0, 0x8000000) r1 = io_uring_setup(0xc42, &(0x7f0000000080)={0x0, 0x14a2, 0x1, 0x3, 0x4, 0x0, r0}) r2 = io_uring_setup(0x7e05, &(0x7f0000000100)={0x0, 0x2d53, 0x20, 0x3, 0x3f, 0x0, r1}) r3 = openat$zero(0xffffffffffffff9c, &(0x7f00000007c0)='/dev/zero\x00', 0x7f187f66c4f689d0, 0x0) setsockopt$XDP_UMEM_FILL_RING(r3, 0x11b, 0x5, &(0x7f0000000800)=0x200400, 0x4) r4 = syz_io_uring_setup(0x65ec, &(0x7f0000000600)={0x0, 0x36fd, 0x4, 0x3, 0x147, 0x0, r3}, &(0x7f0000ff9000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000540), &(0x7f0000000680)) syz_io_uring_setup(0x6787, &(0x7f00000002c0)={0x0, 0x10066d5, 0x2b, 0x2, 0x42, 0x0, r4}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) r5 = io_uring_setup(0x51d5, &(0x7f0000000180)={0x0, 0x6119, 0x10, 0x2, 0x251, 0x0, r2}) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='mounts\x00') r6 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r6, 0x8000000) io_uring_setup(0xbdb, &(0x7f0000000580)={0x0, 0xdabc, 0x10, 0x0, 0x24, 0x0, r6}) syz_io_uring_setup(0x6478, &(0x7f0000000200)={0x0, 0xbc58, 0x4, 0x0, 0x14f, 0x0, r5}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x3000)=nil, &(0x7f0000000000), &(0x7f0000000280)) r7 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r7, 0x8000000) syz_io_uring_setup(0x1b7f, &(0x7f0000000440)={0x0, 0x86d3, 0x2, 0x2, 0x69, 0x0, r7}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) io_uring_setup(0x75d8, &(0x7f00000003c0)={0x0, 0x2187, 0x0, 0x2, 0x65, 0x0, r7}) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x0, 0x80010, r0, 0x8000000) [ 1457.753336][T17796] binder: 17795:17796 unknown command 7401 [ 1457.760512][T17796] binder: 17795:17796 ioctl c0306201 20000100 returned -22 01:07:38 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/sco\x00') r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000000c0)='net/softnet_stat\x00') write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r1, &(0x7f0000000140)={0x10, 0x30, 0xfa00, {&(0x7f0000000100), 0x3, {0xa, 0x4e20, 0xf2a, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x1ff}}}, 0x38) mmap$usbfs(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x0, 0x80010, r0, 0x9) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='mounts\x00') ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000ffd000/0x3000)=nil, 0x3000}, 0x2}) openat$ocfs2_control(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ocfs2_control\x00', 0x123200, 0x0) 01:07:39 executing program 4: socketpair(0x2c, 0x0, 0x1bf, &(0x7f0000000100)) 01:07:39 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000, 0x2]}) 01:07:39 executing program 0: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0x4020940d, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x0, 0x0}) 01:07:39 executing program 2: socketpair(0x22, 0x0, 0x7400, &(0x7f0000000100)) 01:07:39 executing program 1: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r0, 0x8000000) r1 = io_uring_setup(0xc42, &(0x7f0000000080)={0x0, 0x14a2, 0x1, 0x3, 0x4, 0x0, r0}) r2 = io_uring_setup(0x7e05, &(0x7f0000000100)={0x0, 0x2d53, 0x20, 0x3, 0x3f, 0x0, r1}) r3 = openat$zero(0xffffffffffffff9c, &(0x7f00000007c0)='/dev/zero\x00', 0x7f187f66c4f689d0, 0x0) setsockopt$XDP_UMEM_FILL_RING(r3, 0x11b, 0x5, &(0x7f0000000800)=0x200400, 0x4) r4 = syz_io_uring_setup(0x65ec, &(0x7f0000000600)={0x0, 0x36fd, 0x4, 0x3, 0x147, 0x0, r3}, &(0x7f0000ff9000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000540), &(0x7f0000000680)) syz_io_uring_setup(0x6787, &(0x7f00000002c0)={0x0, 0x10066d5, 0x2b, 0x2, 0x42, 0x0, r4}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) r5 = io_uring_setup(0x51d5, &(0x7f0000000180)={0x0, 0x6119, 0x10, 0x2, 0x251, 0x0, r2}) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='mounts\x00') r6 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r6, 0x8000000) io_uring_setup(0xbdb, &(0x7f0000000580)={0x0, 0xdabc, 0x10, 0x0, 0x24, 0x0, r6}) syz_io_uring_setup(0x6478, &(0x7f0000000200)={0x0, 0xbc58, 0x4, 0x0, 0x14f, 0x0, r5}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x3000)=nil, &(0x7f0000000000), &(0x7f0000000280)) r7 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r7, 0x8000000) syz_io_uring_setup(0x1b7f, &(0x7f0000000440)={0x0, 0x86d3, 0x2, 0x2, 0x69, 0x0, r7}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) io_uring_setup(0x75d8, &(0x7f00000003c0)={0x0, 0x2187, 0x0, 0x2, 0x65, 0x0, r7}) 01:07:39 executing program 4: socketpair(0x2c, 0x0, 0x1c0, &(0x7f0000000100)) 01:07:39 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6, 0x60000]}) 01:07:39 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/sco\x00') r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000000c0)='net/softnet_stat\x00') write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r1, &(0x7f0000000140)={0x10, 0x30, 0xfa00, {&(0x7f0000000100), 0x3, {0xa, 0x4e20, 0xf2a, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x1ff}}}, 0x38) mmap$usbfs(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x0, 0x80010, r0, 0x9) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='mounts\x00') ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000ffd000/0x3000)=nil, 0x3000}, 0x2}) r3 = openat$ocfs2_control(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ocfs2_control\x00', 0x123200, 0x0) getsockopt$bt_BT_RCVMTU(r3, 0x112, 0xd, &(0x7f00000001c0)=0x6, &(0x7f0000000200)=0x2) 01:07:39 executing program 0: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0x4020940d, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x0, 0x0}) 01:07:39 executing program 2: socketpair(0x22, 0x0, 0x7401, &(0x7f0000000100)) 01:07:39 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6]}) 01:07:39 executing program 1: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r0, 0x8000000) r1 = io_uring_setup(0xc42, &(0x7f0000000080)={0x0, 0x14a2, 0x1, 0x3, 0x4, 0x0, r0}) r2 = io_uring_setup(0x7e05, &(0x7f0000000100)={0x0, 0x2d53, 0x20, 0x3, 0x3f, 0x0, r1}) r3 = openat$zero(0xffffffffffffff9c, &(0x7f00000007c0)='/dev/zero\x00', 0x7f187f66c4f689d0, 0x0) setsockopt$XDP_UMEM_FILL_RING(r3, 0x11b, 0x5, &(0x7f0000000800)=0x200400, 0x4) r4 = syz_io_uring_setup(0x65ec, &(0x7f0000000600)={0x0, 0x36fd, 0x4, 0x3, 0x147, 0x0, r3}, &(0x7f0000ff9000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000540), &(0x7f0000000680)) syz_io_uring_setup(0x6787, &(0x7f00000002c0)={0x0, 0x10066d5, 0x2b, 0x2, 0x42, 0x0, r4}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) r5 = io_uring_setup(0x51d5, &(0x7f0000000180)={0x0, 0x6119, 0x10, 0x2, 0x251, 0x0, r2}) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='mounts\x00') r6 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r6, 0x8000000) io_uring_setup(0xbdb, &(0x7f0000000580)={0x0, 0xdabc, 0x10, 0x0, 0x24, 0x0, r6}) syz_io_uring_setup(0x6478, &(0x7f0000000200)={0x0, 0xbc58, 0x4, 0x0, 0x14f, 0x0, r5}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x3000)=nil, &(0x7f0000000000), &(0x7f0000000280)) r7 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r7, 0x8000000) syz_io_uring_setup(0x1b7f, &(0x7f0000000440)={0x0, 0x86d3, 0x2, 0x2, 0x69, 0x0, r7}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) 01:07:39 executing program 4: socketpair(0x2c, 0x0, 0x1c1, &(0x7f0000000100)) 01:07:39 executing program 0: r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x4020940d, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x0, 0x0}) 01:07:39 executing program 2: socketpair(0x22, 0x0, 0x7500, &(0x7f0000000100)) 01:07:39 executing program 3: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r0, 0x8000000) r1 = io_uring_setup(0xc42, &(0x7f0000000080)={0x0, 0x14a2, 0x1, 0x3, 0x4, 0x0, r0}) r2 = io_uring_setup(0x7e05, &(0x7f0000000100)={0x0, 0x2d53, 0x20, 0x3, 0x3f, 0x0, r1}) r3 = openat$zero(0xffffffffffffff9c, &(0x7f00000007c0)='/dev/zero\x00', 0x7f187f66c4f689d0, 0x0) setsockopt$XDP_UMEM_FILL_RING(r3, 0x11b, 0x5, &(0x7f0000000800)=0x200400, 0x4) r4 = syz_io_uring_setup(0x65ec, &(0x7f0000000600)={0x0, 0x36fd, 0x4, 0x3, 0x147, 0x0, r3}, &(0x7f0000ff9000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000540), &(0x7f0000000680)) syz_io_uring_setup(0x6787, &(0x7f00000002c0)={0x0, 0x10066d5, 0x2b, 0x2, 0x42, 0x0, r4}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) r5 = io_uring_setup(0x51d5, &(0x7f0000000180)={0x0, 0x6119, 0x10, 0x2, 0x251, 0x0, r2}) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='mounts\x00') r6 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r6, 0x8000000) io_uring_setup(0xbdb, &(0x7f0000000580)={0x0, 0xdabc, 0x10, 0x0, 0x24, 0x0, r6}) syz_io_uring_setup(0x6478, &(0x7f0000000200)={0x0, 0xbc58, 0x4, 0x0, 0x14f, 0x0, r5}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x3000)=nil, &(0x7f0000000000), &(0x7f0000000280)) r7 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r7, 0x8000000) syz_io_uring_setup(0x1b7f, &(0x7f0000000440)={0x0, 0x86d3, 0x2, 0x2, 0x69, 0x0, r7}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) io_uring_setup(0x75d8, &(0x7f00000003c0)={0x0, 0x2187, 0x0, 0x2, 0x65, 0x0, r7}) 01:07:39 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6]}) 01:07:39 executing program 4: socketpair(0x2c, 0x0, 0x1c2, &(0x7f0000000100)) 01:07:39 executing program 2: socketpair(0x22, 0x0, 0x7501, &(0x7f0000000100)) 01:07:39 executing program 0: r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x4020940d, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x0, 0x0}) 01:07:39 executing program 1: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r0, 0x8000000) r1 = io_uring_setup(0xc42, &(0x7f0000000080)={0x0, 0x14a2, 0x1, 0x3, 0x4, 0x0, r0}) r2 = io_uring_setup(0x7e05, &(0x7f0000000100)={0x0, 0x2d53, 0x20, 0x3, 0x3f, 0x0, r1}) r3 = openat$zero(0xffffffffffffff9c, &(0x7f00000007c0)='/dev/zero\x00', 0x7f187f66c4f689d0, 0x0) setsockopt$XDP_UMEM_FILL_RING(r3, 0x11b, 0x5, &(0x7f0000000800)=0x200400, 0x4) r4 = syz_io_uring_setup(0x65ec, &(0x7f0000000600)={0x0, 0x36fd, 0x4, 0x3, 0x147, 0x0, r3}, &(0x7f0000ff9000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000540), &(0x7f0000000680)) syz_io_uring_setup(0x6787, &(0x7f00000002c0)={0x0, 0x10066d5, 0x2b, 0x2, 0x42, 0x0, r4}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) r5 = io_uring_setup(0x51d5, &(0x7f0000000180)={0x0, 0x6119, 0x10, 0x2, 0x251, 0x0, r2}) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='mounts\x00') r6 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r6, 0x8000000) io_uring_setup(0xbdb, &(0x7f0000000580)={0x0, 0xdabc, 0x10, 0x0, 0x24, 0x0, r6}) syz_io_uring_setup(0x6478, &(0x7f0000000200)={0x0, 0xbc58, 0x4, 0x0, 0x14f, 0x0, r5}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x3000)=nil, &(0x7f0000000000), &(0x7f0000000280)) r7 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r7, 0x8000000) 01:07:39 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000]}) 01:07:39 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31, 0x100000000, 0x6, 0x6]}) 01:07:39 executing program 2: socketpair(0x22, 0x0, 0x7600, &(0x7f0000000100)) 01:07:39 executing program 4: socketpair(0x2c, 0x0, 0x1c3, &(0x7f0000000100)) 01:07:39 executing program 0: r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x4020940d, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x0, 0x0}) 01:07:39 executing program 1: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r0, 0x8000000) r1 = io_uring_setup(0xc42, &(0x7f0000000080)={0x0, 0x14a2, 0x1, 0x3, 0x4, 0x0, r0}) r2 = io_uring_setup(0x7e05, &(0x7f0000000100)={0x0, 0x2d53, 0x20, 0x3, 0x3f, 0x0, r1}) r3 = openat$zero(0xffffffffffffff9c, &(0x7f00000007c0)='/dev/zero\x00', 0x7f187f66c4f689d0, 0x0) setsockopt$XDP_UMEM_FILL_RING(r3, 0x11b, 0x5, &(0x7f0000000800)=0x200400, 0x4) r4 = syz_io_uring_setup(0x65ec, &(0x7f0000000600)={0x0, 0x36fd, 0x4, 0x3, 0x147, 0x0, r3}, &(0x7f0000ff9000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000540), &(0x7f0000000680)) syz_io_uring_setup(0x6787, &(0x7f00000002c0)={0x0, 0x10066d5, 0x2b, 0x2, 0x42, 0x0, r4}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) r5 = io_uring_setup(0x51d5, &(0x7f0000000180)={0x0, 0x6119, 0x10, 0x2, 0x251, 0x0, r2}) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='mounts\x00') r6 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r6, 0x8000000) io_uring_setup(0xbdb, &(0x7f0000000580)={0x0, 0xdabc, 0x10, 0x0, 0x24, 0x0, r6}) syz_io_uring_setup(0x6478, &(0x7f0000000200)={0x0, 0xbc58, 0x4, 0x0, 0x14f, 0x0, r5}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x3000)=nil, &(0x7f0000000000), &(0x7f0000000280)) openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) 01:07:39 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31]}) 01:07:40 executing program 2: socketpair(0x22, 0x0, 0x7601, &(0x7f0000000100)) 01:07:40 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/sco\x00') r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000000c0)='net/softnet_stat\x00') write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r1, &(0x7f0000000140)={0x10, 0x30, 0xfa00, {&(0x7f0000000100), 0x3, {0xa, 0x4e20, 