\x00', 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f000000]}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) 11:27:37 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x48000000, 0x0, 0x0}) 11:27:37 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x16\xfa\xff\xff\xff\x00'}, 0x45c) 11:27:37 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xc, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='\x00c@@', @ANYRES64=0x0], 0x0, 0x0, 0x0}) [ 2247.254135][T19576] binder: send failed reply for transaction 2666, target dead [ 2247.318722][T14627] binder: 14624:14627 got new transaction with bad transaction stack, transaction 2669 has target 14624:0 [ 2247.337482][T14631] binder: 14625:14631 got reply transaction with bad transaction stack, transaction 2671 has target 14624:0 [ 2247.348373][T14627] binder: 14624:14627 transaction failed 29201/-71, size 0-0 line 3045 [ 2247.361673][T14631] binder: 14625:14631 transaction failed 29201/-71, size 0-0 line 2915 [ 2247.372907][T14628] input: syz0 as /devices/virtual/input/input2712 [ 2247.375022][T14631] binder: 14625:14631 ioctl c0306201 200002c0 returned -14 11:27:37 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xc, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='\x00c@@', @ANYRES64=0x0], 0x0, 0x0, 0x0}) [ 2247.421265][T14666] input: syz0 as /devices/virtual/input/input2713 [ 2247.425682][T21720] binder: send failed reply for transaction 2673 to 14625:14631 11:27:37 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x4c000000, 0x0, 0x0}) [ 2247.563806][T14750] binder: 14724:14750 got new transaction with bad transaction stack, transaction 2675 has target 14724:0 [ 2247.593571][T14753] binder: 14752:14753 got reply transaction with bad transaction stack, transaction 2677 has target 14724:0 [ 2247.612308][T14753] binder: 14752:14753 ioctl c0306201 200002c0 returned -14 [ 2247.637163][T21720] binder: send failed reply for transaction 2677 to 14752:14753 11:27:38 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) r2 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x3, 0x402) r3 = openat$null(0xffffffffffffff9c, &(0x7f0000000200)='/dev/null\x00', 0x0, 0x0) ioctl$BLKIOOPT(r3, 0x1279, &(0x7f00000004c0)) ioctl$EVIOCSMASK(r2, 0x40104593, &(0x7f0000000080)={0x0, 0x0, 0x0}) write$binfmt_elf32(r2, &(0x7f0000000100)=ANY=[@ANYBLOB="7f454c460000000000000000000000000200080000110000000000003800"/48], 0x30) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r1, 0xc0505350, &(0x7f0000000500)={{0xfffffffffffffffc, 0x80000000}, {0x3f, 0x8}, 0x2392, 0x5, 0x400}) r4 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r4, 0x1000000000013) 11:27:38 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00/\xfa\xff\xff\xff\x00'}, 0x45c) 11:27:38 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xc, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='\x00c@@', @ANYRES64=0x0, @ANYBLOB], 0x0, 0x0, 0x0}) 11:27:38 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x68000000, 0x0, 0x0}) [ 2247.841258][T14860] binder: 14857:14860 ioctl c0306201 200002c0 returned -14 [ 2247.858072][T14862] input: syz0 as /devices/virtual/input/input2714 [ 2247.865474][T14861] binder: 14859:14861 got new transaction with bad transaction stack, transaction 2682 has target 14859:0 [ 2247.903976][T14902] input: syz0 as /devices/virtual/input/input2715 [ 2247.967082][T19576] binder: send failed reply for transaction 2684 to 14857:14860 11:27:38 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r1, 0x40605346, &(0x7f0000000280)={0x0, 0x0, 0x0, 'queue1\x00'}) r2 = gettid() timer_create(0x1, &(0x7f0000000040)={0x0, 0x812, 0x5, @tid=r2}, &(0x7f0000000140)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) 11:27:38 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xc, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='\x00c@@', @ANYRES64=0x0, @ANYBLOB], 0x0, 0x0, 0x0}) [ 2248.099435][T14977] binder: 14973:14977 got new transaction with bad transaction stack, transaction 2686 has target 14973:0 11:27:38 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r1, 0xc02c5341, &(0x7f0000000280)={0x0, 0x0, 0x0, 'queue1\x00', 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfeffffff]}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) 11:27:38 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x04\x00'}, 0x45c) 11:27:38 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x6c000000, 0x0, 0x0}) 11:27:38 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xc, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='\x00c@@', @ANYRES64=0x0, @ANYBLOB], 0x0, 0x0, 0x0}) [ 2248.218288][T14984] binder: 14983:14984 ioctl c0306201 200002c0 returned -14 [ 2248.235691][T14989] input: syz0 as /devices/virtual/input/input2716 [ 2248.243235][T14988] binder: 14982:14988 got new transaction with bad transaction stack, transaction 2690 has target 14982:0 11:27:38 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1e, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='\x00c@@', @ANYRES64=0x0, @ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644"], 0x0, 0x0, 0x0}) [ 2248.284731][T15011] input: syz0 as /devices/virtual/input/input2717 [ 2248.316414][T21720] binder: send failed reply for transaction 2692 to 14983:14984 11:27:38 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xf8\xff\xff\xff\x00'}, 0x45c) [ 2248.469532][T15105] input: syz0 as /devices/virtual/input/input2718 [ 2248.521501][T21720] binder: undelivered transaction 2695, process died. 11:27:38 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) r2 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x3, 0x402) r3 = openat$null(0xffffffffffffff9c, &(0x7f0000000200)='/dev/null\x00', 0x0, 0x0) ioctl$BLKIOOPT(r3, 0x1279, &(0x7f00000004c0)) ioctl$EVIOCSMASK(r2, 0x40104593, &(0x7f0000000080)={0x0, 0x0, 0x0}) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r1, 0xc0505350, &(0x7f0000000500)={{0xfffffffffffffffc, 0x80000000}, {0x3f, 0x8}, 0x2392, 0x5, 0x400}) r4 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r4, 0x1000000000013) 11:27:38 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x74000000, 0x0, 0x0}) 11:27:38 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00'}, 0x45c) 11:27:38 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1e, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='\x00c@@', @ANYRES64=0x0, @ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644"], 0x0, 0x0, 0x0}) [ 2248.715522][T15114] binder: 15112:15114 ioctl c0306201 200002c0 returned -14 [ 2248.771382][T15135] input: syz0 as /devices/virtual/input/input2720 [ 2248.787083][T19576] binder: undelivered transaction 2699, process died. [ 2248.795282][T19576] binder: send failed reply for transaction 2700 to 15112:15114 11:27:41 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x7a000000, 0x0, 0x0}) 11:27:41 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1e, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='\x00c@@', @ANYRES64=0x0, @ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644"], 0x0, 0x0, 0x0}) 11:27:41 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) 11:27:41 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r1, 0x40605346, &(0x7f0000000280)={0x0, 0x0, 0x0, 'queue1\x00'}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)=0x0) timerfd_create(0x3, 0x80000) io_setup(0x9, &(0x7f0000000040)=0x0) io_destroy(r4) clock_gettime(0x0, &(0x7f0000000340)={0x0, 0x0}) timer_settime(r3, 0x0, &(0x7f0000000200)={{0x0, 0x1c9c380}, {r5, r6+30000000}}, 0x0) tkill(r2, 0x1000000000013) 11:27:41 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r1, 0xc02c5341, &(0x7f0000000280)={0x0, 0x0, 0x0, 'queue1\x00', 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe]}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) 11:27:41 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x3, 0x402) r2 = openat$null(0xffffffffffffff9c, &(0x7f0000000200)='/dev/null\x00', 0x0, 0x0) ioctl$BLKIOOPT(r2, 0x1279, &(0x7f00000004c0)) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r1, 0xc0505350, &(0x7f0000000500)={{0xfffffffffffffffc, 0x80000000}, {0x3f, 0x8}, 0x2392, 0x5, 0x400}) r3 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r3, 0x1000000000013) [ 2251.124432][T15239] binder_transaction: 9 callbacks suppressed [ 2251.124461][T15239] binder: 15233:15239 transaction failed 29189/-22, size 0-0 line 2995 [ 2251.135635][T15239] binder: 15233:15239 ioctl c0306201 200002c0 returned -14 [ 2251.156980][T15238] input: syz0 as /devices/virtual/input/input2722 [ 2251.165780][T19576] binder_release_work: 18 callbacks suppressed [ 2251.165787][T19576] binder: undelivered TRANSACTION_ERROR: 29189 [ 2251.190439][T19576] binder_thread_release: 8 callbacks suppressed [ 2251.190460][T19576] binder: release 15234:15242 transaction 2703 out, still active [ 2251.218084][T19576] binder_release_work: 15 callbacks suppressed 11:27:41 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x27, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='\x00c@@', @ANYRES64=0x0, @ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) [ 2251.218089][T19576] binder: undelivered TRANSACTION_COMPLETE [ 2251.243891][T19576] binder: undelivered TRANSACTION_COMPLETE [ 2251.278237][T19576] binder_send_failed_reply: 8 callbacks suppressed [ 2251.278245][T19576] binder: send failed reply for transaction 2703, target dead [ 2251.310739][T15359] binder: 15330:15359 transaction failed 29201/-28, size 16585771-0 line 3148 11:27:41 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x100000000000000, 0x0, 0x0}) [ 2251.323797][T19576] binder: undelivered transaction 2704, process died. [ 2251.342825][T19576] binder: send failed reply for transaction 2705 to 15233:15239 [ 2251.351100][T19576] binder: undelivered TRANSACTION_COMPLETE [ 2251.357514][T19576] binder: undelivered TRANSACTION_ERROR: 29189 [ 2251.364026][T19576] binder: release 15330:15359 transaction 2707 out, still active [ 2251.372261][T19576] binder: undelivered TRANSACTION_COMPLETE 11:27:41 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1f, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='\x00c@@', @ANYRES64=0x0, @ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2"], 0x0, 0x0, 0x0}) 11:27:41 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r1, 0x40605346, &(0x7f0000000280)={0x0, 0x0, 0x0, 'queue1\x00'}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) r3 = syz_open_dev$audion(&(0x7f0000000040)='/dev/audio#\x00', 0xfb25, 0x80000) ioctl$KDGKBLED(r3, 0x4b64, &(0x7f0000000140)) [ 2251.378375][T19576] binder: undelivered TRANSACTION_ERROR: 29201 [ 2251.397915][T15238] input: syz0 as /devices/virtual/input/input2723 [ 2251.401009][T21720] binder: send failed reply for transaction 2707, target dead [ 2251.478726][T15368] binder: 15366:15368 transaction failed 29189/-22, size 0-0 line 2995 11:27:41 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x02\x00'}, 0x45c) [ 2251.543413][T19576] binder: release 15369:15372 transaction 2711 out, still active [ 2251.555813][T19576] binder: undelivered TRANSACTION_COMPLETE 11:27:41 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1f, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='\x00c@@', @ANYRES64=0x0, @ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2"], 0x0, 0x0, 0x0}) [ 2251.590800][T19576] binder: undelivered TRANSACTION_COMPLETE [ 2251.612203][T15404] input: syz0 as /devices/virtual/input/input2724 [ 2251.617879][T21720] binder: send failed reply for transaction 2711, target dead [ 2251.640989][T21720] binder: undelivered transaction 2712, process