0xf2a, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x1ff}}}, 0x38) mmap$usbfs(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x0, 0x80010, r0, 0x9) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='mounts\x00') ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000ffd000/0x3000)=nil, 0x3000}, 0x2}) r3 = openat$ocfs2_control(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ocfs2_control\x00', 0x123200, 0x0) getsockopt$bt_BT_RCVMTU(r3, 0x112, 0xd, &(0x7f00000001c0)=0x6, &(0x7f0000000200)=0x2) 01:07:40 executing program 4: socketpair(0x2c, 0x0, 0x1c4, &(0x7f0000000100)) 01:07:40 executing program 0: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0x4020940d, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x0, 0x0}) 01:07:40 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff]}) 01:07:40 executing program 2: socketpair(0x22, 0x0, 0x7700, &(0x7f0000000100)) 01:07:40 executing program 1: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r0, 0x8000000) r1 = io_uring_setup(0xc42, &(0x7f0000000080)={0x0, 0x14a2, 0x1, 0x3, 0x4, 0x0, r0}) r2 = io_uring_setup(0x7e05, &(0x7f0000000100)={0x0, 0x2d53, 0x20, 0x3, 0x3f, 0x0, r1}) r3 = openat$zero(0xffffffffffffff9c, &(0x7f00000007c0)='/dev/zero\x00', 0x7f187f66c4f689d0, 0x0) setsockopt$XDP_UMEM_FILL_RING(r3, 0x11b, 0x5, &(0x7f0000000800)=0x200400, 0x4) r4 = syz_io_uring_setup(0x65ec, &(0x7f0000000600)={0x0, 0x36fd, 0x4, 0x3, 0x147, 0x0, r3}, &(0x7f0000ff9000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000540), &(0x7f0000000680)) syz_io_uring_setup(0x6787, &(0x7f00000002c0)={0x0, 0x10066d5, 0x2b, 0x2, 0x42, 0x0, r4}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) r5 = io_uring_setup(0x51d5, &(0x7f0000000180)={0x0, 0x6119, 0x10, 0x2, 0x251, 0x0, r2}) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='mounts\x00') r6 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r6, 0x8000000) io_uring_setup(0xbdb, &(0x7f0000000580)={0x0, 0xdabc, 0x10, 0x0, 0x24, 0x0, r6}) syz_io_uring_setup(0x6478, &(0x7f0000000200)={0x0, 0xbc58, 0x4, 0x0, 0x14f, 0x0, r5}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x3000)=nil, &(0x7f0000000000), &(0x7f0000000280)) 01:07:40 executing program 3: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r0, 0x8000000) r1 = io_uring_setup(0xc42, &(0x7f0000000080)={0x0, 0x14a2, 0x1, 0x3, 0x4, 0x0, r0}) r2 = io_uring_setup(0x7e05, &(0x7f0000000100)={0x0, 0x2d53, 0x20, 0x3, 0x3f, 0x0, r1}) r3 = openat$zero(0xffffffffffffff9c, &(0x7f00000007c0)='/dev/zero\x00', 0x7f187f66c4f689d0, 0x0) setsockopt$XDP_UMEM_FILL_RING(r3, 0x11b, 0x5, &(0x7f0000000800)=0x200400, 0x4) r4 = syz_io_uring_setup(0x65ec, &(0x7f0000000600)={0x0, 0x36fd, 0x4, 0x3, 0x147, 0x0, r3}, &(0x7f0000ff9000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000540), &(0x7f0000000680)) syz_io_uring_setup(0x6787, &(0x7f00000002c0)={0x0, 0x10066d5, 0x2b, 0x2, 0x42, 0x0, r4}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) r5 = io_uring_setup(0x51d5, &(0x7f0000000180)={0x0, 0x6119, 0x10, 0x2, 0x251, 0x0, r2}) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='mounts\x00') r6 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r6, 0x8000000) io_uring_setup(0xbdb, &(0x7f0000000580)={0x0, 0xdabc, 0x10, 0x0, 0x24, 0x0, r6}) syz_io_uring_setup(0x6478, &(0x7f0000000200)={0x0, 0xbc58, 0x4, 0x0, 0x14f, 0x0, r5}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x3000)=nil, &(0x7f0000000000), &(0x7f0000000280)) openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) 01:07:40 executing program 4: socketpair(0x2c, 0x0, 0x1c5, &(0x7f0000000100)) 01:07:40 executing program 0: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0x4020940d, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x0, 0x0}) 01:07:40 executing program 2: socketpair(0x22, 0x0, 0x7701, &(0x7f0000000100)) 01:07:40 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2]}) 01:07:40 executing program 3: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r0, 0x8000000) r1 = io_uring_setup(0xc42, &(0x7f0000000080)={0x0, 0x14a2, 0x1, 0x3, 0x4, 0x0, r0}) r2 = io_uring_setup(0x7e05, &(0x7f0000000100)={0x0, 0x2d53, 0x20, 0x3, 0x3f, 0x0, r1}) r3 = openat$zero(0xffffffffffffff9c, &(0x7f00000007c0)='/dev/zero\x00', 0x7f187f66c4f689d0, 0x0) setsockopt$XDP_UMEM_FILL_RING(r3, 0x11b, 0x5, &(0x7f0000000800)=0x200400, 0x4) r4 = syz_io_uring_setup(0x65ec, &(0x7f0000000600)={0x0, 0x36fd, 0x4, 0x3, 0x147, 0x0, r3}, &(0x7f0000ff9000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000540), &(0x7f0000000680)) syz_io_uring_setup(0x6787, &(0x7f00000002c0)={0x0, 0x10066d5, 0x2b, 0x2, 0x42, 0x0, r4}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) r5 = io_uring_setup(0x51d5, &(0x7f0000000180)={0x0, 0x6119, 0x10, 0x2, 0x251, 0x0, r2}) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='mounts\x00') r6 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r6, 0x8000000) io_uring_setup(0xbdb, &(0x7f0000000580)={0x0, 0xdabc, 0x10, 0x0, 0x24, 0x0, r6}) syz_io_uring_setup(0x6478, &(0x7f0000000200)={0x0, 0xbc58, 0x4, 0x0, 0x14f, 0x0, r5}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x3000)=nil, &(0x7f0000000000), &(0x7f0000000280)) openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) 01:07:40 executing program 4: socketpair(0x2c, 0x0, 0x1c6, &(0x7f0000000100)) 01:07:40 executing program 0: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0x4020940d, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x0, 0x0}) 01:07:40 executing program 1: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r0, 0x8000000) r1 = io_uring_setup(0xc42, &(0x7f0000000080)={0x0, 0x14a2, 0x1, 0x3, 0x4, 0x0, r0}) r2 = io_uring_setup(0x7e05, &(0x7f0000000100)={0x0, 0x2d53, 0x20, 0x3, 0x3f, 0x0, r1}) r3 = openat$zero(0xffffffffffffff9c, &(0x7f00000007c0)='/dev/zero\x00', 0x7f187f66c4f689d0, 0x0) setsockopt$XDP_UMEM_FILL_RING(r3, 0x11b, 0x5, &(0x7f0000000800)=0x200400, 0x4) r4 = syz_io_uring_setup(0x65ec, &(0x7f0000000600)={0x0, 0x36fd, 0x4, 0x3, 0x147, 0x0, r3}, &(0x7f0000ff9000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000540), &(0x7f0000000680)) syz_io_uring_setup(0x6787, &(0x7f00000002c0)={0x0, 0x10066d5, 0x2b, 0x2, 0x42, 0x0, r4}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) io_uring_setup(0x51d5, &(0x7f0000000180)={0x0, 0x6119, 0x10, 0x2, 0x251, 0x0, r2}) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='mounts\x00') r5 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r5, 0x8000000) io_uring_setup(0xbdb, &(0x7f0000000580)={0x0, 0xdabc, 0x10, 0x0, 0x24, 0x0, r5}) 01:07:40 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800]}) 01:07:40 executing program 2: socketpair(0x22, 0x0, 0x7800, &(0x7f0000000100)) 01:07:40 executing program 4: socketpair(0x2c, 0x0, 0x1c7, &(0x7f0000000100)) 01:07:40 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x4020940d, 0x0) 01:07:40 executing program 3: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r0, 0x8000000) r1 = io_uring_setup(0xc42, &(0x7f0000000080)={0x0, 0x14a2, 0x1, 0x3, 0x4, 0x0, r0}) r2 = io_uring_setup(0x7e05, &(0x7f0000000100)={0x0, 0x2d53, 0x20, 0x3, 0x3f, 0x0, r1}) r3 = openat$zero(0xffffffffffffff9c, &(0x7f00000007c0)='/dev/zero\x00', 0x7f187f66c4f689d0, 0x0) setsockopt$XDP_UMEM_FILL_RING(r3, 0x11b, 0x5, &(0x7f0000000800)=0x200400, 0x4) r4 = syz_io_uring_setup(0x65ec, &(0x7f0000000600)={0x0, 0x36fd, 0x4, 0x3, 0x147, 0x0, r3}, &(0x7f0000ff9000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000540), &(0x7f0000000680)) syz_io_uring_setup(0x6787, &(0x7f00000002c0)={0x0, 0x10066d5, 0x2b, 0x2, 0x42, 0x0, r4}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) r5 = io_uring_setup(0x51d5, &(0x7f0000000180)={0x0, 0x6119, 0x10, 0x2, 0x251, 0x0, r2}) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='mounts\x00') r6 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r6, 0x8000000) io_uring_setup(0xbdb, &(0x7f0000000580)={0x0, 0xdabc, 0x10, 0x0, 0x24, 0x0, r6}) syz_io_uring_setup(0x6478, &(0x7f0000000200)={0x0, 0xbc58, 0x4, 0x0, 0x14f, 0x0, r5}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x3000)=nil, &(0x7f0000000000), &(0x7f0000000280)) 01:07:40 executing program 1: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r0, 0x8000000) r1 = io_uring_setup(0xc42, &(0x7f0000000080)={0x0, 0x14a2, 0x1, 0x3, 0x4, 0x0, r0}) r2 = io_uring_setup(0x7e05, &(0x7f0000000100)={0x0, 0x2d53, 0x20, 0x3, 0x3f, 0x0, r1}) r3 = openat$zero(0xffffffffffffff9c, &(0x7f00000007c0)='/dev/zero\x00', 0x7f187f66c4f689d0, 0x0) setsockopt$XDP_UMEM_FILL_RING(r3, 0x11b, 0x5, &(0x7f0000000800)=0x200400, 0x4) r4 = syz_io_uring_setup(0x65ec, &(0x7f0000000600)={0x0, 0x36fd, 0x4, 0x3, 0x147, 0x0, r3}, &(0x7f0000ff9000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000540), &(0x7f0000000680)) syz_io_uring_setup(0x6787, &(0x7f00000002c0)={0x0, 0x10066d5, 0x2b, 0x2, 0x42, 0x0, r4}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) io_uring_setup(0x51d5, &(0x7f0000000180)={0x0, 0x6119, 0x10, 0x2, 0x251, 0x0, r2}) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='mounts\x00') r5 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r5, 0x8000000) 01:07:40 executing program 2: socketpair(0x22, 0x0, 0x7801, &(0x7f0000000100)) 01:07:40 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6]}) 01:07:40 executing program 4: socketpair(0x2c, 0x0, 0x1c8, &(0x7f0000000100)) 01:07:40 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x4020940d, 0x0) 01:07:40 executing program 2: socketpair(0x22, 0x0, 0x7900, &(0x7f0000000100)) 01:07:40 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7]}) 01:07:40 executing program 1: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r0, 0x8000000) r1 = io_uring_setup(0xc42, &(0x7f0000000080)={0x0, 0x14a2, 0x1, 0x3, 0x4, 0x0, r0}) r2 = io_uring_setup(0x7e05, &(0x7f0000000100)={0x0, 0x2d53, 0x20, 0x3, 0x3f, 0x0, r1}) r3 = openat$zero(0xffffffffffffff9c, &(0x7f00000007c0)='/dev/zero\x00', 0x7f187f66c4f689d0, 0x0) setsockopt$XDP_UMEM_FILL_RING(r3, 0x11b, 0x5, &(0x7f0000000800)=0x200400, 0x4) r4 = syz_io_uring_setup(0x65ec, &(0x7f0000000600)={0x0, 0x36fd, 0x4, 0x3, 0x147, 0x0, r3}, &(0x7f0000ff9000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000540), &(0x7f0000000680)) syz_io_uring_setup(0x6787, &(0x7f00000002c0)={0x0, 0x10066d5, 0x2b, 0x2, 0x42, 0x0, r4}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) io_uring_setup(0x51d5, &(0x7f0000000180)={0x0, 0x6119, 0x10, 0x2, 0x251, 0x0, r2}) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='mounts\x00') openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) 01:07:41 executing program 3: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r0, 0x8000000) r1 = io_uring_setup(0xc42, &(0x7f0000000080)={0x0, 0x14a2, 0x1, 0x3, 0x4, 0x0, r0}) r2 = io_uring_setup(0x7e05, &(0x7f0000000100)={0x0, 0x2d53, 0x20, 0x3, 0x3f, 0x0, r1}) r3 = openat$zero(0xffffffffffffff9c, &(0x7f00000007c0)='/dev/zero\x00', 0x7f187f66c4f689d0, 0x0) setsockopt$XDP_UMEM_FILL_RING(r3, 0x11b, 0x5, &(0x7f0000000800)=0x200400, 0x4) r4 = syz_io_uring_setup(0x65ec, &(0x7f0000000600)={0x0, 0x36fd, 0x4, 0x3, 0x147, 0x0, r3}, &(0x7f0000ff9000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000540), &(0x7f0000000680)) syz_io_uring_setup(0x6787, &(0x7f00000002c0)={0x0, 0x10066d5, 0x2b, 0x2, 0x42, 0x0, r4}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) io_uring_setup(0x51d5, &(0x7f0000000180)={0x0, 0x6119, 0x10, 0x2, 0x251, 0x0, r2}) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='mounts\x00') r5 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r5, 0x8000000) 01:07:41 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x4020940d, 0x0) 01:07:41 executing program 4: socketpair(0x2c, 0x0, 0x1c9, &(0x7f0000000100)) 01:07:41 executing program 2: socketpair(0x22, 0x0, 0x7901, &(0x7f0000000100)) 01:07:41 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800]}) 01:07:41 executing program 3: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r0, 0x8000000) r1 = io_uring_setup(0xc42, &(0x7f0000000080)={0x0, 0x14a2, 0x1, 0x3, 0x4, 0x0, r0}) r2 = io_uring_setup(0x7e05, &(0x7f0000000100)={0x0, 0x2d53, 0x20, 0x3, 0x3f, 0x0, r1}) r3 = openat$zero(0xffffffffffffff9c, &(0x7f00000007c0)='/dev/zero\x00', 0x7f187f66c4f689d0, 0x0) setsockopt$XDP_UMEM_FILL_RING(r3, 0x11b, 0x5, &(0x7f0000000800)=0x200400, 0x4) r4 = syz_io_uring_setup(0x65ec, &(0x7f0000000600)={0x0, 0x36fd, 0x4, 0x3, 0x147, 0x0, r3}, &(0x7f0000ff9000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000540), &(0x7f0000000680)) syz_io_uring_setup(0x6787, &(0x7f00000002c0)={0x0, 0x10066d5, 0x2b, 0x2, 0x42, 0x0, r4}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) io_uring_setup(0x51d5, &(0x7f0000000180)={0x0, 0x6119, 0x10, 0x2, 0x251, 0x0, r2}) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='mounts\x00') r5 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r5, 0x8000000) 01:07:41 executing program 1: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r0, 0x8000000) r1 = io_uring_setup(0xc42, &(0x7f0000000080)={0x0, 0x14a2, 0x1, 0x3, 0x4, 0x0, r0}) r2 = io_uring_setup(0x7e05, &(0x7f0000000100)={0x0, 0x2d53, 0x20, 0x3, 0x3f, 0x0, r1}) r3 = openat$zero(0xffffffffffffff9c, &(0x7f00000007c0)='/dev/zero\x00', 0x7f187f66c4f689d0, 0x0) setsockopt$XDP_UMEM_FILL_RING(r3, 0x11b, 0x5, &(0x7f0000000800)=0x200400, 0x4) r4 = syz_io_uring_setup(0x65ec, &(0x7f0000000600)={0x0, 0x36fd, 0x4, 0x3, 0x147, 0x0, r3}, &(0x7f0000ff9000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000540), &(0x7f0000000680)) syz_io_uring_setup(0x6787, &(0x7f00000002c0)={0x0, 0x10066d5, 0x2b, 0x2, 0x42, 0x0, r4}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) io_uring_setup(0x51d5, &(0x7f0000000180)={0x0, 0x6119, 0x10, 0x2, 0x251, 0x0, r2}) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='mounts\x00') 01:07:41 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x4020940d, &(0x7f0000000100)={0x1c, 0x0, 0x0, 0x0, 0x0, 0x0}) 01:07:41 executing program 4: socketpair(0x2c, 0x0, 0x1ca, &(0x7f0000000100)) 01:07:41 executing program 2: socketpair(0x22, 0x0, 0x7a00, &(0x7f0000000100)) 01:07:41 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001]}) 01:07:41 executing program 4: socketpair(0x2c, 0x0, 0x1cb, &(0x7f0000000100)) 01:07:41 executing program 0: socketpair(0x2c, 0x0, 0x1c8, &(0x7f0000000100)) 01:07:41 executing program 1: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r0, 0x8000000) r1 = io_uring_setup(0xc42, &(0x7f0000000080)={0x0, 0x14a2, 0x1, 0x3, 0x4, 0x0, r0}) r2 = io_uring_setup(0x7e05, &(0x7f0000000100)={0x0, 0x2d53, 0x20, 0x3, 0x3f, 0x0, r1}) r3 = openat$zero(0xffffffffffffff9c, &(0x7f00000007c0)='/dev/zero\x00', 0x7f187f66c4f689d0, 0x0) setsockopt$XDP_UMEM_FILL_RING(r3, 0x11b, 0x5, &(0x7f0000000800)=0x200400, 0x4) r4 = syz_io_uring_setup(0x65ec, &(0x7f0000000600)={0x0, 0x36fd, 0x4, 0x3, 0x147, 0x0, r3}, &(0x7f0000ff9000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000540), &(0x7f0000000680)) syz_io_uring_setup(0x6787, &(0x7f00000002c0)={0x0, 0x10066d5, 0x2b, 0x2, 0x42, 0x0, r4}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) io_uring_setup(0x51d5, &(0x7f0000000180)={0x0, 0x6119, 0x10, 0x2, 0x251, 0x0, r2}) 01:07:41 executing program 3: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r0, 0x8000000) r1 = io_uring_setup(0xc42, &(0x7f0000000080)={0x0, 0x14a2, 0x1, 0x3, 0x4, 0x0, r0}) r2 = io_uring_setup(0x7e05, &(0x7f0000000100)={0x0, 0x2d53, 0x20, 0x3, 0x3f, 0x0, r1}) r3 = openat$zero(0xffffffffffffff9c, &(0x7f00000007c0)='/dev/zero\x00', 0x7f187f66c4f689d0, 0x0) setsockopt$XDP_UMEM_FILL_RING(r3, 0x11b, 0x5, &(0x7f0000000800)=0x200400, 0x4) r4 = syz_io_uring_setup(0x65ec, &(0x7f0000000600)={0x0, 0x36fd, 0x4, 0x3, 0x147, 0x0, r3}, &(0x7f0000ff9000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000540), &(0x7f0000000680)) syz_io_uring_setup(0x6787, &(0x7f00000002c0)={0x0, 0x10066d5, 0x2b, 0x2, 0x42, 0x0, r4}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) io_uring_setup(0x51d5, &(0x7f0000000180)={0x0, 0x6119, 0x10, 0x2, 0x251, 0x0, r2}) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='mounts\x00') r5 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r5, 0x8000000) 01:07:41 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff]}) 01:07:41 executing program 2: socketpair(0x22, 0x0, 0x7a01, &(0x7f0000000100)) 01:07:41 executing program 1: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r0, 0x8000000) r1 = io_uring_setup(0xc42, &(0x7f0000000080)={0x0, 0x14a2, 0x1, 0x3, 0x4, 0x0, r0}) io_uring_setup(0x7e05, &(0x7f0000000100)={0x0, 0x2d53, 0x20, 0x3, 0x3f, 0x0, r1}) r2 = openat$zero(0xffffffffffffff9c, &(0x7f00000007c0)='/dev/zero\x00', 0x7f187f66c4f689d0, 0x0) setsockopt$XDP_UMEM_FILL_RING(r2, 0x11b, 0x5, &(0x7f0000000800)=0x200400, 0x4) r3 = syz_io_uring_setup(0x65ec, &(0x7f0000000600)={0x0, 0x36fd, 0x4, 0x3, 0x147, 0x0, r2}, &(0x7f0000ff9000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000540), &(0x7f0000000680)) syz_io_uring_setup(0x6787, &(0x7f00000002c0)={0x0, 0x10066d5, 0x2b, 0x2, 0x42, 0x0, r3}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) 01:07:41 executing program 0: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r0, 0x8000000) r1 = io_uring_setup(0xc42, &(0x7f0000000080)={0x0, 0x14a2, 0x1, 0x3, 0x4, 0x0, r0}) r2 = io_uring_setup(0x7e05, &(0x7f0000000100)={0x0, 0x2d53, 0x20, 0x3, 0x3f, 0x0, r1}) r3 = openat$zero(0xffffffffffffff9c, &(0x7f00000007c0)='/dev/zero\x00', 0x7f187f66c4f689d0, 0x0) setsockopt$XDP_UMEM_FILL_RING(r3, 0x11b, 0x5, &(0x7f0000000800)=0x200400, 0x4) r4 = syz_io_uring_setup(0x65ec, &(0x7f0000000600)={0x0, 0x36fd, 0x4, 0x3, 0x147, 0x0, r3}, &(0x7f0000ff9000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000540), &(0x7f0000000680)) syz_io_uring_setup(0x6787, &(0x7f00000002c0)={0x0, 0x10066d5, 0x2b, 0x2, 0x42, 0x0, r4}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) io_uring_setup(0x51d5, &(0x7f0000000180)={0x0, 0x6119, 0x10, 0x2, 0x251, 0x0, r2}) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='mounts\x00') 01:07:41 executing program 4: socketpair(0x2c, 0x0, 0x1cc, &(0x7f0000000100)) 01:07:41 executing program 3: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r0, 0x8000000) r1 = io_uring_setup(0xc42, &(0x7f0000000080)={0x0, 0x14a2, 0x1, 0x3, 0x4, 0x0, r0}) r2 = io_uring_setup(0x7e05, &(0x7f0000000100)={0x0, 0x2d53, 0x20, 0x3, 0x3f, 0x0, r1}) r3 = openat$zero(0xffffffffffffff9c, &(0x7f00000007c0)='/dev/zero\x00', 0x7f187f66c4f689d0, 0x0) setsockopt$XDP_UMEM_FILL_RING(r3, 0x11b, 0x5, &(0x7f0000000800)=0x200400, 0x4) r4 = syz_io_uring_setup(0x65ec, &(0x7f0000000600)={0x0, 0x36fd, 0x4, 0x3, 0x147, 0x0, r3}, &(0x7f0000ff9000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000540), &(0x7f0000000680)) syz_io_uring_setup(0x6787, &(0x7f00000002c0)={0x0, 0x10066d5, 0x2b, 0x2, 0x42, 0x0, r4}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) io_uring_setup(0x51d5, &(0x7f0000000180)={0x0, 0x6119, 0x10, 0x2, 0x251, 0x0, r2}) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='mounts\x00') openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) 01:07:41 executing program 4: socketpair(0x2c, 0x0, 0x1cd, &(0x7f0000000100)) 01:07:41 executing program 2: socketpair(0x22, 0x0, 0x7b00, &(0x7f0000000100)) 01:07:41 executing program 1: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r0, 0x8000000) r1 = io_uring_setup(0xc42, &(0x7f0000000080)={0x0, 0x14a2, 0x1, 0x3, 0x4, 0x0, r0}) io_uring_setup(0x7e05, &(0x7f0000000100)={0x0, 0x2d53, 0x20, 0x3, 0x3f, 0x0, r1}) r2 = openat$zero(0xffffffffffffff9c, &(0x7f00000007c0)='/dev/zero\x00', 0x7f187f66c4f689d0, 0x0) setsockopt$XDP_UMEM_FILL_RING(r2, 0x11b, 0x5, &(0x7f0000000800)=0x200400, 0x4) syz_io_uring_setup(0x65ec, &(0x7f0000000600)={0x0, 0x36fd, 0x4, 0x3, 0x147, 0x0, r2}, &(0x7f0000ff9000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000540), &(0x7f0000000680)) 01:07:41 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc]}) 01:07:41 executing program 0: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r0, 0x8000000) r1 = io_uring_setup(0xc42, &(0x7f0000000080)={0x0, 0x14a2, 0x1, 0x3, 0x4, 0x0, r0}) r2 = io_uring_setup(0x7e05, &(0x7f0000000100)={0x0, 0x2d53, 0x20, 0x3, 0x3f, 0x0, r1}) r3 = openat$zero(0xffffffffffffff9c, &(0x7f00000007c0)='/dev/zero\x00', 0x7f187f66c4f689d0, 0x0) setsockopt$XDP_UMEM_FILL_RING(r3, 0x11b, 0x5, &(0x7f0000000800)=0x200400, 0x4) r4 = syz_io_uring_setup(0x65ec, &(0x7f0000000600)={0x0, 0x36fd, 0x4, 0x3, 0x147, 0x0, r3}, &(0x7f0000ff9000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000540), &(0x7f0000000680)) syz_io_uring_setup(0x6787, &(0x7f00000002c0)={0x0, 0x10066d5, 0x2b, 0x2, 0x42, 0x0, r4}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) io_uring_setup(0x51d5, &(0x7f0000000180)={0x0, 0x6119, 0x10, 0x2, 0x251, 0x0, r2}) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='mounts\x00') r5 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r5, 0x8000000) 01:07:41 executing program 3: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r0, 0x8000000) r1 = io_uring_setup(0xc42, &(0x7f0000000080)={0x0, 0x14a2, 0x1, 0x3, 0x4, 0x0, r0}) r2 = io_uring_setup(0x7e05, &(0x7f0000000100)={0x0, 0x2d53, 0x20, 0x3, 0x3f, 0x0, r1}) r3 = openat$zero(0xffffffffffffff9c, &(0x7f00000007c0)='/dev/zero\x00', 0x7f187f66c4f689d0, 0x0) setsockopt$XDP_UMEM_FILL_RING(r3, 0x11b, 0x5, &(0x7f0000000800)=0x200400, 0x4) r4 = syz_io_uring_setup(0x65ec, &(0x7f0000000600)={0x0, 0x36fd, 0x4, 0x3, 0x147, 0x0, r3}, &(0x7f0000ff9000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000540), &(0x7f0000000680)) syz_io_uring_setup(0x6787, &(0x7f00000002c0)={0x0, 0x10066d5, 0x2b, 0x2, 0x42, 0x0, r4}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) io_uring_setup(0x51d5, &(0x7f0000000180)={0x0, 0x6119, 0x10, 0x2, 0x251, 0x0, r2}) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='mounts\x00') 01:07:42 executing program 4: socketpair(0x2c, 0x0, 0x1ce, &(0x7f0000000100)) 01:07:42 executing program 2: socketpair(0x22, 0x0, 0x7b01, &(0x7f0000000100)) 01:07:42 executing program 1: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r0, 0x8000000) r1 = io_uring_setup(0xc42, &(0x7f0000000080)={0x0, 0x14a2, 0x1, 0x3, 0x4, 0x0, r0}) io_uring_setup(0x7e05, &(0x7f0000000100)={0x0, 0x2d53, 0x20, 0x3, 0x3f, 0x0, r1}) r2 = openat$zero(0xffffffffffffff9c, &(0x7f00000007c0)='/dev/zero\x00', 0x7f187f66c4f689d0, 0x0) setsockopt$XDP_UMEM_FILL_RING(r2, 0x11b, 0x5, &(0x7f0000000800)=0x200400, 0x4) 01:07:42 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8]}) 01:07:42 executing program 4: socketpair(0x2c, 0x0, 0x1cf, &(0x7f0000000100)) 01:07:42 executing program 3: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r0, 0x8000000) r1 = io_uring_setup(0xc42, &(0x7f0000000080)={0x0, 0x14a2, 0x1, 0x3, 0x4, 0x0, r0}) r2 = io_uring_setup(0x7e05, &(0x7f0000000100)={0x0, 0x2d53, 0x20, 0x3, 0x3f, 0x0, r1}) r3 = openat$zero(0xffffffffffffff9c, &(0x7f00000007c0)='/dev/zero\x00', 0x7f187f66c4f689d0, 0x0) setsockopt$XDP_UMEM_FILL_RING(r3, 0x11b, 0x5, &(0x7f0000000800)=0x200400, 0x4) r4 = syz_io_uring_setup(0x65ec, &(0x7f0000000600)={0x0, 0x36fd, 0x4, 0x3, 0x147, 0x0, r3}, &(0x7f0000ff9000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000540), &(0x7f0000000680)) syz_io_uring_setup(0x6787, &(0x7f00000002c0)={0x0, 0x10066d5, 0x2b, 0x2, 0x42, 0x0, r4}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) io_uring_setup(0x51d5, &(0x7f0000000180)={0x0, 0x6119, 0x10, 0x2, 0x251, 0x0, r2}) 01:07:42 executing program 0: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r0, 0x8000000) r1 = io_uring_setup(0xc42, &(0x7f0000000080)={0x0, 0x14a2, 0x1, 0x3, 0x4, 0x0, r0}) r2 = io_uring_setup(0x7e05, &(0x7f0000000100)={0x0, 0x2d53, 0x20, 0x3, 0x3f, 0x0, r1}) r3 = openat$zero(0xffffffffffffff9c, &(0x7f00000007c0)='/dev/zero\x00', 0x7f187f66c4f689d0, 0x0) setsockopt$XDP_UMEM_FILL_RING(r3, 0x11b, 0x5, &(0x7f0000000800)=0x200400, 0x4) r4 = syz_io_uring_setup(0x65ec, &(0x7f0000000600)={0x0, 0x36fd, 0x4, 0x3, 0x147, 0x0, r3}, &(0x7f0000ff9000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000540), &(0x7f0000000680)) syz_io_uring_setup(0x6787, &(0x7f00000002c0)={0x0, 0x10066d5, 0x2b, 0x2, 0x42, 0x0, r4}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) io_uring_setup(0x51d5, &(0x7f0000000180)={0x0, 0x6119, 0x10, 0x2, 0x251, 0x0, r2}) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='mounts\x00') openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) 01:07:42 executing program 2: socketpair(0x22, 0x0, 0x7c00, &(0x7f0000000100)) 01:07:42 executing program 1: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r0, 0x8000000) r1 = io_uring_setup(0xc42, &(0x7f0000000080)={0x0, 0x14a2, 0x1, 0x3, 0x4, 0x0, r0}) io_uring_setup(0x7e05, &(0x7f0000000100)={0x0, 0x2d53, 0x20, 0x3, 0x3f, 0x0, r1}) openat$zero(0xffffffffffffff9c, &(0x7f00000007c0)='/dev/zero\x00', 0x7f187f66c4f689d0, 0x0) 01:07:42 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9]}) 01:07:42 executing program 4: socketpair(0x2c, 0x0, 0x1d0, &(0x7f0000000100)) 01:07:42 executing program 0: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r0, 0x8000000) r1 = io_uring_setup(0xc42, &(0x7f0000000080)={0x0, 0x14a2, 0x1, 0x3, 0x4, 0x0, r0}) r2 = io_uring_setup(0x7e05, &(0x7f0000000100)={0x0, 0x2d53, 0x20, 0x3, 0x3f, 0x0, r1}) r3 = openat$zero(0xffffffffffffff9c, &(0x7f00000007c0)='/dev/zero\x00', 0x7f187f66c4f689d0, 0x0) setsockopt$XDP_UMEM_FILL_RING(r3, 0x11b, 0x5, &(0x7f0000000800)=0x200400, 0x4) r4 = syz_io_uring_setup(0x65ec, &(0x7f0000000600)={0x0, 0x36fd, 0x4, 0x3, 0x147, 0x0, r3}, &(0x7f0000ff9000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000540), &(0x7f0000000680)) syz_io_uring_setup(0x6787, &(0x7f00000002c0)={0x0, 0x10066d5, 0x2b, 0x2, 0x42, 0x0, r4}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) r5 = io_uring_setup(0x51d5, &(0x7f0000000180)={0x0, 0x6119, 0x10, 0x2, 0x251, 0x0, r2}) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='mounts\x00') r6 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r6, 0x8000000) io_uring_setup(0xbdb, &(0x7f0000000580)={0x0, 