died. [ 2251.672254][T15436] input: syz0 as /devices/virtual/input/input2725 11:27:42 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x03\x00'}, 0x45c) 11:27:42 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x200000000000000, 0x0, 0x0}) [ 2251.743086][T21720] binder: release 15453:15492 transaction 2714 out, still active [ 2251.756005][T21720] binder: undelivered TRANSACTION_COMPLETE [ 2251.786914][T21720] binder: undelivered TRANSACTION_COMPLETE [ 2251.812840][T21720] binder: undelivered TRANSACTION_ERROR: 29189 [ 2251.829281][T15496] binder_alloc_new_buf_locked: 1 callbacks suppressed 11:27:42 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1f, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='\x00c@@', @ANYRES64=0x0, @ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2"], 0x0, 0x0, 0x0}) [ 2251.829289][T15496] binder_alloc: 15453: binder_alloc_buf, no vma [ 2251.840039][T21720] binder: send failed reply for transaction 2714, target dead [ 2251.852945][T15496] binder: 15495:15496 transaction failed 29189/-3, size 0-0 line 3148 [ 2251.873159][T21720] binder: undelivered transaction 2715, process died. [ 2251.885517][T15499] input: syz0 as /devices/virtual/input/input2726 [ 2251.936489][T15529] input: syz0 as /devices/virtual/input/input2727 [ 2251.953242][T19576] binder: release 15513:15540 transaction 2718 out, still active [ 2251.971155][T19576] binder: undelivered TRANSACTION_COMPLETE 11:27:42 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x23, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='\x00c@@', @ANYRES64=0x0, @ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa"], 0x0, 0x0, 0x0}) [ 2251.995398][T19576] binder: undelivered TRANSACTION_COMPLETE 11:27:42 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r1, 0xc02c5341, &(0x7f0000000280)={0x0, 0x0, 0x0, 'queue1\x00', 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe00000000000000]}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) 11:27:42 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x3, 0x402) openat$null(0xffffffffffffff9c, &(0x7f0000000200)='/dev/null\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r1, 0xc0505350, &(0x7f0000000500)={{0xfffffffffffffffc, 0x80000000}, {0x3f, 0x8}, 0x2392, 0x5, 0x400}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) [ 2252.037317][T19576] binder: send failed reply for transaction 2718, target dead [ 2252.075593][T19576] binder: undelivered transaction 2719, process died. 11:27:42 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x300000000000000, 0x0, 0x0}) [ 2252.097383][T19576] binder: undelivered TRANSACTION_ERROR: 29189 11:27:42 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x04\x00'}, 0x45c) [ 2252.172853][T19576] binder: release 15612:15616 transaction 2721 out, still active 11:27:42 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x23, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='\x00c@@', @ANYRES64=0x0, @ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa"], 0x0, 0x0, 0x0}) [ 2252.221417][T15621] binder: 15618:15621 got reply transaction with bad transaction stack, transaction 2723 has target 15612:0 [ 2252.252244][T19576] binder: send failed reply for transaction 2721, target dead [ 2252.261176][T19576] binder: undelivered transaction 2722, process died. [ 2252.270817][T19576] binder: send failed reply for transaction 2723 to 15618:15621 [ 2252.280223][T15625] input: syz0 as /devices/virtual/input/input2728 [ 2252.300801][T15621] binder: 15618:15621 transaction failed 29201/-71, size 0-0 line 2915 [ 2252.316459][T15621] binder: 15618:15621 ioctl c0306201 200002c0 returned -14 [ 2252.331717][T21720] binder: undelivered TRANSACTION_ERROR: 29189 [ 2252.338980][T15621] binder: 15618:15621 transaction failed 29189/-22, size 0-0 line 2995 [ 2252.350976][T21720] binder: undelivered TRANSACTION_ERROR: 29201 [ 2252.365667][T15649] input: syz0 as /devices/virtual/input/input2729 [ 2252.384528][T21720] binder: release 15631:15655 transaction 2727 out, still active [ 2252.414442][T21720] binder: send failed reply for transaction 2727, target dead [ 2252.433498][T21720] binder: undelivered transaction 2728, process died. 11:27:42 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vga_arbiter\x00', 0x280000, 0x0) ioctl$SCSI_IOCTL_BENCHMARK_COMMAND(r2, 0x3) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) r3 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r3, 0x1000000000013) 11:27:42 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x23, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='\x00c@@', @ANYRES64=0x0, @ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa"], 0x0, 0x0, 0x0}) 11:27:42 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x400000000000000, 0x0, 0x0}) 11:27:42 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x05\x00'}, 0x45c) [ 2252.494949][T21720] binder: undelivered TRANSACTION_ERROR: 29189 [ 2252.555080][T15747] binder: 15745:15747 transaction failed 29189/-22, size 0-0 line 2995 [ 2252.579418][T15752] input: syz0 as /devices/virtual/input/input2730 [ 2252.589634][T21720] binder: release 15744:15750 transaction 2731 out, still active 11:27:42 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='\x00c@@', @ANYRES64=0x0, @ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b"], 0x0, 0x0, 0x0}) [ 2252.614173][T15747] binder: 15745:15747 ioctl c0306201 200002c0 returned -14 [ 2252.651303][ T1470] binder: send failed reply for transaction 2731, target dead [ 2252.673179][T15756] input: syz0 as /devices/virtual/input/input2731 [ 2252.680158][ T1470] binder: undelivered transaction 2732, process died. [ 2252.688583][T15747] binder: 15745:15747 transaction failed 29189/-22, size 0-0 line 2995 [ 2252.704934][ T1470] binder: undelivered TRANSACTION_ERROR: 29189 11:27:43 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x11\x00'}, 0x45c) [ 2252.759799][T15792] binder: 15763:15792 got transaction with invalid data ptr [ 2252.767689][T15792] binder: 15763:15792 transaction failed 29201/-14, size 43-0 line 3180 [ 2252.790606][ T1470] binder: release 15763:15792 transaction 2735 out, still active [ 2252.804775][ T1470] binder: undelivered TRANSACTION_ERROR: 29201 11:27:43 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='\x00c@@', @ANYRES64=0x0, @ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b"], 0x0, 0x0, 0x0}) [ 2252.843864][T19576] binder: send failed reply for transaction 2735, target dead [ 2252.852542][T15866] input: syz0 as /devices/virtual/input/input2732 [ 2252.907498][T15870] input: syz0 as /devices/virtual/input/input2733 [ 2253.008870][T15873] binder: 15872:15873 got transaction with invalid data ptr [ 2253.038321][T15873] binder: 15872:15873 transaction failed 29201/-14, size 43-0 line 3180 11:27:43 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r1, 0xc02c5341, &(0x7f0000000280)={0x0, 0x0, 0x0, 'queue1\x00', 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f00000000000000]}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) 11:27:43 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x500000000000000, 0x0, 0x0}) 11:27:43 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x3, 0x402) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r1, 0xc0505350, &(0x7f0000000500)={{0xfffffffffffffffc, 0x80000000}, {0x3f, 0x8}, 0x2392, 0x5, 0x400}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) 11:27:43 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x12\x00'}, 0x45c) 11:27:43 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='\x00c@@', @ANYRES64=0x0, @ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b"], 0x0, 0x0, 0x0}) [ 2253.054030][T19576] binder: release 15872:15873 transaction 2738 out, still active [ 2253.071257][ T1470] binder: send failed reply for transaction 2738, target dead [ 2253.150369][T15882] input: syz0 as /devices/virtual/input/input2734 [ 2253.155140][T15886] binder: 15883:15886 ioctl c0306201 200002c0 returned -14 [ 2253.175799][T15888] binder: 15880:15888 got transaction with invalid data ptr [ 2253.232021][T15934] input: syz0 as /devices/virtual/input/input2735 [ 2253.265652][ T1470] binder: send failed reply for transaction 2744 to 15883:15886 11:27:43 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) 11:27:43 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x26, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='\x00c@@', @ANYRES64=0x0, @ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14"], 0x0, 0x0, 0x0}) 11:27:43 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x600000000000000, 0x0, 0x0}) 11:27:43 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x14\x00'}, 0x45c) [ 2253.579081][T16008] binder: 16007:16008 got transaction with invalid data ptr [ 2253.584020][T16013] binder: 16011:16013 got reply transaction with bad transaction stack, transaction 2748 has target 16007:0 [ 2253.602335][T16014] input: syz0 as /devices/virtual/input/input2736 [ 2253.619687][T16013] binder: 16011:16013 ioctl c0306201 200002c0 returned -14 [ 2253.657306][T16016] input: syz0 as /devices/virtual/input/input2737 [ 2253.681023][T16053] input: syz0 as /devices/virtual/input/input2738 11:27:44 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x26, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='\x00c@@', @ANYRES64=0x0, @ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14"], 0x0, 0x0, 0x0}) [ 2253.711240][ T1470] binder: send failed reply for transaction 2750 to 16011:16013 11:27:44 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x700000000000000, 0x0, 0x0}) 11:27:44 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x15\x00'}, 0x45c) [ 2253.860770][T16132] binder: 16128:16132 got transaction with invalid data ptr [ 2253.866540][T16130] binder: 16129:16130 got reply transaction with bad transaction stack, transaction 2754 has target 16128:0 [ 2253.917544][T19576] binder: send failed reply for transaction 2754 to 16129:16130 [ 2253.925612][T16130] binder: 16129:16130 ioctl c0306201 200002c0 returned -14 [ 2253.947836][T16135] input: syz0 as /devices/virtual/input/input2739 [ 2254.007054][T16155] input: syz0 as /devices/virtual/input/input2740 11:27:44 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r1, 0xc02c5341, &(0x7f0000000280)={0x0, 0x0, 0x0, 'queue1\x00', 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfeffffff00000000]}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) 11:27:44 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) 11:27:44 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x26, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='\x00c@@', @ANYRES64=0x0, @ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14"], 0x0, 0x0, 0x0}) 11:27:44 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x3, 0x402) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r1, 0xc0505350, &(0x7f0000000500)={{0xfffffffffffffffc, 0x80000000}, {0x3f, 0x8}, 0x2392, 0x5, 0x400}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) 11:27:44 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x16\x00'}, 0x45c) 11:27:44 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0xa00000000000000, 0x0, 0x0}) [ 2254.163803][T16251] input: syz0 as /devices/virtual/input/input2741 [ 2254.202434][T16259] binder: 16254:16259 got reply transaction with bad transaction stack, transaction 2759 has target 16255:0 [ 2254.220258][T16257] binder: 16255:16257 got transaction with invalid data ptr [ 2254.227582][T16258] input: syz0 as /devices/virtual/input/input2742 11:27:44 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1f, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='\x00c@@', @ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) [ 2254.264244][T16259] binder: 16254:16259 ioctl c0306201 200002c0 returned -14 [ 2254.296063][T16259] binder_alloc: 16255: binder_alloc_buf, no vma 11:27:44 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) [ 2254.357622][T16251] input: syz0 as /devices/virtual/input/input2743 [ 2254.398651][T16372] binder: 16288:16372 got transaction to invalid handle 11:27:44 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x3f00000000000000, 0x0, 0x0}) 11:27:44 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1f, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='\x00c@@', @ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) 11:27:44 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff/\x00'}, 0x45c) [ 2254.485562][T16376] input: syz0 as /devices/virtual/input/input2744 [ 2254.559228][T16383] binder: 16379:16383 ioctl c0306201 200002c0 returned -14 11:27:44 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) socket$inet_udplite(0x2, 0x2, 0x88) write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) [ 2254.622870][T16422] input: syz0 as /devices/virtual/input/input2745 [ 2254.661501][T16487] input: syz0 as /devices/virtual/input/input2746 [ 2254.672889][T16434] binder: 16384:16434 got transaction to invalid handle [ 2254.724222][T16502] input: syz0 as /devices/virtual/input/input2747 11:27:45 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1f, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='\x00c@@', @ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) 11:27:45 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x4800000000000000, 0x0, 0x0}) 11:27:45 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x03\x00'}, 0x45c) 11:27:45 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r1, 0xc02c5341, &(0x7f0000000280)={0x0, 0x0, 0x0, 'queue1\x00', 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff00000000]}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) 11:27:45 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) socket$inet_udplite(0x2, 0x2, 0x88) write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) 11:27:45 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r1, 0xc0505350, &(0x7f0000000500)={{0xfffffffffffffffc, 0x80000000}, {0x3f, 0x8}, 0x2392, 0x5, 0x400}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) [ 2255.145901][T16519] input: syz0 as /devices/virtual/input/input2748 [ 2255.169176][T16524] binder: 16520:16524 ioctl c0306201 200002c0 returned -14 [ 2255.179671][T16523] input: syz0 as /devices/virtual/input/input2749 [ 2255.191372][T16525] binder: 16516:16525 got transaction to invalid handle 11:27:45 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='\x00c@@', @ANYBLOB], 0x0, 0x0, 0x0}) 11:27:45 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) socket$inet_udplite(0x2, 0x2, 0x88) write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) [ 2255.259817][T16531] input: syz0 as /devices/virtual/input/input2750 [ 2255.270821][T19576] binder: send failed reply for transaction 2775 to 16520:16524 11:27:45 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x05\x00'}, 0x45c) 11:27:45 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x4c00000000000000, 0x0, 0x0}) [ 2255.382242][T16641] binder: 16607:16641 got new transaction with bad transaction stack, transaction 2777 has target 16607:0 [ 2255.434915][T16644] input: syz0 as /devices/virtual/input/input2751 11:27:45 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='\x00c@@', @ANYBLOB], 0x0, 0x0, 0x0}) [ 2255.500600][T16648] binder: 16647:16648 got reply transaction with bad transaction stack, transaction 2779 has target 16607:0 [ 2255.527874][T19576] binder: send failed reply for transaction 2779 to 16647:16648 [ 2255.544462][T16651] input: syz0 as /devices/virtual/input/input2752 11:27:45 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) [ 2255.569377][T16648] binder: 16647:16648 ioctl c0306201 200002c0 returned -14 [ 2255.587251][T16654] input: syz0 as /devices/virtual/input/input2753 [ 2255.632651][T16658] binder: 16655:16658 got new transaction with bad transaction stack, transaction 2782 has target 16655:0 11:27:46 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='\x00c@@', @ANYBLOB], 0x0, 0x0, 0x0}) 11:27:46 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x11\x00'}, 0x45c) [ 2255.713054][T19576] binder: send failed reply for transaction 2784 to 16647:16648 [ 2255.744843][T16761] input: syz0 as /devices/virtual/input/input2754 11:27:46 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x6800000000000000, 0x0, 0x0}) [ 2255.837627][T16768] binder: 16765:16768 got new transaction with bad transaction stack, transaction 2786 has target 16765:0 [ 2255.873945][T16771] binder: 16770:16771 got reply transaction with bad transaction stack, transaction 2788 has target 16765:0 [ 2255.897986][T16771] binder: 16770:16771 ioctl c0306201 200002c0 returned -14 [ 2255.911980][T16772] input: syz0 as /devices/virtual/input/input2755 [ 2255.969784][T16775] input: syz0 as /devices/virtual/input/input2756 11:27:46 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r1, 0xc02c5341, &(0x7f0000000280)={0x0, 0x0, 0x0, 'queue1\x00', 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe]}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) 11:27:46 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) 11:27:46 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r1, 0xc0505350, &(0x7f0000000500)={{0xfffffffffffffffc, 0x80000000}, {0x3f, 0x8}, 0x2392, 0x5, 0x400}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) 11:27:46 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x12, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='\x00c@@', @ANYBLOB="fcdfffffffffffff372e1c1c896b"], 0x0, 0x0, 0x0}) 11:27:46 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x12\x00'}, 0x45c) 11:27:46 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x6c00000000000000, 0x0, 0x0}) [ 2256.167176][T16894] input: syz0 as /devices/virtual/input/input2757 [ 2256.197005][T16895] input: syz0 as /devices/virtual/input/input2758 [ 2256.199314][T16898] binder: 16891:16898 got reply transaction with bad transaction stack, transaction 2793 has target 16887:0 [ 2256.216138][T16893] binder: 16887:16893 got transaction to invalid handle [ 2256.245091][T16893] binder_transaction: 22 callbacks suppressed [ 2256.245113][T16893] binder: 16887:16893 transaction failed 29201/-22, size 0-0 line 2995 11:27:46 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) [ 2256.275395][T16898] binder: 16891:16898 transaction failed 29201/-71, size 0-0 line 2915 [ 2256.285686][T16898] binder: 16891:16898 ioctl c0306201 200002c0 returned -14 [ 2256.308736][T19576] binder_thread_release: 13 callbacks suppressed [ 2256.308763][T19576] binder: release 16887:16893 transaction 2792 out, still active 11:27:46 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x12, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='\x00c@@', @ANYBLOB="fcdfffffffffffff372e1c1c896b"], 0x0, 0x0, 0x0}) [ 2256.351087][T19576] binder_release_work: 28 callbacks suppressed [ 2256.351093][T19576] binder: undelivered TRANSACTION_COMPLETE [ 2256.379011][T19576] binder_release_work: 30 callbacks suppressed [ 2256.379017][T19576] binder: undelivered TRANSACTION_ERROR: 29201 11:27:46 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x14\x00'}, 0x45c) [ 2256.398020][T19576] binder_send_failed_reply: 13 callbacks suppressed [ 2256.398026][T19576] binder: send failed reply for transaction 2792, target dead [ 2256.413416][T19576] binder: send failed reply for transaction 2793 to 16891:16898 [ 2256.427647][T16898] binder: 16891:16898 transaction failed 29189/-22, size 0-0 line 2995 [ 2256.446512][T16908] input: syz0 as /devices/virtual/input/input2760 [ 2256.454030][T16930] binder: 16910:16930 got transaction to invalid handle [ 2256.471306][T19576] binder: undelivered TRANSACTION_COMPLETE [ 2256.481045][T16930] binder: 16910:16930 transaction failed 29201/-22, size 0-0 line 2995 [ 2256.497809][T19576] binder: undelivered TRANSACTION_ERROR: 29201 [ 2256.512823][T16971] input: syz0 as /devices/virtual/input/input2761 [ 2256.521021][T19576] binder: undelivered TRANSACTION_ERROR: 29189 [ 2256.544307][T19576] binder: release 16910:16930 transaction 2798 out, still active 11:27:46 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x12, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='\x00c@@', @ANYBLOB="fcdfffffffffffff372e1c1c896b"], 0x0, 0x0, 0x0}) 11:27:46 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) [ 2256.577831][T19576] binder: undelivered TRANSACTION_COMPLETE 11:27:46 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x7400000000000000, 0x0, 0x0}) [ 2256.621222][T19576] binder: undelivered TRANSACTION_ERROR: 29201 [ 2256.670660][T19576] binder: undelivered TRANSACTION_ERROR: 29189 [ 2256.700118][T19576] binder: send failed reply for transaction 2798, target dead [ 2256.728198][T17035] binder: 17031:17035 got transaction to invalid handle [ 2256.735708][T17035] binder: 17031:17035 transaction failed 29201/-22, size 0-0 line 2995 [ 2256.745436][T17036] binder: 17034:17036 got reply transaction with bad transaction stack, transaction 2803 has target 17031:0 [ 2256.747206][T19576] binder: release 17031:17035 transaction 2801 out, still active [ 2256.767415][T19576] binder: undelivered TRANSACTION_COMPLETE [ 2256.773663][T19576] binder: undelivered TRANSACTION_ERROR: 29201 [ 2256.780807][T17036] binder: 17034:17036 transaction failed 29201/-71, size 0-0 line 2915 [ 2256.790027][T17036] binder: 17034:17036 ioctl c0306201 200002c0 returned -14 [ 2256.800295][T21720] binder: release 17034:17036 transaction 2803 out, still active [ 2256.809845][T17036] binder_alloc: 17031: binder_alloc_buf, no vma [ 2256.814872][T21720] binder: undelivered TRANSACTION_COMPLETE [ 2256.833917][T17036] binder: 17034:17036 transaction failed 29189/-3, size 0-0 line 3148 [ 2256.846056][T21720] binder: undelivered TRANSACTION_ERROR: 29201 [ 2256.873232][T21720] binder: send failed reply for transaction 2801, target dead [ 2256.883478][T21720] binder: send failed reply for transaction 2803, target dead [ 2256.912814][T21720] binder: undelivered TRANSACTION_ERROR: 29189 11:27:47 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r1, 0xc02c5341, &(0x7f0000000280)={0x0, 0x0, 0x0, 'queue1\x00', 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe00]}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) 11:27:47 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x15\x00'}, 0x45c) 11:27:47 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x19, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='\x00c@@', @ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b"], 0x0, 0x0, 0x0}) 11:27:47 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) 11:27:47 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x7a00000000000000, 0x0, 0x0}) 11:27:47 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r1, 0xc0505350, &(0x7f0000000500)={{0xfffffffffffffffc, 0x80000000}, {0x3f, 0x8}, 0x2392, 0x5, 0x400}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) [ 2257.183662][T17162] binder: 17155:17162 transaction failed 29189/-22, size 0-0 line 2995 [ 2257.202772][T17161] binder: 17157:17161 got transaction to invalid handle [ 2257.225014][T17162] binder: 17155:17162 ioctl c0306201 200002c0 returned -14 11:27:47 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) [ 2257.228805][T17163] input: syz0 as /devices/virtual/input/input2764 [ 2257.237221][T17161] binder: 17157:17161 transaction failed 29201/-22, size 0-0 line 2995 [ 2257.253780][T21720] binder: undelivered TRANSACTION_ERROR: 29189 [ 2257.300246][T21720] binder: release 17157:17161 transaction 2808 out, still active [ 2257.330635][T21720] binder: undelivered TRANSACTION_COMPLETE [ 2257.344008][T21720] binder: undelivered TRANSACTION_ERROR: 29201 11:27:47 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x19, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='\x00c@@', @ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b"], 0x0, 0x0, 0x0}) 11:27:47 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) [ 2257.361327][T21720] binder: send failed reply for transaction 2808, target dead [ 2257.373645][T21720] binder: send failed reply for transaction 2810 to 17155:17162 [ 2257.383258][T17163] input: syz0 as /devices/virtual/input/input2767 11:27:47 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x0, 0x2, 0x0}) [ 2257.438807][T19576] binder: undelivered TRANSACTION_COMPLETE 11:27:47 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x16\x00'}, 0x45c) [ 2257.498244][T17291] binder: 17287:17291 transaction failed 29189/-22, size 0-0 line 2995 [ 2257.499417][T17290] binder: 17286:17290 got transaction to invalid handle 11:27:47 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) [ 2257.579860][T21720] binder: release 17286:17290 transaction 2813 out, still active [ 2257.598232][T21720] binder: undelivered TRANSACTION_COMPLETE [ 2257.634832][T17353] input: syz0 as /devices/virtual/input/input2769 [ 2257.675761][T17407] input: syz0 as /devices/virtual/input/input2770 [ 2257.693340][T21720] binder: send failed reply for transaction 2813, target dead [ 2257.705159][T21720] binder: send failed reply for transaction 2815 to 17287:17291 [ 2257.750204][T21720] binder: undelivered TRANSACTION_COMPLETE 11:27:48 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x0, 0x3, 0x0}) 11:27:48 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x19, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='\x00c@@', @ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b"], 0x0, 0x0, 0x0}) 11:27:48 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x1f\x00'}, 0x45c) 11:27:48 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r1, 0xc02c5341, &(0x7f0000000280)={0x0, 0x0, 0x0, 'queue1\x00', 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f00]}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) 11:27:48 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) 11:27:48 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r1, 0xc0505350, &(0x7f0000000500)={{0xfffffffffffffffc, 0x80000000}, {0x3f, 0x8}, 0x2392, 0x5, 0x400}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) [ 2258.131944][T17427] input: syz0 as /devices/virtual/input/input2773 [ 2258.170833][T17452] binder: 17424:17452 got transaction to invalid handle 11:27:48 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) [ 2258.196236][T19576] binder: release 17424:17452 transaction 2819 out, still active [ 2258.211034][T19576] binder: undelivered TRANSACTION_COMPLETE [ 2258.236003][T17526] input: syz0 as /devices/virtual/input/input2774 11:27:48 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='\x00c@@', @ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e"], 0x0, 0x0, 0x0}) 11:27:48 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x0, 0x4, 0x0}) 11:27:48 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00/\x00'}, 0x45c) [ 2258.272874][T19576] binder: send failed reply for transaction 2819, target dead [ 2258.299751][T17548] input: syz0 as /devices/virtual/input/input2775 [ 2258.367708][T17553] binder: 17552:17553 got transaction to invalid handle [ 2258.409208][T17558] input: syz0 as /devices/virtual/input/input2776 [ 2258.439446][T19576] binder: release 17552:17553 transaction 2822 out, still active 11:27:48 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) [ 2258.451169][T17560] binder: 17556:17560 got reply transaction with bad transaction stack, transaction 2824 has target 17552:0 11:27:48 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='\x00c@@', @ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e"], 0x0, 0x0, 0x0}) [ 2258.493924][T21720] binder: release 17556:17560 transaction 2824 out, still active [ 2258.512605][T17560] binder_alloc: 17552: binder_alloc_buf, no vma [ 2258.520190][T21720] binder: send failed reply for transaction 2822, target dead [ 2258.555016][T17566] input: syz0 as /devices/virtual/input/input2777 [ 2258.564344][T21720] binder: send failed reply for transaction 2824, target dead [ 2258.613248][T17558] input: syz0 as /devices/virtual/input/input2778 11:27:48 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) 11:27:48 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00?\x00'}, 0x45c) [ 2258.671967][T21720] binder: release 17589:17660 transaction 2828 out, still active 11:27:49 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x0, 0x5, 0x0}) [ 2258.746902][T21720] binder: send failed reply for transaction 2828, target dead [ 2258.813716][T17695] input: syz0 as /devices/virtual/input/input2779 [ 2258.840284][T17697] input: syz0 as /devices/virtual/input/input2780 [ 2258.891820][T17716] input: syz0 as /devices/virtual/input/input2781 11:27:49 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r1, 0xc02c5341, &(0x7f0000000280)={0x0, 0x0, 0x0, 'queue1\x00', 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe000000]}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) 11:27:49 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='\x00c@@', @ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e"], 0x0, 0x0, 0x0}) 11:27:49 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r1, 0xc0505350, &(0x7f0000000500)={{0xfffffffffffffffc, 0x80000000}, {0x3f, 0x8}, 0x2392, 0x5, 0x400}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) 11:27:49 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) 11:27:49 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x01\x00'}, 0x45c) 11:27:49 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x0, 0x6, 0x0}) [ 2259.133984][T17823] input: syz0 as /devices/virtual/input/input2782 [ 2259.147252][T17824] input: syz0 as /devices/virtual/input/input2783 11:27:49 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r1, 0xc0505350, &(0x7f0000000500)={{0xfffffffffffffffc, 0x80000000}, {0x3f, 0x8}, 0x2392, 0x5, 0x400}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) 11:27:49 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1e, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='\x00c@@', @ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14"], 0x0, 0x0, 0x0}) [ 2259.213171][T17845] input: syz0 as /devices/virtual/input/input2784 [ 2259.218392][T19576] binder: send failed reply for transaction 2836 to 17825:17827 11:27:49 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) 11:27:49 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x0, 0x7, 0x0}) 11:27:49 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x02\x00'}, 0x45c) 11:27:49 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r1, 0xc0505350, &(0x7f0000000500)={{0xfffffffffffffffc, 0x80000000}, {0x3f, 0x8}, 0x2392, 0x5, 0x400}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) [ 2259.441430][T17951] input: syz0 as /devices/virtual/input/input2785 [ 2259.553976][T17965] input: syz0 as /devices/virtual/input/input2786 [ 2259.651762][T18058] input: syz0 as /devices/virtual/input/input2787 11:27:50 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r1, 0xc02c5341, &(0x7f0000000280)={0x0, 0x0, 0x0, 'queue1\x00', 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f000000]}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) 11:27:50 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1e, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='\x00c@@', @ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14"], 0x0, 0x0, 0x0}) 11:27:50 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) 11:27:50 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") read(0xffffffffffffffff, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(0xffffffffffffffff, 0xc0505350, &(0x7f0000000500)={{0xfffffffffffffffc, 0x80000000}, {0x3f, 0x8}, 0x2392, 0x5, 0x400}) r1 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r1, 0x1000000000013) 11:27:50 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x03\x00'}, 0x45c) 11:27:50 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x0, 0xa, 0x0}) 11:27:50 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") read(0xffffffffffffffff, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(0xffffffffffffffff, 0xc0505350, &(0x7f0000000500)={{0xfffffffffffffffc, 0x80000000}, {0x3f, 0x8}, 0x2392, 0x5, 0x400}) r1 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r1, 0x1000000000013) [ 2260.121943][T18083] input: syz0 as /devices/virtual/input/input2788 [ 2260.135064][T18082] input: syz0 as /devices/virtual/input/input2789 [ 2260.147874][T18089] binder_transaction: 3 callbacks suppressed [ 2260.147914][T18089] binder: 18081:18089 got transaction to invalid handle [ 2260.233216][T18139] input: syz0 as /devices/virtual/input/input2790 11:27:50 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1e, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='\x00c@@', @ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14"], 0x0, 0x0, 0x0}) 11:27:50 executing program 3: ioctl$UI_ABS_SETUP(0xffffffffffffffff, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x3) write$uinput_user_dev(0xffffffffffffffff, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(0xffffffffffffffff, 0x5501) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) [ 2260.290588][T19576] binder: send failed reply for transaction 2846 to 18077:18086 11:27:50 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x0, 0x48, 0x0}) 11:27:50 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x04\x00'}, 0x45c) 11:27:50 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") read(0xffffffffffffffff, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(0xffffffffffffffff, 0xc0505350, &(0x7f0000000500)={{0xfffffffffffffffc, 0x80000000}, {0x3f, 0x8}, 0x2392, 0x5, 0x400}) r1 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r1, 0x1000000000013) [ 2260.447686][T18209] binder: 18205:18209 got transaction to invalid handle [ 2260.474005][T18213] binder: 18206:18213 got reply transaction with bad transaction stack, transaction 2850 has target 18205:0 [ 2260.561255][T18243] input: syz0 as /devices/virtual/input/input2791 [ 2260.568887][T19576] binder: send failed reply for transaction 2852 to 18206:18213 [ 2260.621523][T18322] input: syz0 as /devices/virtual/input/input2792 11:27:51 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r1, 0xc02c5341, &(0x7f0000000280)={0x0, 0x0, 0x0, 'queue1\x00', 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfeffffff]}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) 11:27:51 executing program 3: ioctl$UI_ABS_SETUP(0xffffffffffffffff, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x3) write$uinput_user_dev(0xffffffffffffffff, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(0xffffffffffffffff, 0x5501) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) 11:27:51 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) 11:27:51 executing program 4: socket$inet_udplite(0x2, 0x2, 0x88) r0 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r0, 0xc0505350, &(0x7f0000000500)={{0xfffffffffffffffc, 0x80000000}, {0x3f, 0x8}, 0x2392, 0x5, 