0xdabc, 0x10, 0x0, 0x24, 0x0, r6}) syz_io_uring_setup(0x6478, &(0x7f0000000200)={0x0, 0xbc58, 0x4, 0x0, 0x14f, 0x0, r5}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x3000)=nil, &(0x7f0000000000), &(0x7f0000000280)) 01:07:42 executing program 3: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r0, 0x8000000) r1 = io_uring_setup(0xc42, &(0x7f0000000080)={0x0, 0x14a2, 0x1, 0x3, 0x4, 0x0, r0}) io_uring_setup(0x7e05, &(0x7f0000000100)={0x0, 0x2d53, 0x20, 0x3, 0x3f, 0x0, r1}) r2 = openat$zero(0xffffffffffffff9c, &(0x7f00000007c0)='/dev/zero\x00', 0x7f187f66c4f689d0, 0x0) setsockopt$XDP_UMEM_FILL_RING(r2, 0x11b, 0x5, &(0x7f0000000800)=0x200400, 0x4) r3 = syz_io_uring_setup(0x65ec, &(0x7f0000000600)={0x0, 0x36fd, 0x4, 0x3, 0x147, 0x0, r2}, &(0x7f0000ff9000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000540), &(0x7f0000000680)) syz_io_uring_setup(0x6787, &(0x7f00000002c0)={0x0, 0x10066d5, 0x2b, 0x2, 0x42, 0x0, r3}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) 01:07:42 executing program 2: socketpair(0x22, 0x0, 0x7c01, &(0x7f0000000100)) 01:07:42 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2]}) 01:07:42 executing program 1: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r0, 0x8000000) r1 = io_uring_setup(0xc42, &(0x7f0000000080)={0x0, 0x14a2, 0x1, 0x3, 0x4, 0x0, r0}) io_uring_setup(0x7e05, &(0x7f0000000100)={0x0, 0x2d53, 0x20, 0x3, 0x3f, 0x0, r1}) 01:07:42 executing program 4: socketpair(0x2c, 0x0, 0x1d1, &(0x7f0000000100)) 01:07:42 executing program 2: socketpair(0x22, 0x0, 0x7d00, &(0x7f0000000100)) 01:07:42 executing program 0: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r0, 0x8000000) r1 = io_uring_setup(0xc42, &(0x7f0000000080)={0x0, 0x14a2, 0x1, 0x3, 0x4, 0x0, r0}) io_uring_setup(0x7e05, &(0x7f0000000100)={0x0, 0x2d53, 0x20, 0x3, 0x3f, 0x0, r1}) openat$zero(0xffffffffffffff9c, &(0x7f00000007c0)='/dev/zero\x00', 0x7f187f66c4f689d0, 0x0) 01:07:42 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9]}) 01:07:42 executing program 3: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r0, 0x8000000) r1 = io_uring_setup(0xc42, &(0x7f0000000080)={0x0, 0x14a2, 0x1, 0x3, 0x4, 0x0, r0}) io_uring_setup(0x7e05, &(0x7f0000000100)={0x0, 0x2d53, 0x20, 0x3, 0x3f, 0x0, r1}) r2 = openat$zero(0xffffffffffffff9c, &(0x7f00000007c0)='/dev/zero\x00', 0x7f187f66c4f689d0, 0x0) setsockopt$XDP_UMEM_FILL_RING(r2, 0x11b, 0x5, &(0x7f0000000800)=0x200400, 0x4) syz_io_uring_setup(0x65ec, &(0x7f0000000600)={0x0, 0x36fd, 0x4, 0x3, 0x147, 0x0, r2}, &(0x7f0000ff9000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000540), &(0x7f0000000680)) 01:07:42 executing program 1: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r0, 0x8000000) io_uring_setup(0x7e05, &(0x7f0000000100)={0x0, 0x2d53, 0x20, 0x3, 0x3f}) 01:07:42 executing program 4: socketpair(0x2c, 0x0, 0x1d2, &(0x7f0000000100)) 01:07:42 executing program 2: socketpair(0x22, 0x0, 0x7d01, &(0x7f0000000100)) 01:07:42 executing program 0: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r0, 0x8000000) r1 = io_uring_setup(0xc42, &(0x7f0000000080)={0x0, 0x14a2, 0x1, 0x3, 0x4, 0x0, r0}) io_uring_setup(0x7e05, &(0x7f0000000100)={0x0, 0x2d53, 0x20, 0x3, 0x3f, 0x0, r1}) r2 = openat$zero(0xffffffffffffff9c, &(0x7f00000007c0)='/dev/zero\x00', 0x7f187f66c4f689d0, 0x0) setsockopt$XDP_UMEM_FILL_RING(r2, 0x11b, 0x5, &(0x7f0000000800)=0x200400, 0x4) r3 = syz_io_uring_setup(0x65ec, &(0x7f0000000600)={0x0, 0x36fd, 0x4, 0x3, 0x147, 0x0, r2}, &(0x7f0000ff9000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000540), &(0x7f0000000680)) syz_io_uring_setup(0x6787, &(0x7f00000002c0)={0x0, 0x10066d5, 0x2b, 0x2, 0x42, 0x0, r3}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) 01:07:42 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3]}) 01:07:42 executing program 3: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r0, 0x8000000) r1 = io_uring_setup(0xc42, &(0x7f0000000080)={0x0, 0x14a2, 0x1, 0x3, 0x4, 0x0, r0}) io_uring_setup(0x7e05, &(0x7f0000000100)={0x0, 0x2d53, 0x20, 0x3, 0x3f, 0x0, r1}) r2 = openat$zero(0xffffffffffffff9c, &(0x7f00000007c0)='/dev/zero\x00', 0x7f187f66c4f689d0, 0x0) setsockopt$XDP_UMEM_FILL_RING(r2, 0x11b, 0x5, &(0x7f0000000800)=0x200400, 0x4) 01:07:42 executing program 1: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r0, 0x8000000) io_uring_setup(0x7e05, &(0x7f0000000100)={0x0, 0x2d53, 0x20, 0x3, 0x3f}) 01:07:42 executing program 4: socketpair(0x2c, 0x0, 0x1d3, &(0x7f0000000100)) 01:07:43 executing program 2: socketpair(0x22, 0x0, 0x7e00, &(0x7f0000000100)) 01:07:43 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2, 0x0, 0x3, 0x9, 0x2, 0x9, 0x8, 0xfffffffffffffffc, 0x0, 0x7fffffff, 0x100000001, 0x800, 0x7, 0x6, 0x800, 0x2, 0xffff, 0x31]}) 01:07:43 executing program 3: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r0, 0x8000000) r1 = io_uring_setup(0xc42, &(0x7f0000000080)={0x0, 0x14a2, 0x1, 0x3, 0x4, 0x0, r0}) io_uring_setup(0x7e05, &(0x7f0000000100)={0x0, 0x2d53, 0x20, 0x3, 0x3f, 0x0, r1}) openat$zero(0xffffffffffffff9c, &(0x7f00000007c0)='/dev/zero\x00', 0x7f187f66c4f689d0, 0x0) 01:07:43 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8, 0x2]}) 01:07:43 executing program 1: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r0, 0x8000000) io_uring_setup(0x7e05, &(0x7f0000000100)={0x0, 0x2d53, 0x20, 0x3, 0x3f}) 01:07:43 executing program 4: socketpair(0x2c, 0x0, 0x1d4, &(0x7f0000000100)) 01:07:43 executing program 2: socketpair(0x22, 0x0, 0x7e01, &(0x7f0000000100)) 01:07:43 executing program 3: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r0, 0x8000000) r1 = io_uring_setup(0xc42, &(0x7f0000000080)={0x0, 0x14a2, 0x1, 0x3, 0x4, 0x0, r0}) io_uring_setup(0x7e05, &(0x7f0000000100)={0x0, 0x2d53, 0x20, 0x3, 0x3f, 0x0, r1}) 01:07:43 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9, 0x8]}) 01:07:43 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40046207, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x0, 0x0}) 01:07:43 executing program 1: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) r1 = io_uring_setup(0xc42, &(0x7f0000000080)={0x0, 0x14a2, 0x1, 0x3, 0x4, 0x0, r0}) io_uring_setup(0x7e05, &(0x7f0000000100)={0x0, 0x2d53, 0x20, 0x3, 0x3f, 0x0, r1}) 01:07:43 executing program 2: socketpair(0x22, 0x0, 0x7f00, &(0x7f0000000100)) 01:07:43 executing program 4: socketpair(0x2c, 0x0, 0x1d5, &(0x7f0000000100)) 01:07:43 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7, 0x9]}) 01:07:43 executing program 1: r0 = io_uring_setup(0xc42, &(0x7f0000000080)={0x0, 0x14a2, 0x1, 0x3, 0x4}) io_uring_setup(0x7e05, &(0x7f0000000100)={0x0, 0x2d53, 0x20, 0x3, 0x3f, 0x0, r0}) 01:07:43 executing program 3: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r0, 0x8000000) io_uring_setup(0x7e05, &(0x7f0000000100)={0x0, 0x2d53, 0x20, 0x3, 0x3f}) 01:07:43 executing program 0: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r0, 0x8000000) r1 = io_uring_setup(0xc42, &(0x7f0000000080)={0x0, 0x14a2, 0x1, 0x3, 0x4, 0x0, r0}) io_uring_setup(0x7e05, &(0x7f0000000100)={0x0, 0x2d53, 0x20, 0x3, 0x3f, 0x0, r1}) 01:07:43 executing program 2: socketpair(0x22, 0x0, 0x7f01, &(0x7f0000000100)) 01:07:43 executing program 4: socketpair(0x2c, 0x0, 0x1d6, &(0x7f0000000100)) 01:07:43 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7, 0x0, 0x7]}) 01:07:43 executing program 3: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r0, 0x8000000) io_uring_setup(0x7e05, &(0x7f0000000100)={0x0, 0x2d53, 0x20, 0x3, 0x3f}) 01:07:43 executing program 1: r0 = io_uring_setup(0x0, &(0x7f0000000080)={0x0, 0x14a2, 0x1, 0x3, 0x4}) io_uring_setup(0x7e05, &(0x7f0000000100)={0x0, 0x2d53, 0x20, 0x3, 0x3f, 0x0, r0}) 01:07:43 executing program 2: socketpair(0x22, 0x0, 0x8100, &(0x7f0000000100)) 01:07:43 executing program 4: socketpair(0x2c, 0x0, 0x1d7, &(0x7f0000000100)) 01:07:43 executing program 0: socketpair(0x22, 0x0, 0x92, &(0x7f0000000100)) 01:07:43 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8, 0x7]}) 01:07:43 executing program 1: r0 = io_uring_setup(0x0, &(0x7f0000000080)={0x0, 0x14a2, 0x1, 0x3, 0x4}) io_uring_setup(0x7e05, &(0x7f0000000100)={0x0, 0x2d53, 0x20, 0x3, 0x3f, 0x0, r0}) 01:07:43 executing program 3: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r0, 0x8000000) io_uring_setup(0x7e05, &(0x7f0000000100)={0x0, 0x2d53, 0x20, 0x3, 0x3f}) 01:07:43 executing program 4: socketpair(0x2c, 0x0, 0x1d8, &(0x7f0000000100)) 01:07:43 executing program 0: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='mounts\x00') r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0xa0241, 0x0) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xe, 0x100010, r2, 0x8000000) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x2000009, 0x100010, r2, 0x8000000) renameat2(r0, &(0x7f0000000000)='./file0\x00', r1, &(0x7f0000000080)='./file0\x00', 0x0) 01:07:43 executing program 2: socketpair(0x22, 0x0, 0x8101, &(0x7f0000000100)) 01:07:44 executing program 1: r0 = io_uring_setup(0x0, &(0x7f0000000080)={0x0, 0x14a2, 0x1, 0x3, 0x4}) io_uring_setup(0x7e05, &(0x7f0000000100)={0x0, 0x2d53, 0x20, 0x3, 0x3f, 0x0, r0}) 01:07:44 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9, 0xf8]}) 01:07:44 executing program 3: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40)='/dev/zero\x00', 0x0, 0x0) r1 = io_uring_setup(0xc42, &(0x7f0000000080)={0x0, 0x14a2, 0x1, 0x3, 0x4, 0x0, r0}) io_uring_setup(0x7e05, &(0x7f0000000100)={0x0, 0x2d53, 0x20, 0x3, 0x3f, 0x0, r1}) 01:07:44 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x6364, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c"], 0x0, 0x0, 0x0}) 01:07:44 executing program 4: socketpair(0x2c, 0x0, 0x1d9, &(0x7f0000000100)) 01:07:44 executing program 2: socketpair(0x22, 0x0, 0x8200, &(0x7f0000000100)) 01:07:44 executing program 1: r0 = io_uring_setup(0xc42, 0x0) io_uring_setup(0x7e05, &(0x7f0000000100)={0x0, 0x2d53, 0x20, 0x3, 0x3f, 0x0, r0}) 01:07:44 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7, 0x9]}) [ 1463.109988][T18147] binder: 18142:18147 ioctl 6364 20000100 returned -22 01:07:44 executing program 3: r0 = io_uring_setup(0xc42, &(0x7f0000000080)={0x0, 0x14a2, 0x1, 0x3, 0x4}) io_uring_setup(0x7e05, &(0x7f0000000100)={0x0, 0x2d53, 0x20, 0x3, 0x3f, 0x0, r0}) 01:07:44 executing program 2: socketpair(0x22, 0x0, 0x8201, &(0x7f0000000100)) 01:07:44 executing program 4: socketpair(0x2c, 0x0, 0x1da, &(0x7f0000000100)) 01:07:44 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x300, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='mounts\x00') r2 = open$dir(&(0x7f0000000080)='.\x00', 0x12146, 0x99) renameat2(r2, &(0x7f00000000c0)='./file0\x00', r1, &(0x7f0000000100)='./file0\x00', 0x1) 01:07:44 executing program 1: r0 = io_uring_setup(0xc42, 0x0) io_uring_setup(0x7e05, &(0x7f0000000100)={0x0, 0x2d53, 0x20, 0x3, 0x3f, 0x0, r0}) 01:07:44 executing program 2: socketpair(0x22, 0x0, 0x8300, &(0x7f0000000100)) 01:07:44 executing program 3: r0 = io_uring_setup(0x0, &(0x7f0000000080)={0x0, 0x14a2, 0x1, 0x3, 0x4}) io_uring_setup(0x7e05, &(0x7f0000000100)={0x0, 0x2d53, 0x20, 0x3, 0x3f, 0x0, r0}) 01:07:44 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613, 0x4b7]}) 01:07:44 executing program 4: socketpair(0x2c, 0x0, 0x1db, &(0x7f0000000100)) 01:07:44 executing program 3: r0 = io_uring_setup(0x0, &(0x7f0000000080)={0x0, 0x14a2, 0x1, 0x3, 0x4}) io_uring_setup(0x7e05, &(0x7f0000000100)={0x0, 0x2d53, 0x20, 0x3, 0x3f, 0x0, r0}) 01:07:44 executing program 1: r0 = io_uring_setup(0xc42, 0x0) io_uring_setup(0x7e05, &(0x7f0000000100)={0x0, 0x2d53, 0x20, 0x3, 0x3f, 0x0, r0}) 01:07:44 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x300, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='mounts\x00') r2 = open$dir(&(0x7f0000000080)='.\x00', 0x12146, 0x99) renameat2(r2, &(0x7f00000000c0)='./file0\x00', r1, &(0x7f0000000100)='./file0\x00', 0x1) 01:07:44 executing program 2: socketpair(0x22, 0x0, 0x8301, &(0x7f0000000100)) 01:07:44 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3, 0x2646c613]}) 01:07:44 executing program 4: socketpair(0x2c, 0x0, 0x1dc, &(0x7f0000000100)) 01:07:44 executing program 3: r0 = io_uring_setup(0x0, &(0x7f0000000080)={0x0, 0x14a2, 0x1, 0x3, 0x4}) io_uring_setup(0x7e05, &(0x7f0000000100)={0x0, 0x2d53, 0x20, 0x3, 0x3f, 0x0, r0}) 01:07:44 executing program 2: socketpair(0x22, 0x0, 0x8400, &(0x7f0000000100)) 01:07:44 executing program 1: r0 = io_uring_setup(0xc42, &(0x7f0000000080)={0x0, 0x0, 0x1, 0x3, 0x4}) io_uring_setup(0x7e05, &(0x7f0000000100)={0x0, 0x2d53, 0x20, 0x3, 0x3f, 0x0, r0}) 01:07:44 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x3]}) 01:07:44 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x300, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='mounts\x00') r2 = open$dir(&(0x7f0000000080)='.\x00', 0x12146, 0x99) renameat2(r2, &(0x7f00000000c0)='./file0\x00', r1, &(0x7f0000000100)='./file0\x00', 0x1) 01:07:44 executing program 4: socketpair(0x2c, 0x0, 0x1dd, &(0x7f0000000100)) 01:07:45 executing program 2: socketpair(0x22, 0x0, 0x8401, &(0x7f0000000100)) 01:07:45 executing program 1: r0 = io_uring_setup(0xc42, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x3, 0x4}) io_uring_setup(0x7e05, &(0x7f0000000100)={0x0, 0x2d53, 0x20, 0x3, 0x3f, 0x0, r0}) 01:07:45 executing program 3: r0 = io_uring_setup(0xc42, 0x0) io_uring_setup(0x7e05, &(0x7f0000000100)={0x0, 0x2d53, 0x20, 0x3, 0x3f, 0x0, r0}) 01:07:45 executing program 4: socketpair(0x2c, 0x0, 0x1de, &(0x7f0000000100)) 01:07:45 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x300, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='mounts\x00') open$dir(&(0x7f0000000080)='.\x00', 0x12146, 0x99) 01:07:45 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8, 0x8]}) 01:07:45 executing program 1: r0 = io_uring_setup(0xc42, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x4}) io_uring_setup(0x7e05, &(0x7f0000000100)={0x0, 0x2d53, 0x20, 0x3, 0x3f, 0x0, r0}) 01:07:45 executing program 2: socketpair(0x22, 0x0, 0x8500, &(0x7f0000000100)) 01:07:45 executing program 3: r0 = io_uring_setup(0xc42, 0x0) io_uring_setup(0x7e05, &(0x7f0000000100)={0x0, 0x2d53, 0x20, 0x3, 0x3f, 0x0, r0}) 01:07:45 executing program 4: socketpair(0x2c, 0x0, 0x1df, &(0x7f0000000100)) 01:07:45 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4, 0x8]}) 01:07:45 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x300, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) open$dir(&(0x7f0000000080)='.\x00', 0x12146, 0x99) 01:07:45 executing program 3: r0 = io_uring_setup(0xc42, 0x0) io_uring_setup(0x7e05, &(0x7f0000000100)={0x0, 0x2d53, 0x20, 0x3, 0x3f, 0x0, r0}) 01:07:45 executing program 1: r0 = io_uring_setup(0xc42, &(0x7f0000000080)) io_uring_setup(0x7e05, &(0x7f0000000100)={0x0, 0x2d53, 0x20, 0x3, 0x3f, 0x0, r0}) 01:07:45 executing program 2: socketpair(0x22, 0x0, 0x8501, &(0x7f0000000100)) 01:07:45 executing program 4: socketpair(0x2c, 0x0, 0x1e0, &(0x7f0000000100)) 01:07:45 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff, 0x4]}) 01:07:45 executing program 0: openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x300, 0x0) open$dir(&(0x7f0000000080)='.\x00', 0x12146, 0x99) 01:07:45 executing program 3: r0 = io_uring_setup(0xc42, &(0x7f0000000080)={0x0, 0x0, 0x1, 0x3, 0x4}) io_uring_setup(0x7e05, &(0x7f0000000100)={0x0, 0x2d53, 0x20, 0x3, 0x3f, 0x0, r0}) 01:07:45 executing program 1: r0 = io_uring_setup(0xc42, &(0x7f0000000080)) io_uring_setup(0x0, &(0x7f0000000100)={0x0, 0x2d53, 0x20, 0x3, 0x3f, 0x0, r0}) 01:07:45 executing program 2: socketpair(0x22, 0x0, 0x8600, &(0x7f0000000100)) 01:07:45 executing program 4: socketpair(0x2c, 0x0, 0x1e1, &(0x7f0000000100)) 01:07:45 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200, 0xffffffffffffffff]}) 01:07:45 executing program 0: open$dir(&(0x7f0000000080)='.\x00', 0x12146, 0x99) 01:07:46 executing program 3: r0 = io_uring_setup(0xc42, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x3, 0x4}) io_uring_setup(0x7e05, &(0x7f0000000100)={0x0, 0x2d53, 0x20, 0x3, 0x3f, 0x0, r0}) 01:07:46 executing program 1: r0 = io_uring_setup(0xc42, &(0x7f0000000080)) io_uring_setup(0x0, &(0x7f0000000100)={0x0, 0x2d53, 0x20, 0x3, 0x3f, 0x0, r0}) 01:07:46 executing program 2: socketpair(0x22, 0x0, 0x8601, &(0x7f0000000100)) 01:07:46 executing program 4: socketpair(0x2c, 0x0, 0x1e2, &(0x7f0000000100)) 01:07:46 executing program 0: open$dir(0x0, 0x12146, 0x99) 01:07:46 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94, 0x200]}) 01:07:46 executing program 3: r0 = io_uring_setup(0xc42, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x4}) io_uring_setup(0x7e05, &(0x7f0000000100)={0x0, 0x2d53, 0x20, 0x3, 0x3f, 0x0, r0}) 01:07:46 executing program 1: r0 = io_uring_setup(0xc42, &(0x7f0000000080)) io_uring_setup(0x0, &(0x7f0000000100)={0x0, 0x2d53, 0x20, 0x3, 0x3f, 0x0, r0}) 01:07:46 executing program 2: socketpair(0x22, 0x0, 0x8700, &(0x7f0000000100)) 01:07:46 executing program 4: socketpair(0x2c, 0x0, 0x1e3, &(0x7f0000000100)) 01:07:46 executing program 0: open$dir(0x0, 0x12146, 0x99) 01:07:46 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8, 0x94]}) 01:07:46 executing program 3: r0 = io_uring_setup(0xc42, &(0x7f0000000080)) io_uring_setup(0x7e05, &(0x7f0000000100)={0x0, 0x2d53, 0x20, 0x3, 0x3f, 0x0, r0}) 01:07:46 executing program 2: socketpair(0x22, 0x0, 0x8701, &(0x7f0000000100)) 01:07:46 executing program 1: io_uring_setup(0xc42, &(0x7f0000000080)) io_uring_setup(0x7e05, 0x0) 01:07:46 executing program 4: socketpair(0x2c, 0x0, 0x1e4, &(0x7f0000000100)) 01:07:46 executing program 0: open$dir(0x0, 0x12146, 0x99) 01:07:46 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40, 0x759c1f8]}) 01:07:46 executing program 3: r0 = io_uring_setup(0xc42, &(0x7f0000000080)) io_uring_setup(0x0, &(0x7f0000000100)={0x0, 0x2d53, 0x20, 0x3, 0x3f, 0x0, r0}) 01:07:46 executing program 2: socketpair(0x22, 0x0, 0x8800, &(0x7f0000000100)) 01:07:46 executing program 1: io_uring_setup(0xc42, &(0x7f0000000080)) io_uring_setup(0x7e05, 0x0) 01:07:46 executing program 4: socketpair(0x2c, 0x0, 0x1e5, &(0x7f0000000100)) 01:07:46 executing program 0: open$dir(&(0x7f0000000080)='.\x00', 0x0, 0x99) 01:07:46 executing program 3: r0 = io_uring_setup(0xc42, &(0x7f0000000080)) io_uring_setup(0x0, &(0x7f0000000100)={0x0, 0x2d53, 0x20, 0x3, 0x3f, 0x0, r0}) 01:07:46 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff, 0x40]}) 01:07:46 executing program 4: socketpair(0x2c, 0x0, 0x1e6, &(0x7f0000000100)) 01:07:46 executing program 1: io_uring_setup(0xc42, &(0x7f0000000080)) io_uring_setup(0x7e05, 0x0) 01:07:46 executing program 2: socketpair(0x22, 0x0, 0x8801, &(0x7f0000000100)) 01:07:46 executing program 0: open$dir(&(0x7f0000000080)='.\x00', 0x0, 0x99) 01:07:46 executing program 3: r0 = io_uring_setup(0xc42, &(0x7f0000000080)) io_uring_setup(0x0, &(0x7f0000000100)={0x0, 0x2d53, 0x20, 0x3, 0x3f, 0x0, r0}) 01:07:46 executing program 4: socketpair(0x2c, 0x0, 0x1e7, &(0x7f0000000100)) 01:07:46 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1, 0x7fff]}) 01:07:46 executing program 1: r0 = io_uring_setup(0xc42, &(0x7f0000000080)) io_uring_setup(0x7e05, &(0x7f0000000100)={0x0, 0x0, 0x20, 0x3, 0x3f, 0x0, r0}) 01:07:47 executing program 2: socketpair(0x22, 0x0, 0x8900, &(0x7f0000000100)) 01:07:47 executing program 3: io_uring_setup(0xc42, &(0x7f0000000080)) io_uring_setup(0x7e05, 0x0) 01:07:47 executing program 0: open$dir(&(0x7f0000000080)='.\x00', 0x0, 0x99) 01:07:47 executing program 4: socketpair(0x2c, 0x0, 0x1e8, &(0x7f0000000100)) 01:07:47 executing program 1: r0 = io_uring_setup(0xc42, &(0x7f0000000080)) io_uring_setup(0x7e05, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x3, 0x3f, 0x0, r0}) 01:07:47 executing program 2: socketpair(0x22, 0x0, 0x8901, &(0x7f0000000100)) 01:07:47 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1, 0x1]}) 01:07:47 executing program 0: open$dir(&(0x7f0000000080)='.\x00', 0x12146, 0x0) 01:07:47 executing program 3: io_uring_setup(0xc42, &(0x7f0000000080)) io_uring_setup(0x7e05, 0x0) 01:07:47 executing program 4: socketpair(0x2c, 0x0, 0x1e9, &(0x7f0000000100)) 01:07:47 executing program 1: r0 = io_uring_setup(0xc42, &(0x7f0000000080)) io_uring_setup(0x7e05, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x3, 0x3f, 0x0, r0}) 01:07:47 executing program 2: socketpair(0x22, 0x0, 0x8a00, &(0x7f0000000100)) 01:07:47 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9, 0x1]}) 01:07:47 executing program 0: socketpair(0x2c, 0x0, 0x1e8, &(0x7f0000000100)) 01:07:47 executing program 3: io_uring_setup(0xc42, &(0x7f0000000080)) io_uring_setup(0x7e05, 0x0) 01:07:47 executing program 4: socketpair(0x2c, 0x0, 0x1ea, &(0x7f0000000100)) 01:07:47 executing program 2: socketpair(0x22, 0x0, 0x8a01, &(0x7f0000000100)) 01:07:47 executing program 1: r0 = io_uring_setup(0xc42, &(0x7f0000000080)) io_uring_setup(0x7e05, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x3, 0x3f, 0x0, r0}) 01:07:47 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4, 0x9]}) 01:07:47 executing program 0: socketpair(0x2c, 0x0, 0x1e5, &(0x7f0000000100)) 01:07:47 executing program 3: r0 = io_uring_setup(0xc42, &(0x7f0000000080)) io_uring_setup(0x7e05, &(0x7f0000000100)={0x0, 0x0, 0x20, 0x3, 0x3f, 0x0, r0}) 01:07:47 executing program 1: r0 = io_uring_setup(0xc42, &(0x7f0000000080)) io_uring_setup(0x7e05, &(0x7f0000000100)={0x0, 0x0, 0x20, 0x0, 0x3f, 0x0, r0}) 01:07:47 executing program 2: socketpair(0x22, 0x0, 0x8b00, &(0x7f0000000100)) 01:07:47 executing program 4: socketpair(0x2c, 0x0, 0x1eb, &(0x7f0000000100)) 01:07:47 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80, 0x4]}) 01:07:47 executing program 3: r0 = io_uring_setup(0xc42, &(0x7f0000000080)) io_uring_setup(0x7e05, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x3, 0x3f, 0x0, r0}) 01:07:47 executing program 0: r0 = io_uring_setup(0xc42, &(0x7f0000000080)) io_uring_setup(0x7e05, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x3, 0x3f, 0x0, r0}) 01:07:47 executing program 4: socketpair(0x2c, 0x0, 0x1ec, &(0x7f0000000100)) 01:07:47 executing program 2: socketpair(0x22, 0x0, 0x8b01, &(0x7f0000000100)) 01:07:47 executing program 1: r0 = io_uring_setup(0xc42, &(0x7f0000000080)) io_uring_setup(0x7e05, &(0x7f0000000100)={0x0, 0x0, 0x20, 0x0, 0x0, 0x0, r0}) 01:07:47 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f, 0x80]}) 01:07:48 executing program 3: r0 = io_uring_setup(0xc42, &(0x7f0000000080)) io_uring_setup(0x7e05, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x3, 0x3f, 0x0, r0}) 01:07:48 executing program 0: r0 = io_uring_setup(0xc42, &(0x7f0000000080)) io_uring_setup(0x7e05, &(0x7f0000000100)={0x0, 0x0, 0x20, 0x0, 0x3f, 0x0, r0}) 01:07:48 executing program 4: socketpair(0x2c, 0x0, 0x1ed, &(0x7f0000000100)) 01:07:48 executing program 2: socketpair(0x22, 0x0, 0x8c00, &(0x7f0000000100)) 01:07:48 executing program 1: io_uring_setup(0xc42, &(0x7f0000000080)) io_uring_setup(0x7e05, &(0x7f0000000100)={0x0, 0x0, 0x20}) 01:07:48 executing program 3: r0 = io_uring_setup(0xc42, &(0x7f0000000080)) io_uring_setup(0x7e05, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x3, 0x3f, 0x0, r0}) 01:07:48 executing program 4: socketpair(0x2c, 0x0, 0x1ee, &(0x7f0000000100)) 01:07:48 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8, 0x7f]}) 01:07:48 executing program 0: r0 = io_uring_setup(0xc42, &(0x7f0000000080)) io_uring_setup(0x7e05, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x3, 0x3f, 0x0, r0}) 01:07:48 executing program 2: socketpair(0x22, 0x0, 0x8c01, &(0x7f0000000100)) 01:07:48 executing program 1: io_uring_setup(0xc42, &(0x7f0000000080)) io_uring_setup(0x7e05, &(0x7f0000000100)={0x0, 0x0, 0x20}) 01:07:48 executing program 4: socketpair(0x2c, 0x0, 0x1ef, &(0x7f0000000100)) 01:07:48 executing program 3: r0 = io_uring_setup(0xc42, &(0x7f0000000080)) io_uring_setup(0x7e05, &(0x7f0000000100)={0x0, 0x0, 0x20, 0x0, 0x3f, 0x0, r0}) 01:07:48 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2, 0x8]}) 01:07:48 executing program 0: r0 = io_uring_setup(0xc42, &(0x7f0000000080)) io_uring_setup(0x7e05, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x3, 0x3f, 0x0, r0}) 01:07:48 executing program 2: socketpair(0x22, 0x0, 0x8d00, &(0x7f0000000100)) 01:07:48 executing program 4: socketpair(0x2c, 0x0, 0x1f0, &(0x7f0000000100)) 01:07:48 executing program 1: io_uring_setup(0xc42, &(0x7f0000000080)) io_uring_setup(0x7e05, &(0x7f0000000100)={0x0, 0x0, 0x20}) 01:07:48 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3, 0x2]}) 01:07:48 executing program 3: r0 = io_uring_setup(0xc42, &(0x7f0000000080)) io_uring_setup(0x7e05, &(0x7f0000000100)={0x0, 0x0, 0x20, 0x0, 0x0, 0x0, r0}) 01:07:48 executing program 0: r0 = io_uring_setup(0xc42, &(0x7f0000000080)) io_uring_setup(0x0, &(0x7f0000000100)={0x0, 0x2d53, 0x20, 0x3, 0x3f, 0x0, r0}) 01:07:48 executing program 2: socketpair(0x22, 0x0, 0x8d01, &(0x7f0000000100)) 01:07:48 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2, 0x3]}) 01:07:48 executing program 4: socketpair(0x2c, 0x0, 0x1f1, &(0x7f0000000100)) 01:07:48 executing program 1: r0 = io_uring_setup(0xc42, &(0x7f0000000080)={0x0, 0x0, 0x1, 0x3, 0x4}) io_uring_setup(0x7e05, &(0x7f0000000100)={0x0, 0x2d53, 0x20, 0x3, 0x3f, 0x0, r0}) 01:07:48 executing program 3: io_uring_setup(0xc42, &(0x7f0000000080)) io_uring_setup(0x7e05, &(0x7f0000000100)={0x0, 0x0, 0x20}) 01:07:48 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x300, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) open$dir(&(0x7f0000000080)='.\x00', 0x12146, 0x99) 01:07:48 executing program 4: socketpair(0x2c, 0x0, 0x1f2, &(0x7f0000000100)) 01:07:48 executing program 2: socketpair(0x22, 0x0, 0x8e00, &(0x7f0000000100)) 01:07:48 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1, 0x0, 0x2]}) 01:07:49 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x300, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='mounts\x00') open$dir(&(0x7f0000000080)='.