0x400}) r1 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r1, 0x1000000000013) 11:27:51 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x0, 0x4c, 0x0}) 11:27:51 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x05\x00'}, 0x45c) 11:27:51 executing program 3: ioctl$UI_ABS_SETUP(0xffffffffffffffff, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x3) write$uinput_user_dev(0xffffffffffffffff, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(0xffffffffffffffff, 0x5501) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) [ 2261.100096][T18340] binder: 18334:18340 unknown command -8196 [ 2261.106051][T18340] binder: 18334:18340 ioctl c0306201 200002c0 returned -22 [ 2261.113533][T18345] input: syz0 as /devices/virtual/input/input2793 [ 2261.134654][T18402] input: syz0 as /devices/virtual/input/input2794 11:27:51 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) [ 2261.194981][T19576] binder: send failed reply for transaction 2856 to 18337:18338 11:27:51 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x11\x00'}, 0x45c) 11:27:51 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x0, 0x68, 0x0}) 11:27:51 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, 0x0, 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) [ 2261.288844][T18459] binder: 18458:18459 unknown command -8196 [ 2261.313839][T18459] binder: 18458:18459 ioctl c0306201 200002c0 returned -22 [ 2261.356014][T19576] binder_thread_release: 6 callbacks suppressed [ 2261.356026][T19576] binder: release 18458:18459 transaction 2858 out, still active 11:27:51 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) [ 2261.401814][T19576] binder_release_work: 13 callbacks suppressed [ 2261.401820][T19576] binder: undelivered TRANSACTION_COMPLETE [ 2261.428481][T18468] binder_alloc: 18458: binder_alloc_buf, no vma [ 2261.445708][T18465] input: syz0 as /devices/virtual/input/input2795 [ 2261.445735][T19576] binder_send_failed_reply: 6 callbacks suppressed [ 2261.445757][T19576] binder: send failed reply for transaction 2858, target dead [ 2261.485670][T18468] binder_transaction: 20 callbacks suppressed [ 2261.485688][T18468] binder: 18463:18468 transaction failed 29189/-3, size 0-0 line 3148 [ 2261.515237][T18474] binder: 18473:18474 unknown command -8196 [ 2261.521768][T18474] binder: 18473:18474 ioctl c0306201 200002c0 returned -22 [ 2261.530823][T19576] binder: release 18473:18474 transaction 2861 out, still active [ 2261.543030][T19576] binder: undelivered TRANSACTION_COMPLETE [ 2261.580290][T19576] binder: send failed reply for transaction 2861, target dead [ 2261.601927][T18465] input: syz0 as /devices/virtual/input/input2796 [ 2261.720725][T21720] binder_release_work: 27 callbacks suppressed [ 2261.720732][T21720] binder: undelivered TRANSACTION_ERROR: 29189 11:27:52 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r1, 0xc02c5341, &(0x7f0000000280)={0x0, 0x0, 0x0, 'queue1\x00', 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe]}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) 11:27:52 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, 0x0, 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) 11:27:52 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) 11:27:52 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x12\x00'}, 0x45c) 11:27:52 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x0, 0x6c, 0x0}) 11:27:52 executing program 4: socket$inet_udplite(0x2, 0x2, 0x88) r0 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r0, 0xc0505350, &(0x7f0000000500)={{0xfffffffffffffffc, 0x80000000}, {0x3f, 0x8}, 0x2392, 0x5, 0x400}) r1 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r1, 0x1000000000013) [ 2261.992933][T18591] binder: 18581:18591 got reply transaction with bad transaction stack, transaction 2864 has target 18582:0 [ 2262.000810][T19576] binder: release 18582:18588 transaction 2863 out, still active [ 2262.013116][T18590] input: syz0 as /devices/virtual/input/input2797 [ 2262.025256][T18591] binder: 18581:18591 transaction failed 29201/-71, size 0-0 line 2915 11:27:52 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, 0x0, 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) 11:27:52 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) [ 2262.052192][T19576] binder: undelivered TRANSACTION_COMPLETE [ 2262.068344][T19576] binder: release 18581:18591 transaction 2864 out, still active [ 2262.108826][T19576] binder: undelivered TRANSACTION_COMPLETE [ 2262.137770][T18590] input: syz0 as /devices/virtual/input/input2798 [ 2262.145441][T19576] binder: undelivered TRANSACTION_ERROR: 29201 11:27:52 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x0, 0x74, 0x0}) [ 2262.189020][T19576] binder: send failed reply for transaction 2863, target dead [ 2262.221277][T19576] binder: send failed reply for transaction 2864, target dead 11:27:52 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) [ 2262.242238][T19576] binder: send failed reply for transaction 2866 to 18581:18591 [ 2262.265172][T19576] binder: undelivered TRANSACTION_COMPLETE 11:27:52 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x14\x00'}, 0x45c) [ 2262.289807][T19576] binder: undelivered TRANSACTION_ERROR: 29189 11:27:52 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) [ 2262.332941][T19576] binder: release 18706:18709 transaction 2868 out, still active [ 2262.345635][T18716] binder: 18713:18716 got reply transaction with bad transaction stack, transaction 2869 has target 18706:0 [ 2262.367102][T19576] binder: undelivered TRANSACTION_COMPLETE [ 2262.376857][T19576] binder: send failed reply for transaction 2868, target dead [ 2262.396072][T18716] binder: 18713:18716 transaction failed 29201/-71, size 0-0 line 2915 [ 2262.406061][T19576] binder: send failed reply for transaction 2869 to 18713:18716 [ 2262.421813][T18721] input: syz0 as /devices/virtual/input/input2800 [ 2262.434437][T21720] binder: undelivered TRANSACTION_COMPLETE [ 2262.435613][T18716] binder: 18713:18716 transaction failed 29189/-22, size 0-0 line 2995 [ 2262.441844][T21720] binder: undelivered TRANSACTION_ERROR: 29189 [ 2262.489895][T21720] binder: undelivered TRANSACTION_ERROR: 29201 [ 2262.509310][T18725] input: syz0 as /devices/virtual/input/input2801 [ 2262.516791][T21720] binder: release 18719:18720 transaction 2873 out, still active [ 2262.534046][T21720] binder: undelivered TRANSACTION_COMPLETE [ 2262.561206][T21720] binder: send failed reply for transaction 2873, target dead [ 2262.645845][T19576] binder: undelivered TRANSACTION_ERROR: 29189 11:27:53 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xe, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896b"], 0x0, 0x0, 0x0}) 11:27:53 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) 11:27:53 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r1, 0xc02c5341, &(0x7f0000000280)={0x0, 0x0, 0x0, 'queue1\x00', 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe00000000000000]}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) 11:27:53 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x15\x00'}, 0x45c) 11:27:53 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x0, 0x7a, 0x0}) 11:27:53 executing program 4: socket$inet_udplite(0x2, 0x2, 0x88) r0 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r0, 0xc0505350, &(0x7f0000000500)={{0xfffffffffffffffc, 0x80000000}, {0x3f, 0x8}, 0x2392, 0x5, 0x400}) r1 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r1, 0x1000000000013) [ 2262.901879][T18839] binder: 18837:18839 transaction failed 29189/-22, size 0-0 line 2995 [ 2262.917528][T18841] input: syz0 as /devices/virtual/input/input2802 [ 2262.943010][T18845] binder: 18833:18845 unknown command -8196 [ 2262.976607][T18845] binder: 18833:18845 ioctl c0306201 200002c0 returned -22 11:27:53 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) [ 2262.995593][T18874] input: syz0 as /devices/virtual/input/input2804 [ 2263.018200][T19576] binder: release 18833:18845 transaction 2876 out, still active [ 2263.036428][T19576] binder: undelivered TRANSACTION_COMPLETE 11:27:53 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xe, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896b"], 0x0, 0x0, 0x0}) 11:27:53 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x0, 0x300, 0x0}) 11:27:53 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x16\x00'}, 0x45c) [ 2263.082989][T21720] binder: send failed reply for transaction 2876, target dead [ 2263.116418][T21720] binder: undelivered TRANSACTION_ERROR: 29189 11:27:53 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(0xffffffffffffffff, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) [ 2263.202874][T18967] binder: 18964:18967 transaction failed 29189/-22, size 0-0 line 2995 [ 2263.214758][T18965] binder: 18961:18965 unknown command -8196 [ 2263.239025][T19576] binder: undelivered TRANSACTION_ERROR: 29189 [ 2263.242140][T18965] binder: 18961:18965 ioctl c0306201 200002c0 returned -22 [ 2263.255366][T18968] input: syz0 as /devices/virtual/input/input2806 [ 2263.271209][T18971] input: syz0 as /devices/virtual/input/input2807 [ 2263.280430][T21720] binder: release 18961:18965 transaction 2879 out, still active [ 2263.293603][T21720] binder: undelivered TRANSACTION_COMPLETE 11:27:53 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xe, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896b"], 0x0, 0x0, 0x0}) 11:27:53 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(0xffffffffffffffff, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) 11:27:53 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x1f\x00'}, 0x45c) [ 2263.353797][T21720] binder: send failed reply for transaction 2879, target dead [ 2263.376048][T21720] binder: send failed reply for transaction 2880 to 18964:18967 [ 2263.481935][T19576] binder: undelivered TRANSACTION_ERROR: 29189 [ 2263.488714][T19082] binder: 19078:19082 unknown command -8196 [ 2263.516897][T19082] binder: 19078:19082 ioctl c0306201 200002c0 returned -22 [ 2263.532974][T19085] input: syz0 as /devices/virtual/input/input2809 [ 2263.548082][T19086] input: syz0 as /devices/virtual/input/input2810 [ 2263.551429][T21720] binder: release 19078:19082 transaction 2882 out, still active [ 2263.597675][T19090] input: syz0 as /devices/virtual/input/input2811 [ 2263.609839][T21720] binder: send failed reply for transaction 2882, target dead 11:27:54 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r1, 0xc02c5341, &(0x7f0000000280)={0x0, 0x0, 0x0, 'queue1\x00', 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f00000000000000]}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) 11:27:54 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x0, 0x500, 0x0}) 11:27:54 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x15, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b"], 0x0, 0x0, 0x0}) 11:27:54 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(0xffffffffffffffff, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) 11:27:54 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00/\x00'}, 0x45c) 11:27:54 executing program 4: ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r0 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r0, 0xc0505350, &(0x7f0000000500)={{0xfffffffffffffffc, 0x80000000}, {0x3f, 0x8}, 0x2392, 0x5, 0x400}) r1 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r1, 0x1000000000013) [ 2263.881000][T19105] binder: 19098:19105 transaction failed 29189/-22, size 0-0 line 2995 [ 2263.902426][T19104] input: syz0 as /devices/virtual/input/input2812 [ 2263.920614][T19110] binder: 19100:19110 unknown command -8196 [ 2263.931006][T19110] binder: 19100:19110 ioctl c0306201 200002c0 returned -22 [ 2263.943016][T19107] input: syz0 as /devices/virtual/input/input2813 [ 2263.963473][T19576] binder: release 19100:19110 transaction 2885 out, still active 11:27:54 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, 0x0) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) [ 2264.021914][T19186] input: syz0 as /devices/virtual/input/input2814 11:27:54 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x15, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b"], 0x0, 0x0, 0x0}) 11:27:54 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x0, 0x600, 0x0}) [ 2264.064941][T19576] binder: undelivered TRANSACTION_ERROR: 29189 [ 2264.080205][T19576] binder: send failed reply for transaction 2885, target dead 11:27:54 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00?