\x00', 0x12146, 0x99) 01:07:49 executing program 3: io_uring_setup(0xc42, &(0x7f0000000080)) io_uring_setup(0x7e05, &(0x7f0000000100)={0x0, 0x0, 0x20}) 01:07:49 executing program 4: socketpair(0x2c, 0x0, 0x1f3, &(0x7f0000000100)) 01:07:49 executing program 2: socketpair(0x22, 0x0, 0x8e01, &(0x7f0000000100)) 01:07:49 executing program 0: r0 = io_uring_setup(0xc42, &(0x7f0000000080)={0x0, 0x0, 0x1, 0x3, 0x4}) io_uring_setup(0x7e05, &(0x7f0000000100)={0x0, 0x2d53, 0x20, 0x3, 0x3f, 0x0, r0}) 01:07:49 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9, 0x1]}) 01:07:49 executing program 4: socketpair(0x2c, 0x0, 0x1f4, &(0x7f0000000100)) 01:07:49 executing program 3: io_uring_setup(0xc42, &(0x7f0000000080)) io_uring_setup(0x7e05, &(0x7f0000000100)={0x0, 0x0, 0x20}) 01:07:49 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76, 0x9]}) 01:07:49 executing program 2: socketpair(0x22, 0x0, 0x8f00, &(0x7f0000000100)) 01:07:49 executing program 1: socketpair(0x2c, 0x0, 0x1dc, &(0x7f0000000100)) 01:07:49 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x300, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='mounts\x00') r2 = open$dir(&(0x7f0000000080)='.\x00', 0x12146, 0x99) renameat2(r2, &(0x7f00000000c0)='./file0\x00', r1, &(0x7f0000000100)='./file0\x00', 0x1) 01:07:49 executing program 4: socketpair(0x2c, 0x0, 0x1f5, &(0x7f0000000100)) 01:07:49 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x300, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='mounts\x00') r2 = open$dir(&(0x7f0000000080)='.\x00', 0x12146, 0x99) renameat2(r2, &(0x7f00000000c0)='./file0\x00', r1, &(0x7f0000000100)='./file0\x00', 0x1) 01:07:49 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff, 0x76]}) 01:07:49 executing program 2: socketpair(0x22, 0x0, 0x8f01, &(0x7f0000000100)) 01:07:49 executing program 3: socketpair(0x22, 0x0, 0x87, &(0x7f0000000100)) 01:07:49 executing program 4: socketpair(0x2c, 0x0, 0x1f6, &(0x7f0000000100)) 01:07:49 executing program 0: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='mounts\x00') write$RDMA_USER_CM_CMD_DISCONNECT(r0, &(0x7f0000000040)={0xa, 0x4}, 0xc) 01:07:49 executing program 2: socketpair(0x22, 0x0, 0x9000, &(0x7f0000000100)) 01:07:49 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8, 0x0, 0xff]}) 01:07:49 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000180)=ANY=[], 0x69, 0x0, &(0x7f0000000040)="3941fd4846d9028dcf9cd4d5c8405ad16e2f9b97bc6bad0f7bb50ae41026c0829e62ddc04c45f4a897960d23ce4eae60639a98ec190ac5e216eaecff1b9b14d4fe7ecef6ed31363c1da83685b17e92b6be43eda5cc3ad61588d77a406e4e0b466b33fa8d4b7f78cd14"}) 01:07:49 executing program 1 (fault-call:1 fault-nth:0): r0 = io_uring_setup(0xc42, &(0x7f0000000080)) io_uring_setup(0x7e05, &(0x7f0000000100)={0x0, 0x0, 0x20, 0x0, 0x0, 0x0, r0}) 01:07:49 executing program 2: socketpair(0x22, 0x0, 0x9001, &(0x7f0000000100)) 01:07:49 executing program 4: socketpair(0x2c, 0x0, 0x1f7, &(0x7f0000000100)) 01:07:49 executing program 0 (fault-call:1 fault-nth:0): r0 = io_uring_setup(0xc42, &(0x7f0000000080)) io_uring_setup(0x7e05, &(0x7f0000000100)={0x0, 0x0, 0x20, 0x0, 0x0, 0x0, r0}) 01:07:49 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5, 0x8]}) [ 1468.811683][T18557] binder: 18555:18557 unknown command 0 [ 1468.820882][T18558] FAULT_INJECTION: forcing a failure. [ 1468.820882][T18558] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1468.837756][T18557] binder: 18555:18557 ioctl c0306201 20000100 returned -22 [ 1468.918625][T18558] CPU: 1 PID: 18558 Comm: syz-executor.1 Not tainted 5.12.0-rc5-syzkaller #0 [ 1468.920597][T18565] FAULT_INJECTION: forcing a failure. [ 1468.920597][T18565] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1468.927455][T18558] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1468.927477][T18558] Call Trace: [ 1468.927490][T18558] dump_stack+0x141/0x1d7 [ 1468.927538][T18558] should_fail.cold+0x5/0xa [ 1468.927576][T18558] _copy_from_user+0x2c/0x180 [ 1468.967425][T18558] io_uring_setup+0x91/0x2ae0 [ 1468.972222][T18558] ? __context_tracking_exit+0xb8/0xe0 [ 1468.977714][T18558] ? __do_sys_io_uring_enter+0x1e30/0x1e30 [ 1468.983576][T18558] ? syscall_enter_from_user_mode+0x27/0x70 [ 1468.989534][T18558] do_syscall_64+0x2d/0x70 [ 1468.993984][T18558] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 1468.999910][T18558] RIP: 0033:0x466459 [ 1469.003827][T18558] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1469.023586][T18558] RSP: 002b:00007fc46025b188 EFLAGS: 00000246 ORIG_RAX: 00000000000001a9 [ 1469.032034][T18558] RAX: ffffffffffffffda RBX: 000000000056bf60 RCX: 0000000000466459 [ 1469.040030][T18558] RDX: 0000000000000000 RSI: 0000000020000100 RDI: 0000000000007e05 [ 1469.048048][T18558] RBP: 00007fc46025b1d0 R08: 0000000000000000 R09: 0000000000000000 [ 1469.056052][T18558] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 01:07:50 executing program 2: socketpair(0x22, 0x0, 0x9100, &(0x7f0000000100)) [ 1469.064052][T18558] R13: 0000000000a9fb1f R14: 00007fc46025b300 R15: 0000000000022000 [ 1469.072467][T18565] CPU: 0 PID: 18565 Comm: syz-executor.0 Not tainted 5.12.0-rc5-syzkaller #0 [ 1469.081273][T18565] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1469.091345][T18565] Call Trace: [ 1469.094643][T18565] dump_stack+0x141/0x1d7 [ 1469.099007][T18565] should_fail.cold+0x5/0xa [ 1469.103541][T18565] _copy_from_user+0x2c/0x180 [ 1469.108259][T18565] io_uring_setup+0x91/0x2ae0 [ 1469.112970][T18565] ? __context_tracking_exit+0xb8/0xe0 [ 1469.118453][T18565] ? __do_sys_io_uring_enter+0x1e30/0x1e30 [ 1469.124304][T18565] ? syscall_enter_from_user_mode+0x27/0x70 [ 1469.130230][T18565] do_syscall_64+0x2d/0x70 [ 1469.134673][T18565] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 1469.140592][T18565] RIP: 0033:0x466459 [ 1469.144543][T18565] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 01:07:50 executing program 2: socketpair(0x22, 0x0, 0x9101, &(0x7f0000000100)) 01:07:50 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9, 0x5]}) 01:07:50 executing program 3 (fault-call:0 fault-nth:0): open$dir(&(0x7f0000000080)='.\x00', 0x12146, 0x0) 01:07:50 executing program 4: socketpair(0x2c, 0x0, 0x1f8, &(0x7f0000000100)) [ 1469.164181][T18565] RSP: 002b:00007f0e8dcbf188 EFLAGS: 00000246 ORIG_RAX: 00000000000001a9 [ 1469.172640][T18565] RAX: ffffffffffffffda RBX: 000000000056bf60 RCX: 0000000000466459 [ 1469.180639][T18565] RDX: 0000000000000000 RSI: 0000000020000100 RDI: 0000000000007e05 [ 1469.188723][T18565] RBP: 00007f0e8dcbf1d0 R08: 0000000000000000 R09: 0000000000000000 [ 1469.196722][T18565] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1469.204724][T18565] R13: 0000000000a9fb1f R14: 00007f0e8dcbf300 R15: 0000000000022000 01:07:50 executing program 2: socketpair(0x22, 0x0, 0x9200, &(0x7f0000000100)) 01:07:50 executing program 1 (fault-call:1 fault-nth:1): r0 = io_uring_setup(0xc42, &(0x7f0000000080)) io_uring_setup(0x7e05, &(0x7f0000000100)={0x0, 0x0, 0x20, 0x0, 0x0, 0x0, r0}) [ 1469.327648][T18577] FAULT_INJECTION: forcing a failure. [ 1469.327648][T18577] name failslab, interval 1, probability 0, space 0, times 0 [ 1469.363655][T18577] CPU: 0 PID: 18577 Comm: syz-executor.3 Not tainted 5.12.0-rc5-syzkaller #0 [ 1469.372489][T18577] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1469.382580][T18577] Call Trace: [ 1469.385890][T18577] dump_stack+0x141/0x1d7 [ 1469.390257][T18577] should_fail.cold+0x5/0xa [ 1469.394792][T18577] ? getname_flags.part.0+0x50/0x4f0 [ 1469.400113][T18577] ? getname_flags.part.0+0x50/0x4f0 [ 1469.405458][T18577] should_failslab+0x5/0x10 [ 1469.409995][T18577] kmem_cache_alloc+0x5e/0x370 [ 1469.414493][T18582] FAULT_INJECTION: forcing a failure. [ 1469.414493][T18582] name failslab, interval 1, probability 0, space 0, times 0 01:07:50 executing program 2: socketpair(0x22, 0x0, 0x9201, &(0x7f0000000100)) [ 1469.414813][T18577] getname_flags.part.0+0x50/0x4f0 [ 1469.432517][T18577] getname+0x8e/0xd0 [ 1469.436560][T18577] do_sys_openat2+0xf5/0x420 [ 1469.441192][T18577] ? build_open_flags+0x6f0/0x6f0 [ 1469.446246][T18577] ? __context_tracking_exit+0xb8/0xe0 [ 1469.451733][T18577] ? lock_downgrade+0x6e0/0x6e0 [ 1469.456625][T18577] __x64_sys_open+0x119/0x1c0 [ 1469.461327][T18577] ? do_sys_open+0x140/0x140 [ 1469.466034][T18577] ? syscall_enter_from_user_mode+0x27/0x70 [ 1469.472041][T18577] do_syscall_64+0x2d/0x70 [ 1469.476480][T18577] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 1469.482411][T18577] RIP: 0033:0x466459 [ 1469.486319][T18577] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1469.505952][T18577] RSP: 002b:00007fb3491f0188 EFLAGS: 00000246 ORIG_RAX: 0000000000000002 [ 1469.514400][T18577] RAX: ffffffffffffffda RBX: 000000000056bf60 RCX: 0000000000466459 [ 1469.522390][T18577] RDX: 0000000000000000 RSI: 0000000000012146 RDI: 0000000020000080 [ 1469.530376][T18577] RBP: 00007fb3491f01d0 R08: 0000000000000000 R09: 0000000000000000 [ 1469.538361][T18577] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1469.546351][T18577] R13: 0000000000a9fb1f R14: 00007fb3491f0300 R15: 0000000000022000 [ 1469.554365][T18582] CPU: 1 PID: 18582 Comm: syz-executor.1 Not tainted 5.12.0-rc5-syzkaller #0 [ 1469.563167][T18582] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1469.573252][T18582] Call Trace: [ 1469.576549][T18582] dump_stack+0x141/0x1d7 [ 1469.580908][T18582] should_fail.cold+0x5/0xa [ 1469.585438][T18582] ? io_uring_setup+0x27d/0x2ae0 [ 1469.590395][T18582] should_failslab+0x5/0x10 [ 1469.594921][T18582] kmem_cache_alloc_trace+0x55/0x2a0 [ 1469.600233][T18582] io_uring_setup+0x27d/0x2ae0 [ 1469.605028][T18582] ? __context_tracking_exit+0xb8/0xe0 [ 1469.610507][T18582] ? __do_sys_io_uring_enter+0x1e30/0x1e30 [ 1469.616354][T18582] ? syscall_enter_from_user_mode+0x27/0x70 [ 1469.622286][T18582] do_syscall_64+0x2d/0x70 [ 1469.626743][T18582] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 1469.632679][T18582] RIP: 0033:0x466459 [ 1469.636591][T18582] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1469.656222][T18582] RSP: 002b:00007fc46025b188 EFLAGS: 00000246 ORIG_RAX: 00000000000001a9 [ 1469.664694][T18582] RAX: ffffffffffffffda RBX: 000000000056bf60 RCX: 0000000000466459 01:07:50 executing program 4: socketpair(0x2c, 0x0, 0x1f9, &(0x7f0000000100)) 01:07:50 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6, 0x0, 0xc9]}) [ 1469.672690][T18582] RDX: 0000000000000000 RSI: 0000000020000100 RDI: 0000000000007e05 [ 1469.680713][T18582] RBP: 00007fc46025b1d0 R08: 0000000000000000 R09: 0000000000000000 [ 1469.688706][T18582] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1469.696714][T18582] R13: 0000000000a9fb1f R14: 00007fc46025b300 R15: 0000000000022000 01:07:50 executing program 0 (fault-call:1 fault-nth:1): r0 = io_uring_setup(0xc42, &(0x7f0000000080)) io_uring_setup(0x7e05, &(0x7f0000000100)={0x0, 0x0, 0x20, 0x0, 0x0, 0x0, r0}) 01:07:50 executing program 4: socketpair(0x2c, 0x0, 0x1fa, &(0x7f0000000100)) 01:07:50 executing program 1 (fault-call:1 fault-nth:2): r0 = io_uring_setup(0xc42, &(0x7f0000000080)) io_uring_setup(0x7e05, &(0x7f0000000100)={0x0, 0x0, 0x20, 0x0, 0x0, 0x0, r0}) 01:07:51 executing program 2: socketpair(0x22, 0x0, 0x9300, &(0x7f0000000100)) 01:07:51 executing program 3 (fault-call:0 fault-nth:1): open$dir(&(0x7f0000000080)='.