\x00'}, 0x45c) [ 2264.173079][T19228] binder: 19225:19228 transaction failed 29189/-22, size 0-0 line 2995 [ 2264.192639][T19230] binder: 19226:19230 unknown command -8196 [ 2264.201477][T19230] binder: 19226:19230 ioctl c0306201 200002c0 returned -22 [ 2264.225098][T19229] input: syz0 as /devices/virtual/input/input2815 11:27:54 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, 0x0) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) 11:27:54 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x15, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b"], 0x0, 0x0, 0x0}) [ 2264.291108][T19306] input: syz0 as /devices/virtual/input/input2816 [ 2264.320884][T19576] binder: send failed reply for transaction 2889 to 19225:19228 [ 2264.414084][T19342] input: syz0 as /devices/virtual/input/input2817 [ 2264.443834][T19344] binder: 19340:19344 unknown command -8196 [ 2264.458176][T19344] binder: 19340:19344 ioctl c0306201 200002c0 returned -22 [ 2264.483327][T19346] input: syz0 as /devices/virtual/input/input2818 11:27:55 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r1, 0xc02c5341, &(0x7f0000000280)={0x0, 0x0, 0x0, 'queue1\x00', 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfeffffff00000000]}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) 11:27:55 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x0, 0x700, 0x0}) 11:27:55 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x18, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e"], 0x0, 0x0, 0x0}) 11:27:55 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, 0x0) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) 11:27:55 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\xff\xff\xff\xfe\x00'}, 0x45c) 11:27:55 executing program 4: ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r0 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r0, 0xc0505350, &(0x7f0000000500)={{0xfffffffffffffffc, 0x80000000}, {0x3f, 0x8}, 0x2392, 0x5, 0x400}) r1 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r1, 0x1000000000013) [ 2264.828481][T19358] input: syz0 as /devices/virtual/input/input2819 [ 2264.860824][T19363] input: syz0 as /devices/virtual/input/input2820 [ 2264.879377][T19368] binder: 19356:19368 unknown command -8196 [ 2264.904504][T19368] binder: 19356:19368 ioctl c0306201 200002c0 returned -22 11:27:55 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) 11:27:55 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x18, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e"], 0x0, 0x0, 0x0}) [ 2264.947185][T19440] input: syz0 as /devices/virtual/input/input2821 11:27:55 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x0, 0xa00, 0x0}) 11:27:55 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\xfe\xff\xff\xff\x00'}, 0x45c) [ 2265.082007][T19481] input: syz0 as /devices/virtual/input/input2822 [ 2265.112424][T19483] binder: 19480:19483 unknown command -8196 11:27:55 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) [ 2265.151461][T19483] binder: 19480:19483 ioctl c0306201 200002c0 returned -22 11:27:55 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x18, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e"], 0x0, 0x0, 0x0}) [ 2265.209060][T19489] binder: 19487:19489 got reply transaction with bad transaction stack, transaction 2896 has target 19480:0 [ 2265.220672][T19576] binder: send failed reply for transaction 2896 to 19487:19489 [ 2265.246795][T19489] binder: 19487:19489 transaction failed 29201/-71, size 0-0 line 2915 [ 2265.276658][T19489] binder: 19487:19489 transaction failed 29189/-22, size 0-0 line 2995 [ 2265.303699][T19488] input: syz0 as /devices/virtual/input/input2823 [ 2265.332390][T19503] binder: 19495:19503 unknown command -8196 [ 2265.344528][T19503] binder: 19495:19503 ioctl c0306201 200002c0 returned -22 [ 2265.357378][T19533] input: syz0 as /devices/virtual/input/input2825 [ 2265.374754][T19499] input: syz0 as /devices/virtual/input/input2824 11:27:56 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r1, 0xc02c5341, &(0x7f0000000280)={0x0, 0x0, 0x0, 'queue1\x00', 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff00000000]}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) 11:27:56 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x0, 0x3f00, 0x0}) 11:27:56 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1a, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14"], 0x0, 0x0, 0x0}) 11:27:56 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) 11:27:56 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x01\x00'}, 0x45c) 11:27:56 executing program 4: ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r0 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r0, 0xc0505350, &(0x7f0000000500)={{0xfffffffffffffffc, 0x80000000}, {0x3f, 0x8}, 0x2392, 0x5, 0x400}) r1 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r1, 0x1000000000013) [ 2265.792361][T19619] input: syz0 as /devices/virtual/input/input2826 [ 2265.799805][T19624] binder: 19616:19624 unknown command -8196 [ 2265.805722][T19624] binder: 19616:19624 ioctl c0306201 200002c0 returned -22 [ 2265.849298][T19625] input: syz0 as /devices/virtual/input/input2827 11:27:56 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1a, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14"], 0x0, 0x0, 0x0}) [ 2265.896584][T19674] input: syz0 as /devices/virtual/input/input2828 11:27:56 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x0, 0x4800, 0x0}) 11:27:56 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x0) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) 11:27:56 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x02\x00'}, 0x45c) [ 2266.097980][T19741] binder: 19736:19741 unknown command -8196 [ 2266.118701][T19741] binder: 19736:19741 ioctl c0306201 200002c0 returned -22 [ 2266.138735][T19770] input: syz0 as /devices/virtual/input/input2829 [ 2266.146649][T19768] input: syz0 as /devices/virtual/input/input2830 11:27:56 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1a, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14"], 0x0, 0x0, 0x0}) [ 2266.206129][T19840] input: syz0 as /devices/virtual/input/input2831 11:27:56 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x0) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) [ 2266.308954][T19860] binder: 19859:19860 unknown command -8196 [ 2266.334830][T19860] binder: 19859:19860 ioctl c0306201 200002c0 returned -22 [ 2266.385410][T21720] binder_thread_release: 7 callbacks suppressed [ 2266.385421][T21720] binder: release 19859:19860 transaction 2910 out, still active [ 2266.429817][T19865] input: syz0 as /devices/virtual/input/input2832 [ 2266.446991][T21720] binder_release_work: 12 callbacks suppressed [ 2266.447005][T21720] binder: undelivered TRANSACTION_COMPLETE [ 2266.461935][T21720] binder_send_failed_reply: 7 callbacks suppressed [ 2266.461942][T21720] binder: send failed reply for transaction 2910, target dead 11:27:57 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x03\x00'}, 0x45c) 11:27:57 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x0, 0x4c00, 0x0}) 11:27:57 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r1, 0xc02c5341, &(0x7f0000000280)={0x0, 0x0, 0x0, 'queue1\x00', 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe]}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) 11:27:57 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000180)="0adc1f123c123f319bd070") creat(&(0x7f0000000100)='./file0\x00', 0x0) r1 = open(&(0x7f0000000000)='.\x00', 0x0, 0x0) fchownat(r1, &(0x7f0000001440)='./file0\x00', 0x0, 0x0, 0x1000) 11:27:57 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x0) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) 11:27:57 executing program 4: socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r0 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r0, 0xc0505350, &(0x7f0000000500)={{0xfffffffffffffffc, 0x80000000}, {0x3f, 0x8}, 0x2392, 0x5, 0x400}) r1 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r1, 0x1000000000013) [ 2266.771648][T19882] binder_transaction: 4 callbacks suppressed [ 2266.771666][T19882] binder: 19874:19882 transaction failed 29189/-22, size 0-0 line 2995 [ 2266.788104][T21720] binder_release_work: 9 callbacks suppressed [ 2266.788111][T21720] binder: undelivered TRANSACTION_ERROR: 29189 [ 2266.807816][T19880] input: syz0 as /devices/virtual/input/input2833 [ 2266.816436][T19882] binder: 19874:19882 transaction failed 29189/-22, size 0-0 line 2995 11:27:57 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(0xffffffffffffffff, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) [ 2266.859782][T19883] input: syz0 as /devices/virtual/input/input2834 11:27:57 executing program 2: [ 2266.938893][T19970] input: syz0 as /devices/virtual/input/input2835 11:27:57 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x0, 0x6800, 0x0}) 11:27:57 executing program 2: [ 2267.015362][T21720] binder: undelivered TRANSACTION_ERROR: 29189 11:27:57 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(0xffffffffffffffff, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) 11:27:57 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x04\x00'}, 0x45c) 11:27:57 executing program 2: [ 2267.158944][T20009] binder: 20008:20009 transaction failed 29189/-22, size 0-0 line 2995 [ 2267.231812][T20027] input: syz0 as /devices/virtual/input/input2837 11:27:57 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(0xffffffffffffffff, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) [ 2267.275378][T20080] input: syz0 as /devices/virtual/input/input2839 [ 2267.389785][T21720] binder: undelivered TRANSACTION_ERROR: 29189 11:27:58 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r1, 0xc02c5341, &(0x7f0000000280)={0x0, 0x0, 0x0, 'queue1\x00', 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe00]}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) 11:27:58 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x05\x00'}, 0x45c) 11:27:58 executing program 2: 11:27:58 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x0, 0x6c00, 0x0}) 11:27:58 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, 0x0, 0x0) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) 11:27:58 executing program 4: socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r0 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r0, 0xc0505350, &(0x7f0000000500)={{0xfffffffffffffffc, 0x80000000}, {0x3f, 0x8}, 0x2392, 0x5, 0x400}) r1 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r1, 0x1000000000013) [ 2267.772548][T20142] binder: 20133:20142 transaction failed 29189/-22, size 0-0 line 2995 [ 2267.787177][T20141] input: syz0 as /devices/virtual/input/input2842 11:27:58 executing program 2: [ 2267.823048][T19576] binder: undelivered TRANSACTION_ERROR: 29189 [ 2267.830662][T20142] binder: 20133:20142 transaction failed 29189/-22, size 0-0 line 2995 11:27:58 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, 0x0, 0x0) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) [ 2267.868779][T20141] input: syz0 as /devices/virtual/input/input2843 11:27:58 executing program 2: 11:27:58 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x11\x00'}, 0x45c) 11:27:58 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, 0x0, 0x0) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) 11:27:58 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x0, 0x7400, 0x0}) [ 2268.087047][T21720] binder: undelivered TRANSACTION_ERROR: 29189 [ 2268.131822][T20268] input: syz0 as /devices/virtual/input/input2845 [ 2268.165921][T20273] binder: 20272:20273 transaction failed 29189/-22, size 0-0 line 2995 [ 2268.201359][T20275] input: syz0 as /devices/virtual/input/input2847 [ 2268.212446][T21720] binder: undelivered TRANSACTION_ERROR: 29189 [ 2268.241657][T20273] binder: 20272:20273 transaction failed 29189/-22, size 0-0 line 2995 [ 2268.341777][T21720] binder: undelivered TRANSACTION_ERROR: 29189 11:27:59 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r1, 0xc02c5341, &(0x7f0000000280)={0x0, 0x0, 0x0, 'queue1\x00', 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f00]}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) 11:27:59 executing program 2: r0 = socket$packet(0x11, 0x3, 0x300) sendmmsg(r0, &(0x7f0000009640)=[{{&(0x7f0000000080)=@nfc={0x27, 0x1}, 0x80, 0x0, 0x0, &(0x7f0000002780)=[{0x10, 0x1}], 0x10}}], 0x1, 0x0) 11:27:59 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00'}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) 11:27:59 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x12\x00'}, 0x45c) 11:27:59 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x0, 0x7a00, 0x0}) 11:27:59 executing program 4: socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r0 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r0, 0xc0505350, &(0x7f0000000500)={{0xfffffffffffffffc, 0x80000000}, {0x3f, 0x8}, 0x2392, 0x5, 0x400}) r1 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r1, 0x1000000000013) [ 2268.796892][T20391] binder: 20387:20391 transaction failed 29189/-22, size 0-0 line 2995 [ 2268.822760][T20393] input: syz0 as /devices/virtual/input/input2848 [ 2268.832020][T20394] input: syz0 as /devices/virtual/input/input2849 11:27:59 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup\x00\x00\x00\x00\x00\xdb\x88yt\xa9\xd4\xb8\x04\x9e f\x06\xa8\b\xfc\xfe=\xd3\x12\x91\xf7\x86\xce\xe9*.\xd9\xcc\x0e\xeb\x0fn\x1b!p\x05W\xd7\xd3!\xc6\x16\xf2\xa6\x9f\x97^]X\ah1\x03\xcfHQo\xd9`c`1\x93\xe1\xcc1\t\xac\x8e\xeb4\x89\xd6\xa5\xd8n\xeao\xc6j\xdcl\x927\x8dI', 0x200002, 0x0) fchdir(r1) r2 = open(&(0x7f00000000c0)='./file0\x00', 0x0, 0x0) fadvise64(r2, 0x0, 0x3e56, 0x4) 11:27:59 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00'}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) [ 2268.931872][T20463] input: syz0 as /devices/virtual/input/input2850 11:27:59 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x14\x00'}, 0x45c) 11:27:59 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x0, 0x1000000, 0x0}) [ 2269.048898][T20514] input: syz0 as /devices/virtual/input/input2851 [ 2269.071810][T21720] binder: undelivered TRANSACTION_ERROR: 29189 [ 2269.117262][T20521] input: syz0 as /devices/virtual/input/input2852 11:27:59 executing program 2: r0 = syz_open_dev$video(&(0x7f00000000c0)='/dev/video#\x00', 0x8447, 0x0) ioctl$VIDIOC_ENUM_FRAMESIZES(r0, 0xc02c564a, &(0x7f0000000000)={0x0, 0x33424752}) 11:27:59 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00'}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) [ 2269.168110][T20525] binder: 20523:20525 transaction failed 29189/-22, size 0-0 line 2995 [ 2269.200767][T20526] input: syz0 as /devices/virtual/input/input2853 [ 2269.330939][T20616] input: syz0 as /devices/virtual/input/input2854 [ 2269.385720][T21720] binder: undelivered TRANSACTION_ERROR: 29189 11:28:00 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r1, 0xc02c5341, &(0x7f0000000280)={0x0, 0x0, 0x0, 'queue1\x00', 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe000000]}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) 11:28:00 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x15\x00'}, 0x45c) 11:28:00 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) read$FUSE(r0, &(0x7f00000040c0), 0x1000) 11:28:00 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x0, 0x2000000, 0x0}) 11:28:00 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(0xffffffffffffffff, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) 11:28:00 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x0, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r1, 0xc0505350, &(0x7f0000000500)={{0xfffffffffffffffc, 0x80000000}, {0x3f, 0x8}, 0x2392, 0x5, 0x400}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) [ 2269.808291][T20649] input: syz0 as /devices/virtual/input/input2856 [ 2269.828865][T20651] binder: 20644:20651 transaction failed 29189/-22, size 0-0 line 2995 11:28:00 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(0xffffffffffffffff, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) [ 2269.860677][T20656] input: syz0 as /devices/virtual/input/input2857 11:28:00 executing program 2: ioctl$BLKIOOPT(0xffffffffffffffff, 0x1279, 0x0) r0 = syz_open_dev$vcsa(&(0x7f0000000440)='/dev/vcsa#\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, 0x0, 0xfffffdf4) pidfd_send_signal(r0, 0x0, &(0x7f0000000000)={0x0, 0xcd80000000000000, 0x7}, 0x0) r1 = openat$cgroup_ro(r0, &(0x7f0000000480)='/group.stat\x00<#\xfbW*xZ\xd1\x88\xa7\xe1\xc8\x88u\xe0[\x18\xa4\xcb:\x9c\xd1-\xce\xa4@\xd8\x99\xc2,e+:G\x1bJ\x7f\xa2\xf3\xfd\xf6\xe04\xd8\x04\xe5\xf0\xdfK\x1d\xeeH;\x15]$\xc5\x9c\x01\x00\xe8\x9ej5|\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\xd1u\x1f>D\xdaC\xc0\xed\x973o8\xd6\xc6z\xde\xa2\x1d\xb4\x90\xc69ry\xe2\x9fNT\xe0\xc8:{++\xa6!\xabL\x00\x83\x1c\xd13\x13+8P\xe7\xa6\xc2\t\x18\xae:2\x9a\xc9\x8e\xe2\xee2E\x84\xb4M-\x14\x81Z\xd8{~\xb5h\xba\x8b\xf5\xb9\x1a5\x05\x83D\xbf\x1c|\x95P\x92^\x1d\xef\x7fDeg\xc5D', 0x2761, 0x0) write$cgroup_int(r1, &(0x7f0000000080), 0x297ef) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) 11:28:00 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x16\x00'}, 0x45c) 11:28:00 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(0xffffffffffffffff, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) 11:28:00 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x0, 0x3000000, 0x0}) [ 2270.112462][T20775] input: syz0 as /devices/virtual/input/input2859 [ 2270.126696][T19576] binder: undelivered TRANSACTION_ERROR: 29189 11:28:00 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) [ 2270.235037][T20780] input: syz0 as /devices/virtual/input/input2861 [ 2270.315645][T20792] input: syz0 as /devices/virtual/input/input2862 11:28:01 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r1, 0xc02c5341, &(0x7f0000000280)={0x0, 0x0, 0x0, 'queue1\x00', 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f000000]}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) 11:28:01 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x1f\x00'}, 0x45c) 11:28:01 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) 11:28:01 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x0, 0x4000000, 0x0}) 11:28:01 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x0, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r1, 0xc0505350, &(0x7f0000000500)={{0xfffffffffffffffc, 0x80000000}, {0x3f, 0x8}, 0x2392, 0x5, 0x400}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) 11:28:01 executing program 2: ioctl$BLKIOOPT(0xffffffffffffffff, 0x1279, 0x0) r0 = syz_open_dev$vcsa(&(0x7f0000000440)='/dev/vcsa#\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, 0x0, 0xfffffdf4) pidfd_send_signal(r0, 0x0, &(0x7f0000000000)={0x0, 0xcd80000000000000, 0x7}, 0x0) r1 = openat$cgroup_ro(r0, &(0x7f0000000480)='/group.stat\x00<#\xfbW*xZ\xd1\x88\xa7\xe1\xc8\x88u\xe0[\x18\xa4\xcb:\x9c\xd1-\xce\xa4@\xd8\x99\xc2,e+:G\x1bJ\x7f\xa2\xf3\xfd\xf6\xe04\xd8\x04\xe5\xf0\xdfK\x1d\xeeH;\x15]$\xc5\x9c\x01\x00\xe8\x9ej5|\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\xd1u\x1f>D\xdaC\xc0\xed\x973o8\xd6\xc6z\xde\xa2\x1d\xb4\x90\xc69ry\xe2\x9fNT\xe0\xc8:{++\xa6!\xabL\x00\x83\x1c\xd13\x13+8P\xe7\xa6\xc2\t\x18\xae:2\x9a\xc9\x8e\xe2\xee2E\x84\xb4M-\x14\x81Z\xd8{~\xb5h\xba\x8b\xf5\xb9\x1a5\x05\x83D\xbf\x1c|\x95P\x92^\x1d\xef\x7fDeg\xc5D', 0x2761, 0x0) write$cgroup_int(r1, &(0x7f0000000080), 0x297ef) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) [ 2270.778376][T20906] input: syz0 as /devices/virtual/input/input2863 [ 2270.801912][T20907] input: syz0 as /devices/virtual/input/input2864 11:28:01 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x0, 0x5000000, 0x0}) 11:28:01 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) [ 2270.918864][T20906] input: syz0 as /devices/virtual/input/input2865 11:28:01 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00/\x00'}, 0x45c) [ 2271.035749][T21054] input: syz0 as /devices/virtual/input/input2866 11:28:01 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x0, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) [ 2271.137091][T21137] input: syz0 as /devices/virtual/input/input2867 11:28:01 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x0, 0x6000000, 0x0}) [ 2271.218232][T21140] input: syz0 as /devices/virtual/input/input2868 [ 2271.236558][T21142] input: syz0 as /devices/virtual/input/input2869 11:28:01 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x0, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) [ 2271.402624][T21189] input: syz0 as /devices/virtual/input/input2870 11:28:01 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r1, 0xc02c5341, &(0x7f0000000280)={0x0, 0x0, 0x0, 'queue1\x00', 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfeffffff]}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) 11:28:01 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00?