\x00', 0x12146, 0x0) 01:07:51 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff, 0x6]}) [ 1469.926135][T18594] FAULT_INJECTION: forcing a failure. [ 1469.926135][T18594] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 1469.938862][T18596] FAULT_INJECTION: forcing a failure. [ 1469.938862][T18596] name failslab, interval 1, probability 0, space 0, times 0 [ 1469.963900][T18596] CPU: 0 PID: 18596 Comm: syz-executor.0 Not tainted 5.12.0-rc5-syzkaller #0 [ 1469.972823][T18596] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1469.982911][T18596] Call Trace: [ 1469.986211][T18596] dump_stack+0x141/0x1d7 [ 1469.990619][T18596] should_fail.cold+0x5/0xa [ 1469.995164][T18596] ? io_uring_setup+0x27d/0x2ae0 [ 1470.000146][T18596] should_failslab+0x5/0x10 [ 1470.004685][T18596] kmem_cache_alloc_trace+0x55/0x2a0 [ 1470.010012][T18596] io_uring_setup+0x27d/0x2ae0 [ 1470.014819][T18596] ? __context_tracking_exit+0xb8/0xe0 [ 1470.020310][T18596] ? __do_sys_io_uring_enter+0x1e30/0x1e30 [ 1470.026168][T18596] ? syscall_enter_from_user_mode+0x27/0x70 [ 1470.032098][T18596] do_syscall_64+0x2d/0x70 [ 1470.037068][T18596] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 1470.042996][T18596] RIP: 0033:0x466459 [ 1470.046909][T18596] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1470.066551][T18596] RSP: 002b:00007f0e8dcbf188 EFLAGS: 00000246 ORIG_RAX: 00000000000001a9 [ 1470.074998][T18596] RAX: ffffffffffffffda RBX: 000000000056bf60 RCX: 0000000000466459 [ 1470.082996][T18596] RDX: 0000000000000000 RSI: 0000000020000100 RDI: 0000000000007e05 [ 1470.090984][T18596] RBP: 00007f0e8dcbf1d0 R08: 0000000000000000 R09: 0000000000000000 [ 1470.098973][T18596] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1470.106971][T18596] R13: 0000000000a9fb1f R14: 00007f0e8dcbf300 R15: 0000000000022000 [ 1470.114984][T18594] CPU: 1 PID: 18594 Comm: syz-executor.1 Not tainted 5.12.0-rc5-syzkaller #0 [ 1470.123782][T18594] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1470.133866][T18594] Call Trace: [ 1470.137169][T18594] dump_stack+0x141/0x1d7 [ 1470.141533][T18594] should_fail.cold+0x5/0xa [ 1470.146065][T18594] __alloc_pages_nodemask+0x189/0x730 [ 1470.151461][T18594] ? __alloc_pages_slowpath.constprop.0+0x2270/0x2270 [ 1470.158249][T18594] ? ___slab_alloc+0x147/0x7a0 [ 1470.163036][T18594] ? find_held_lock+0x2d/0x110 [ 1470.167828][T18594] ? fs_reclaim_release+0x9c/0xe0 [ 1470.172885][T18594] alloc_pages_current+0x18c/0x2a0 [ 1470.178026][T18594] kmalloc_order+0x34/0xf0 [ 1470.182468][T18594] kmalloc_order_trace+0x14/0x130 [ 1470.187520][T18594] io_uring_setup+0x37e/0x2ae0 [ 1470.192319][T18594] ? __context_tracking_exit+0xb8/0xe0 [ 1470.197821][T18594] ? __do_sys_io_uring_enter+0x1e30/0x1e30 [ 1470.203702][T18594] ? syscall_enter_from_user_mode+0x27/0x70 [ 1470.209655][T18594] do_syscall_64+0x2d/0x70 [ 1470.214109][T18594] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 1470.220038][T18594] RIP: 0033:0x466459 [ 1470.223953][T18594] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1470.243586][T18594] RSP: 002b:00007fc46025b188 EFLAGS: 00000246 ORIG_RAX: 00000000000001a9 [ 1470.252031][T18594] RAX: ffffffffffffffda RBX: 000000000056bf60 RCX: 0000000000466459 [ 1470.260031][T18594] RDX: 0000000000000000 RSI: 0000000020000100 RDI: 0000000000007e05 [ 1470.268028][T18594] RBP: 00007fc46025b1d0 R08: 0000000000000000 R09: 0000000000000000 01:07:51 executing program 2: socketpair(0x22, 0x0, 0x9301, &(0x7f0000000100)) 01:07:51 executing program 4: socketpair(0x2c, 0x0, 0x1fb, &(0x7f0000000100)) [ 1470.276024][T18594] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1470.284017][T18594] R13: 0000000000a9fb1f R14: 00007fc46025b300 R15: 0000000000022000 [ 1470.352259][T18605] FAULT_INJECTION: forcing a failure. [ 1470.352259][T18605] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1470.391568][T18605] CPU: 1 PID: 18605 Comm: syz-executor.3 Not tainted 5.12.0-rc5-syzkaller #0 [ 1470.400485][T18605] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1470.410568][T18605] Call Trace: [ 1470.413909][T18605] dump_stack+0x141/0x1d7 [ 1470.418285][T18605] should_fail.cold+0x5/0xa [ 1470.422836][T18605] strncpy_from_user+0x34/0x3e0 [ 1470.427731][T18605] getname_flags.part.0+0x95/0x4f0 [ 1470.432883][T18605] getname+0x8e/0xd0 [ 1470.436805][T18605] do_sys_openat2+0xf5/0x420 [ 1470.441432][T18605] ? build_open_flags+0x6f0/0x6f0 [ 1470.446500][T18605] ? __context_tracking_exit+0xb8/0xe0 [ 1470.452002][T18605] ? lock_downgrade+0x6e0/0x6e0 [ 1470.456901][T18605] __x64_sys_open+0x119/0x1c0 [ 1470.461622][T18605] ? do_sys_open+0x140/0x140 [ 1470.466268][T18605] ? syscall_enter_from_user_mode+0x27/0x70 [ 1470.472222][T18605] do_syscall_64+0x2d/0x70 [ 1470.476689][T18605] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 1470.482617][T18605] RIP: 0033:0x466459 [ 1470.486535][T18605] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1470.506170][T18605] RSP: 002b:00007fb3491f0188 EFLAGS: 00000246 ORIG_RAX: 0000000000000002 [ 1470.514619][T18605] RAX: ffffffffffffffda RBX: 000000000056bf60 RCX: 0000000000466459 [ 1470.522618][T18605] RDX: 0000000000000000 RSI: 0000000000012146 RDI: 0000000020000080 [ 1470.530610][T18605] RBP: 00007fb3491f01d0 R08: 0000000000000000 R09: 0000000000000000 [ 1470.538606][T18605] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 01:07:51 executing program 4: socketpair(0x2c, 0x0, 0x1fc, &(0x7f0000000100)) 01:07:51 executing program 2: socketpair(0x22, 0x0, 0x9400, &(0x7f0000000100)) 01:07:51 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4, 0xff]}) [ 1470.546613][T18605] R13: 0000000000a9fb1f R14: 00007fb3491f0300 R15: 0000000000022000 01:07:51 executing program 2: socketpair(0x22, 0x0, 0x9401, &(0x7f0000000100)) 01:07:51 executing program 0 (fault-call:1 fault-nth:2): r0 = io_uring_setup(0xc42, &(0x7f0000000080)) io_uring_setup(0x7e05, &(0x7f0000000100)={0x0, 0x0, 0x20, 0x0, 0x0, 0x0, r0}) 01:07:51 executing program 3 (fault-call:0 fault-nth:2): open$dir(&(0x7f0000000080)='.\x00', 0x12146, 0x0) 01:07:51 executing program 1 (fault-call:1 fault-nth:3): r0 = io_uring_setup(0xc42, &(0x7f0000000080)) io_uring_setup(0x7e05, &(0x7f0000000100)={0x0, 0x0, 0x20, 0x0, 0x0, 0x0, r0}) 01:07:51 executing program 2: socketpair(0x22, 0x0, 0x9500, &(0x7f0000000100)) 01:07:51 executing program 4: socketpair(0x2c, 0x0, 0x1fd, &(0x7f0000000100)) 01:07:51 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1, 0x4]}) [ 1470.765624][T18617] FAULT_INJECTION: forcing a failure. [ 1470.765624][T18617] name failslab, interval 1, probability 0, space 0, times 0 [ 1470.817111][T18625] FAULT_INJECTION: forcing a failure. [ 1470.817111][T18625] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 1470.827104][T18623] FAULT_INJECTION: forcing a failure. [ 1470.827104][T18623] name failslab, interval 1, probability 0, space 0, times 0 [ 1470.845078][T18617] CPU: 1 PID: 18617 Comm: syz-executor.3 Not tainted 5.12.0-rc5-syzkaller #0 [ 1470.853891][T18617] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1470.864170][T18617] Call Trace: [ 1470.867474][T18617] dump_stack+0x141/0x1d7 [ 1470.871847][T18617] should_fail.cold+0x5/0xa [ 1470.876379][T18617] ? __alloc_file+0x21/0x280 [ 1470.881009][T18617] ? __alloc_file+0x21/0x280 [ 1470.885643][T18617] should_failslab+0x5/0x10 [ 1470.890285][T18617] kmem_cache_alloc+0x5e/0x370 [ 1470.895078][T18617] ? stack_trace_save+0x8c/0xc0 [ 1470.899989][T18617] __alloc_file+0x21/0x280 [ 1470.904440][T18617] alloc_empty_file+0x6d/0x170 [ 1470.909236][T18617] path_openat+0xe3/0x27e0 01:07:52 executing program 2: socketpair(0x22, 0x0, 0x9501, &(0x7f0000000100)) [ 1470.913683][T18617] ? __lock_acquire+0x16b3/0x54c0 [ 1470.918755][T18617] ? path_lookupat+0x830/0x830 [ 1470.923568][T18617] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 1470.929604][T18617] do_filp_open+0x17e/0x3c0 [ 1470.934155][T18617] ? may_open_dev+0xf0/0xf0 [ 1470.938698][T18617] ? alloc_fd+0x2bc/0x640 [ 1470.943065][T18617] ? lock_downgrade+0x6e0/0x6e0 [ 1470.947956][T18617] ? do_raw_spin_lock+0x120/0x2b0 [ 1470.953019][T18617] ? rwlock_bug.part.0+0x90/0x90 [ 1470.958042][T18617] ? __sanitizer_cov_trace_const_cmp8+0x1d/0x70 [ 1470.964316][T18617] ? _raw_spin_unlock+0x24/0x40 [ 1470.969706][T18617] ? alloc_fd+0x2bc/0x640 [ 1470.974062][T18617] do_sys_openat2+0x16d/0x420 [ 1470.978771][T18617] ? build_open_flags+0x6f0/0x6f0 [ 1470.983830][T18617] ? __context_tracking_exit+0xb8/0xe0 [ 1470.989324][T18617] ? lock_downgrade+0x6e0/0x6e0 [ 1470.994201][T18617] __x64_sys_open+0x119/0x1c0 [ 1470.998895][T18617] ? do_sys_open+0x140/0x140 [ 1471.003509][T18617] ? syscall_enter_from_user_mode+0x27/0x70 [ 1471.009439][T18617] do_syscall_64+0x2d/0x70 [ 1471.013895][T18617] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 1471.019806][T18617] RIP: 0033:0x466459 [ 1471.023719][T18617] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1471.043433][T18617] RSP: 002b:00007fb3491f0188 EFLAGS: 00000246 ORIG_RAX: 0000000000000002 [ 1471.052033][T18617] RAX: ffffffffffffffda RBX: 000000000056bf60 RCX: 0000000000466459 [ 1471.060024][T18617] RDX: 0000000000000000 RSI: 0000000000012146 RDI: 0000000020000080 [ 1471.068012][T18617] RBP: 00007fb3491f01d0 R08: 0000000000000000 R09: 0000000000000000 [ 1471.076006][T18617] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1471.084010][T18617] R13: 0000000000a9fb1f R14: 00007fb3491f0300 R15: 0000000000022000 [ 1471.099594][T18625] CPU: 1 PID: 18625 Comm: syz-executor.0 Not tainted 5.12.0-rc5-syzkaller #0 [ 1471.108418][T18625] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1471.118500][T18625] Call Trace: [ 1471.121797][T18625] dump_stack+0x141/0x1d7 [ 1471.126168][T18625] should_fail.cold+0x5/0xa [ 1471.130718][T18625] __alloc_pages_nodemask+0x189/0x730 [ 1471.136111][T18625] ? __alloc_pages_slowpath.constprop.0+0x2270/0x2270 [ 1471.142892][T18625] ? ___slab_alloc+0x147/0x7a0 [ 1471.147690][T18625] ? find_held_lock+0x2d/0x110 [ 1471.155339][T18625] ? exc_int3+0xb/0x80 [ 1471.159443][T18625] alloc_pages_current+0x18c/0x2a0 [ 1471.164578][T18625] kmalloc_order+0x34/0xf0 [ 1471.169018][T18625] kmalloc_order_trace+0x14/0x130 [ 1471.174068][T18625] io_uring_setup+0x37e/0x2ae0 [ 1471.178864][T18625] ? __context_tracking_exit+0xb8/0xe0 [ 1471.184349][T18625] ? __do_sys_io_uring_enter+0x1e30/0x1e30 [ 1471.190217][T18625] ? syscall_enter_from_user_mode+0x27/0x70 [ 1471.196144][T18625] do_syscall_64+0x2d/0x70 [ 1471.200603][T18625] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 1471.206530][T18625] RIP: 0033:0x466459 [ 1471.210465][T18625] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1471.230096][T18625] RSP: 002b:00007f0e8dcbf188 EFLAGS: 00000246 ORIG_RAX: 00000000000001a9 [ 1471.239637][T18625] RAX: ffffffffffffffda RBX: 000000000056bf60 RCX: 0000000000466459 [ 1471.247636][T18625] RDX: 0000000000000000 RSI: 0000000020000100 RDI: 0000000000007e05 [ 1471.257296][T18625] RBP: 00007f0e8dcbf1d0 R08: 0000000000000000 R09: 0000000000000000 [ 1471.265291][T18625] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1471.273309][T18625] R13: 0000000000a9fb1f R14: 00007f0e8dcbf300 R15: 0000000000022000 [ 1471.303787][T18623] CPU: 0 PID: 18623 Comm: syz-executor.1 Not tainted 5.12.0-rc5-syzkaller #0 [ 1471.312607][T18623] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1471.322699][T18623] Call Trace: [ 1471.326005][T18623] dump_stack+0x141/0x1d7 [ 1471.330391][T18623] should_fail.cold+0x5/0xa [ 1471.334940][T18623] ? percpu_ref_init+0xcc/0x3a0 [ 1471.339828][T18623] should_failslab+0x5/0x10 [ 1471.344414][T18623] kmem_cache_alloc_trace+0x55/0x2a0 [ 1471.350348][T18623] ? io_uring_fasync+0x60/0x60 [ 1471.355148][T18623] percpu_ref_init+0xcc/0x3a0 [ 1471.359878][T18623] ? rcu_read_lock_sched_held+0x3a/0x70 [ 1471.365456][T18623] io_uring_setup+0x42d/0x2ae0 [ 1471.370257][T18623] ? __context_tracking_exit+0xb8/0xe0 [ 1471.375753][T18623] ? __do_sys_io_uring_enter+0x1e30/0x1e30 [ 1471.381619][T18623] ? syscall_enter_from_user_mode+0x27/0x70 [ 1471.387553][T18623] do_syscall_64+0x2d/0x70 [ 1471.392012][T18623] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 1471.397957][T18623] RIP: 0033:0x466459 01:07:52 executing program 2: socketpair(0x22, 0x0, 0x9600, &(0x7f0000000100)) 01:07:52 executing program 3 (fault-call:0 fault-nth:3): open$dir(&(0x7f0000000080)='.\x00', 0x12146, 0x0) [ 1471.401873][T18623] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1471.421506][T18623] RSP: 002b:00007fc46025b188 EFLAGS: 00000246 ORIG_RAX: 00000000000001a9 [ 1471.430065][T18623] RAX: ffffffffffffffda RBX: 000000000056bf60 RCX: 0000000000466459 [ 1471.438063][T18623] RDX: 0000000000000000 RSI: 0000000020000100 RDI: 0000000000007e05 [ 1471.446067][T18623] RBP: 00007fc46025b1d0 R08: 0000000000000000 R09: 0000000000000000 [ 1471.454066][T18623] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1471.462063][T18623] R13: 0000000000a9fb1f R14: 00007fc46025b300 R15: 0000000000022000 01:07:52 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2, 0x0, 0x1]}) 01:07:52 executing program 2: socketpair(0x22, 0x0, 0x9601, &(0x7f0000000100)) 01:07:52 executing program 4: socketpair(0x2c, 0x0, 0x1fe, &(0x7f0000000100)) 01:07:52 executing program 0 (fault-call:1 fault-nth:3): r0 = io_uring_setup(0xc42, &(0x7f0000000080)) io_uring_setup(0x7e05, &(0x7f0000000100)={0x0, 0x0, 0x20, 0x0, 0x0, 0x0, r0}) [ 1471.568894][T18635] FAULT_INJECTION: forcing a failure. [ 1471.568894][T18635] name failslab, interval 1, probability 0, space 0, times 0 [ 1471.641066][T18635] CPU: 0 PID: 18635 Comm: syz-executor.3 Not tainted 5.12.0-rc5-syzkaller #0 [ 1471.649911][T18635] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1471.660002][T18635] Call Trace: [ 1471.663311][T18635] dump_stack+0x141/0x1d7 [ 1471.667690][T18635] should_fail.cold+0x5/0xa [ 1471.673020][T18635] ? security_file_alloc+0x34/0x170 [ 1471.678271][T18635] ? security_file_alloc+0x34/0x170 [ 1471.683529][T18635] should_failslab+0x5/0x10 [ 1471.688070][T18635] kmem_cache_alloc+0x5e/0x370 [ 1471.692873][T18635] security_file_alloc+0x34/0x170 [ 1471.697945][T18635] __alloc_file+0xd8/0x280 [ 1471.702405][T18635] alloc_empty_file+0x6d/0x170 [ 1471.707223][T18635] path_openat+0xe3/0x27e0 [ 1471.711693][T18635] ? __lock_acquire+0x16b3/0x54c0 [ 1471.716773][T18635] ? path_lookupat+0x830/0x830 [ 1471.721575][T18635] ? mark_lock+0xef/0x17b0 [ 1471.726033][T18635] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 1471.728546][T18644] FAULT_INJECTION: forcing a failure. [ 1471.728546][T18644] name failslab, interval 1, probability 0, space 0, times 0 [ 1471.732060][T18635] do_filp_open+0x17e/0x3c0 [ 1471.732099][T18635] ? may_open_dev+0xf0/0xf0 [ 1471.732133][T18635] ? alloc_fd+0x2bc/0x640 [ 1471.732167][T18635] ? lock_downgrade+0x6e0/0x6e0 [ 1471.732200][T18635] ? do_raw_spin_lock+0x120/0x2b0 [ 1471.768008][T18635] ? rwlock_bug.part.0+0x90/0x90 [ 1471.772986][T18635] ? __sanitizer_cov_trace_const_cmp8+0x1d/0x70 [ 1471.779278][T18635] ? _raw_spin_unlock+0x24/0x40 [ 1471.784168][T18635] ? alloc_fd+0x2bc/0x640 [ 1471.788541][T18635] do_sys_openat2+0x16d/0x420 [ 1471.793256][T18635] ? build_open_flags+0x6f0/0x6f0 [ 1471.798323][T18635] ? __context_tracking_exit+0xb8/0xe0 [ 1471.803812][T18635] ? lock_downgrade+0x6e0/0x6e0 [ 1471.808702][T18635] __x64_sys_open+0x119/0x1c0 [ 1471.813412][T18635] ? do_sys_open+0x140/0x140 [ 1471.818033][T18635] ? syscall_enter_from_user_mode+0x27/0x70 [ 1471.823956][T18635] do_syscall_64+0x2d/0x70 [ 1471.828405][T18635] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 1471.834332][T18635] RIP: 0033:0x466459 [ 1471.838272][T18635] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1471.857906][T18635] RSP: 002b:00007fb3491f0188 EFLAGS: 00000246 ORIG_RAX: 0000000000000002 [ 1471.866352][T18635] RAX: ffffffffffffffda RBX: 000000000056bf60 RCX: 0000000000466459 [ 1471.874354][T18635] RDX: 0000000000000000 RSI: 0000000000012146 RDI: 0000000020000080 [ 1471.882355][T18635] RBP: 00007fb3491f01d0 R08: 0000000000000000 R09: 0000000000000000 [ 1471.890351][T18635] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1471.898346][T18635] R13: 0000000000a9fb1f R14: 00007fb3491f0300 R15: 0000000000022000 [ 1471.906375][T18644] CPU: 1 PID: 18644 Comm: syz-executor.0 Not tainted 5.12.0-rc5-syzkaller #0 [ 1471.915186][T18644] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1471.925288][T18644] Call Trace: [ 1471.928592][T18644] dump_stack+0x141/0x1d7 [ 1471.932967][T18644] should_fail.cold+0x5/0xa [ 1471.937523][T18644] ? percpu_ref_init+0xcc/0x3a0 [ 1471.942398][T18644] should_failslab+0x5/0x10 [ 1471.946929][T18644] kmem_cache_alloc_trace+0x55/0x2a0 [ 1471.952239][T18644] ? io_uring_fasync+0x60/0x60 [ 1471.957027][T18644] percpu_ref_init+0xcc/0x3a0 [ 1471.961723][T18644] ? rcu_read_lock_sched_held+0x3a/0x70 [ 1471.967309][T18644] io_uring_setup+0x42d/0x2ae0 [ 1471.972106][T18644] ? __context_tracking_exit+0xb8/0xe0 [ 1471.977601][T18644] ? __do_sys_io_uring_enter+0x1e30/0x1e30 [ 1471.983453][T18644] ? syscall_enter_from_user_mode+0x27/0x70 [ 1471.989377][T18644] do_syscall_64+0x2d/0x70 [ 1471.993835][T18644] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 1471.999757][T18644] RIP: 0033:0x466459 [ 1472.003673][T18644] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1472.023319][T18644] RSP: 002b:00007f0e8dc9e188 EFLAGS: 00000246 ORIG_RAX: 00000000000001a9 [ 1472.031767][T18644] RAX: ffffffffffffffda RBX: 000000000056c008 RCX: 0000000000466459 01:07:53 executing program 1: r0 = io_uring_setup(0xc42, &(0x7f0000000080)) io_uring_setup(0x7e05, &(0x7f0000000100)={0x0, 0x0, 0x20, 0x0, 0x0, 0x0, r0}) 01:07:53 executing program 4: socketpair(0x2c, 0x0, 0x201, &(0x7f0000000100)) [ 1472.039764][T18644] RDX: 0000000000000000 RSI: 0000000020000100 RDI: 0000000000007e05 [ 1472.047766][T18644] RBP: 00007f0e8dc9e1d0 R08: 0000000000000000 R09: 0000000000000000 [ 1472.055783][T18644] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1472.063793][T18644] R13: 0000000000a9fb1f R14: 00007f0e8dc9e300 R15: 0000000000022000 01:07:53 executing program 0 (fault-call:1 fault-nth:4): r0 = io_uring_setup(0xc42, &(0x7f0000000080)) io_uring_setup(0x7e05, &(0x7f0000000100)={0x0, 0x0, 0x20, 0x0, 0x0, 0x0, r0}) 01:07:53 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100, 0xa9f2]}) 01:07:53 executing program 2: socketpair(0x22, 0x0, 0x9700, &(0x7f0000000100)) 01:07:53 executing program 1: r0 = io_uring_setup(0xc42, &(0x7f0000000080)) io_uring_setup(0x8, &(0x7f0000000100)={0x0, 0x0, 0x20, 0x0, 0x0, 0x0, r0}) 01:07:53 executing program 3 (fault-call:0 fault-nth:4): open$dir(&(0x7f0000000080)='.\x00', 0x12146, 0x0) 01:07:53 executing program 4: socketpair(0x2c, 0x0, 0x300, &(0x7f0000000100)) 01:07:53 executing program 1: r0 = io_uring_setup(0xc42, &(0x7f0000000080)) io_uring_setup(0x7e14, &(0x7f0000000100)={0x0, 0x0, 0x20, 0x0, 0x0, 0x0, r0}) [ 1472.273765][T18652] FAULT_INJECTION: forcing a failure. [ 1472.273765][T18652] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 1472.315034][T18663] FAULT_INJECTION: forcing a failure. [ 1472.315034][T18663] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1472.329504][T18652] CPU: 0 PID: 18652 Comm: syz-executor.0 Not tainted 5.12.0-rc5-syzkaller #0 [ 1472.338325][T18652] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1472.348436][T18652] Call Trace: [ 1472.351738][T18652] dump_stack+0x141/0x1d7 [ 1472.356126][T18652] should_fail.cold+0x5/0xa [ 1472.360672][T18652] __alloc_pages_nodemask+0x189/0x730 [ 1472.366083][T18652] ? __debug_object_init+0x409/0xd10 [ 1472.371494][T18652] ? __alloc_pages_slowpath.constprop.0+0x2270/0x2270 [ 1472.378296][T18652] ? debug_object_destroy+0x210/0x210 [ 1472.383711][T18652] ? __sanitizer_cov_trace_cmp4+0x1c/0x70 [ 1472.389562][T18652] ? cap_capable+0x1f1/0x280 [ 1472.394195][T18652] alloc_pages_current+0x18c/0x2a0 [ 1472.399342][T18652] __get_free_pages+0x8/0x40 [ 1472.403963][T18652] io_uring_setup+0xd34/0x2ae0 [ 1472.408771][T18652] ? __context_tracking_exit+0xb8/0xe0 [ 1472.414262][T18652] ? __do_sys_io_uring_enter+0x1e30/0x1e30 [ 1472.420141][T18652] ? syscall_enter_from_user_mode+0x27/0x70 [ 1472.426084][T18652] do_syscall_64+0x2d/0x70 [ 1472.430549][T18652] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 1472.436471][T18652] RIP: 0033:0x466459 [ 1472.440387][T18652] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 01:07:53 executing program 1: r0 = io_uring_setup(0xc42, &(0x7f0000000080)) io_uring_setup(0x7e05, &(0x7f0000000100)={0x0, 0x0, 0x20, 0x0, 0x0, 0x0, r0}) 01:07:53 executing program 4: socketpair(0x2c, 0x0, 0x301, &(0x7f0000000100)) [ 1472.460031][T18652] RSP: 002b:00007f0e8dcbf188 EFLAGS: 00000246 ORIG_RAX: 00000000000001a9 [ 1472.468482][T18652] RAX: ffffffffffffffda RBX: 000000000056bf60 RCX: 0000000000466459 [ 1472.476478][T18652] RDX: 0000000000000000 RSI: 0000000020000100 RDI: 0000000000007e05 [ 1472.484502][T18652] RBP: 00007f0e8dcbf1d0 R08: 0000000000000000 R09: 0000000000000000 [ 1472.492498][T18652] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1472.500488][T18652] R13: 0000000000a9fb1f R14: 00007f0e8dcbf300 R15: 0000000000022000 [ 1472.546269][T18663] CPU: 1 PID: 18663 Comm: syz-executor.3 Not tainted 5.12.0-rc5-syzkaller #0 [ 1472.555094][T18663] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1472.565175][T18663] Call Trace: [ 1472.570859][T18663] dump_stack+0x141/0x1d7 [ 1472.575681][T18663] should_fail.cold+0x5/0xa [ 1472.580235][T18663] _copy_to_user+0x2c/0x150 [ 1472.585086][T18663] simple_read_from_buffer+0xcc/0x160 [ 1472.590513][T18663] proc_fail_nth_read+0x187/0x220 [ 1472.595606][T18663] ? proc_exe_link+0x1d0/0x1d0 [ 1472.600406][T18663] ? security_file_permission+0x248/0x560 [ 1472.606162][T18663] ? proc_exe_link+0x1d0/0x1d0 [ 1472.610955][T18663] vfs_read+0x1b5/0x570 [ 1472.612351][T18652] general protection fault, probably for non-canonical address 0xdffffc0000000018: 0000 [#1] PREEMPT SMP KASAN [ 1472.615138][T18663] ksys_read+0x12d/0x250 [ 1472.626967][T18652] KASAN: null-ptr-deref in range [0x00000000000000c0-0x00000000000000c7] [ 1472.631301][T18663] ? vfs_write+0xa30/0xa30 [ 1472.639687][T18652] CPU: 0 PID: 18652 Comm: syz-executor.0 Not tainted 5.12.0-rc5-syzkaller #0 [ 1472.644086][T18663] ? syscall_enter_from_user_mode+0x27/0x70 [ 1472.652832][T18652] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1472.658712][T18663] do_syscall_64+0x2d/0x70 [ 1472.668841][T18652] RIP: 0010:io_commit_cqring+0x37f/0xc10 [ 1472.673337][T18663] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 1472.679210][T18652] Code: 74 08 3c 03 0f 8e fa 05 00 00 48 8d bb c0 00 00 00 41 8b ac 24 00 06 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f> b6 14 02 48 89 f8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 b7 [ 1472.685110][T18663] RIP: 0033:0x4191dc [ 1472.704715][T18652] RSP: 0018:ffffc9000b327c78 EFLAGS: 00010006 [ 1472.708611][T18663] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 fc ff ff 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 2f fd ff ff 48 [ 1472.714709][T18652] RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffc90002151000 [ 1472.735593][T18663] RSP: 002b:00007fb3491f0170 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1472.743592][T18652] RDX: 0000000000000018 RSI: ffffffff81db8861 RDI: 00000000000000c0 [ 1472.743617][T18652] RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000003 [ 1472.752026][T18663] RAX: ffffffffffffffda RBX: ffffffffffffffff RCX: 00000000004191dc [ 1472.759993][T18652] R10: fffff52001664f8f R11: 0000000000000000 R12: ffff88803d2fe000 [ 1472.767954][T18663] RDX: 000000000000000f RSI: 00007fb3491f01e0 RDI: 0000000000000003 [ 1472.775914][T18652] R13: 0000000000000000 R14: 1ffff92001664fab R15: ffff88803d2fe0c0 [ 1472.783876][T18663] RBP: 00007fb3491f01d0 R08: 0000000000000000 R09: 0000000000000000 [ 1472.791834][T18652] FS: 00007f0e8dcbf700(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000 [ 1472.799792][T18663] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1472.807748][T18652] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1472.816658][T18663] R13: 0000000000a9fb1f R14: 00007fb3491f0300 R15: 0000000000022000 [ 1472.824618][T18652] CR2: 0000000000970004 CR3: 0000000012e8e000 CR4: 00000000001506f0 01:07:53 executing program 1: r0 = io_uring_setup(0xc42, &(0x7f0000000080)) io_uring_setup(0x7e05, &(0x7f0000000100)={0x0, 0x2, 0x20, 0x0, 0x0, 0x0, r0}) 01:07:53 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000000c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x4, 0x69, 0x1, 0x10000, 0x4, 0x153d, 0x0, 0x7ff, 0x5, 0x8, 0x80000000, 0x80000000, 0x4, 0x7, 0x1, 0x8, 0xfff, 0x6, 0xfff, 0x7ff, 0x5, 0x40, 0x6, 0x3, 0xbc7, 0x5ae27022, 0x9, 0x7, 0xbbd, 0x7, 0x8, 0xf352, 0x100]}) 01:07:53 executing program 2: socketpair(0x22, 0x0, 0x9701, &(0x7f0000000100)) [ 1472.847123][T18652] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 1472.855133][T18652] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 1472.863123][T18652] Call Trace: [ 1472.866418][T18652] io_kill_timeouts+0x2b5/0x320 [ 1472.871292][T18652] io_ring_ctx_wait_and_kill+0x1da/0x400 [ 1472.876950][T18652] ? io_iopoll_try_reap_events.part.0+0x220/0x220 [ 1472.883388][T18652] ? alloc_pages_current+0x194/0x2a0 [ 1472.888698][T18652] io_uring_setup+0x10da/0x2ae0 [ 1472.893571][T18652] ? __context_tracking_exit+0xb8/0xe0 [ 1472.899055][T18652] ? __do_sys_io_uring_enter+0x1e30/0x1e30 [ 1472.904896][T18652] ? syscall_enter_from_user_mode+0x27/0x70 [ 1472.916025][T18652] do_syscall_64+0x2d/0x70 [ 1472.920468][T18652] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 1472.926379][T18652] RIP: 0033:0x466459 [ 1472.930282][T18652] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1472.949907][T18652] RSP: 002b:00007f0e8dcbf188 EFLAGS: 00000246 ORIG_RAX: 00000000000001a9 [ 1472.958345][T18652] RAX: ffffffffffffffda RBX: 000000000056bf60 RCX: 0000000000466459 [ 1472.966360][T18652] RDX: 0000000000000000 RSI: 0000000020000100 RDI: 0000000000007e05 [ 1472.975622][T18652] RBP: 00007f0e8dcbf1d0 R08: 0000000000000000 R09: 0000000000000000 [ 1472.983618][T18652] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1472.991602][T18652] R13: 0000000000a9fb1f R14: 00007f0e8dcbf300 R15: 0000000000022000 [ 1472.999599][T18652] Modules linked in: [ 1473.003511][T18652] ---[ end trace 75cbf326a6fdeb37 ]--- [ 1473.008969][T18652] RIP: 0010:io_commit_cqring+0x37f/0xc10 [ 1473.014619][T18652] Code: 74 08 3c 03 0f 8e fa 05 00 00 48 8d bb c0 00 00 00 41 8b ac 24 00 06 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f> b6 14 02 48 89 f8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 b7 [ 1473.034258][T18652] RSP: 0018:ffffc9000b327c78 EFLAGS: 00010006 [ 1473.040316][T18652] RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffc90002151000 [ 1473.048294][T18652] RDX: 0000000000000018 RSI: ffffffff81db8861 RDI: 00000000000000c0 [ 1473.056271][T18652] RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000003 [ 1473.064231][T18652] R10: fffff52001664f8f R11: 0000000000000000 R12: ffff88803d2fe000 [ 1473.072192][T18652] R13: 0000000000000000 R14: 1ffff92001664fab R15: ffff88803d2fe0c0 [ 1473.080170][T18652] FS: 00007f0e8dcbf700(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000 [ 1473.089105][T18652] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1473.095681][T18652] CR2: 0000000000970004 CR3: 0000000012e8e000 CR4: 00000000001506f0 [ 1473.103642][T18652] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 1473.111695][T18652] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 1473.119681][T18652] Kernel panic - not syncing: Fatal exception [ 1473.126753][T18652] Kernel Offset: disabled [ 1473.131159][T18652] Rebooting in 86400 seconds..