\x00'}, 0x45c) 11:28:01 executing program 2: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) 11:28:01 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x0, 0x7000000, 0x0}) 11:28:01 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x0, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) 11:28:01 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x0, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r1, 0xc0505350, &(0x7f0000000500)={{0xfffffffffffffffc, 0x80000000}, {0x3f, 0x8}, 0x2392, 0x5, 0x400}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) [ 2271.701299][T21263] input: syz0 as /devices/virtual/input/input2871 [ 2271.708210][T21261] input: syz0 as /devices/virtual/input/input2873 [ 2271.759441][T21266] input: syz0 as /devices/virtual/input/input2872 11:28:02 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x0, 0xa000000, 0x0}) 11:28:02 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, 0x0) write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) 11:28:02 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x00\xff\xff\xff\xfe\x00'}, 0x45c) [ 2271.855025][T21720] binder_release_work: 9 callbacks suppressed [ 2271.855033][T21720] binder: undelivered TRANSACTION_ERROR: 29189 11:28:02 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x7400, 0x0, 0x0}) [ 2271.921292][T21388] binder_transaction: 10 callbacks suppressed [ 2271.921307][T21388] binder: 21387:21388 transaction failed 29189/-22, size 0-0 line 2995 [ 2271.960517][T21391] input: syz0 as /devices/virtual/input/input2875 [ 2272.014205][T21393] input: syz0 as /devices/virtual/input/input2876 11:28:02 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, 0x0) write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) [ 2272.074243][T21495] binder: 21472:21495 transaction failed 29189/-22, size 0-0 line 2995 11:28:02 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x0, 0x3f000000, 0x0}) [ 2272.121135][T21720] binder: undelivered TRANSACTION_ERROR: 29189 [ 2272.133631][T21495] binder: 21472:21495 ioctl c0306201 200002c0 returned -14 [ 2272.178988][T19576] binder: undelivered TRANSACTION_ERROR: 29189 [ 2272.180639][T21511] binder: 21510:21511 transaction failed 29189/-22, size 0-0 line 2995 [ 2272.204625][T21513] input: syz0 as /devices/virtual/input/input2877 [ 2272.254206][T21522] input: syz0 as /devices/virtual/input/input2878 [ 2272.413708][T21720] binder: undelivered TRANSACTION_ERROR: 29189 11:28:02 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r1, 0xc02c5341, &(0x7f0000000280)={0x0, 0x0, 0x0, 'queue1\x00', 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe]}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) 11:28:02 executing program 2: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x05\x00\xfa\xff\xff\xff\x00'}, 0x45c) 11:28:02 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, 0x0) write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) 11:28:02 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x0, 0x48000000, 0x0}) 11:28:02 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x02\x00'}, 0x45c) 11:28:02 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r1, 0xc0505350, &(0x7f0000000500)={{0xfffffffffffffffc, 0x80000000}, {0x3f, 0x8}, 0x2392, 0x5, 0x400}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) [ 2272.653836][T21627] input: syz0 as /devices/virtual/input/input2880 [ 2272.684837][T21638] input: syz0 as /devices/virtual/input/input2881 [ 2272.696517][T21637] binder: 21634:21637 transaction failed 29189/-22, size 0-0 line 2995 [ 2272.730405][T21630] input: syz0 as /devices/virtual/input/input2879 11:28:03 executing program 2 (fault-call:5 fault-nth:0): r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) [ 2272.787112][T21644] input: syz0 as /devices/virtual/input/input2882 11:28:03 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)) write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) 11:28:03 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x03\x00'}, 0x45c) 11:28:03 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x0, 0x4c000000, 0x0}) [ 2272.930586][T21720] binder: undelivered TRANSACTION_ERROR: 29189 [ 2272.930651][T21758] binder: 21757:21758 unknown command -8196 [ 2272.953163][T21762] input: syz0 as /devices/virtual/input/input2883 [ 2272.998523][T21766] input: syz0 as /devices/virtual/input/input2884 [ 2273.012226][T21758] binder: 21757:21758 ioctl c0306201 200002c0 returned -22 [ 2273.029300][T21770] binder: 21768:21770 got reply transaction with bad transaction stack, transaction 2937 has target 21757:0 [ 2273.049787][T19576] binder: release 21757:21758 transaction 2936 out, still active [ 2273.056953][T21770] binder: 21768:21770 transaction failed 29201/-71, size 0-0 line 2915 [ 2273.074287][T19576] binder: undelivered TRANSACTION_COMPLETE 11:28:03 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) [ 2273.105257][T19576] binder: release 21768:21770 transaction 2937 out, still active [ 2273.115224][T21769] input: syz0 as /devices/virtual/input/input2885 [ 2273.129613][T19576] binder: undelivered TRANSACTION_COMPLETE [ 2273.141412][T19576] binder: undelivered TRANSACTION_ERROR: 29201 [ 2273.162838][T19576] binder: send failed reply for transaction 2936, target dead [ 2273.183963][T19576] binder: send failed reply for transaction 2937, target dead [ 2273.200111][T19576] binder: send failed reply for transaction 2939 to 21768:21770 11:28:03 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)) write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) [ 2273.227936][T21874] binder: 21854:21874 unknown command -8196 [ 2273.273676][T21874] binder: 21854:21874 ioctl c0306201 200002c0 returned -22 [ 2273.277006][T19576] binder: undelivered TRANSACTION_COMPLETE [ 2273.295708][T21879] input: syz0 as /devices/virtual/input/input2886 [ 2273.309844][T19576] binder: undelivered TRANSACTION_ERROR: 29189 [ 2273.329541][T19576] binder: release 21854:21874 transaction 2941 out, still active [ 2273.347030][T19576] binder: undelivered TRANSACTION_COMPLETE [ 2273.376008][T19576] binder: send failed reply for transaction 2941, target dead 11:28:03 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r1, 0xc02c5341, &(0x7f0000000280)={0x0, 0x0, 0x0, 'queue1\x00', 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe00000000000000]}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) 11:28:03 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x04\x00'}, 0x45c) 11:28:03 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x0, 0x68000000, 0x0}) 11:28:03 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)) write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) 11:28:03 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0x2, &(0x7f00000002c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) 11:28:03 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r1, 0xc0505350, &(0x7f0000000500)={{0xfffffffffffffffc, 0x80000000}, {0x3f, 0x8}, 0x2392, 0x5, 0x400}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) [ 2273.576390][T21896] input: syz0 as /devices/virtual/input/input2887 [ 2273.597669][T21893] input: syz0 as /devices/virtual/input/input2888 [ 2273.598722][T21899] binder: 21889:21899 transaction failed 29189/-22, size 0-0 line 2995 [ 2273.618312][T19576] binder: release 21890:21900 transaction 2944 out, still active [ 2273.632225][T19576] binder: undelivered TRANSACTION_COMPLETE [ 2273.654398][T21905] input: syz0 as /devices/virtual/input/input2889 11:28:04 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0x10, &(0x7f00000002c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) [ 2273.691338][T19576] binder: release 21890:21906 transaction 2945 out, still active [ 2273.716393][T19576] binder: undelivered TRANSACTION_COMPLETE [ 2273.725310][T19576] binder: send failed reply for transaction 2944, target dead 11:28:04 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x05\x00'}, 0x45c) [ 2273.745077][T19576] binder: send failed reply for transaction 2945, target dead 11:28:04 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c12") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) 11:28:04 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x0, 0x6c000000, 0x0}) [ 2273.821583][T22021] binder: 22000:22021 ioctl 10 200002c0 returned -22 [ 2273.833313][T21720] binder: undelivered TRANSACTION_ERROR: 29189 [ 2273.854433][T21720] binder: release 22000:22021 transaction 2947 out, still active [ 2273.864282][T22021] binder: BINDER_SET_CONTEXT_MGR already set [ 2273.875730][T21720] binder: undelivered TRANSACTION_COMPLETE [ 2273.902119][T22021] binder: 22000:22021 ioctl 40046207 0 returned -16 [ 2273.914564][T21720] binder: send failed reply for transaction 2947, target dead [ 2273.924667][T22028] input: syz0 as /devices/virtual/input/input2891 [ 2273.935072][T22025] input: syz0 as /devices/virtual/input/input2890 [ 2273.942721][T22024] binder: 22000:22024 transaction failed 29189/-22, size 0-0 line 2995 [ 2273.962894][T22033] binder: 22032:22033 transaction failed 29189/-22, size 0-0 line 2995 [ 2274.002857][T21720] binder: undelivered TRANSACTION_ERROR: 29189 11:28:04 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0x4b47, &(0x7f00000002c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) 11:28:04 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c12") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) [ 2274.050381][T22025] input: syz0 as /devices/virtual/input/input2892 [ 2274.134559][T22126] binder: 22107:22126 ioctl 4b47 200002c0 returned -22 [ 2274.171807][T21720] binder: release 22107:22126 transaction 2951 out, still active [ 2274.183156][T22142] binder: BINDER_SET_CONTEXT_MGR already set [ 2274.188149][T21720] binder: undelivered TRANSACTION_COMPLETE [ 2274.201196][T22142] binder: 22107:22142 ioctl 40046207 0 returned -16 [ 2274.211844][T21720] binder: undelivered TRANSACTION_ERROR: 29189 [ 2274.222833][T21720] binder: release 22107:22143 transaction 2952 out, still active [ 2274.234116][T22144] input: syz0 as /devices/virtual/input/input2893 [ 2274.254656][T21720] binder: undelivered TRANSACTION_COMPLETE [ 2274.297865][T19576] binder: send failed reply for transaction 2951, target dead [ 2274.305977][T19576] binder: send failed reply for transaction 2952, target dead 11:28:04 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x0, 0x74000000, 0x0}) 11:28:04 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x11\x00'}, 0x45c) 11:28:04 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r1, 0xc02c5341, &(0x7f0000000280)={0x0, 0x0, 0x0, 'queue1\x00', 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f00000000000000]}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) 11:28:04 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0x4b49, &(0x7f00000002c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) 11:28:04 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r1, 0xc0505350, &(0x7f0000000500)={{0xfffffffffffffffc, 0x80000000}, {0x3f, 0x8}, 0x2392, 0x5, 0x400}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) 11:28:04 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c12") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) [ 2274.534848][T22158] input: syz0 as /devices/virtual/input/input2894 [ 2274.549636][T22159] input: syz0 as /devices/virtual/input/input2895 [ 2274.565103][T22162] binder: 22161:22162 transaction failed 29189/-22, size 0-0 line 2995 [ 2274.567238][T22164] binder: 22153:22164 ioctl 4b49 200002c0 returned -22 11:28:04 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319b") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) [ 2274.636111][T22193] input: syz0 as /devices/virtual/input/input2896 [ 2274.657788][T21720] binder: release 22153:22164 transaction 2955 out, still active [ 2274.674194][T21720] binder: undelivered TRANSACTION_COMPLETE [ 2274.681781][T22164] binder: BINDER_SET_CONTEXT_MGR already set 11:28:05 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x12\x00'}, 0x45c) [ 2274.709309][T22164] binder: 22153:22164 ioctl 40046207 0 returned -16 [ 2274.709354][T21720] binder: send failed reply for transaction 2955, target dead [ 2274.709385][T22208] binder_alloc: 22153: binder_alloc_buf, no vma [ 2274.736052][T22237] input: syz0 as /devices/virtual/input/input2897 11:28:05 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x0, 0x7a000000, 0x0}) [ 2274.824347][T22208] binder: 22153:22208 transaction failed 29189/-3, size 0-0 line 3148 11:28:05 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319b") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) 11:28:05 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0x541b, &(0x7f00000002c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) [ 2274.880232][T22288] input: syz0 as /devices/virtual/input/input2898 [ 2274.960856][T22296] input: syz0 as /devices/virtual/input/input2899 [ 2274.994812][T22299] input: syz0 as /devices/virtual/input/input2900 [ 2275.016315][T22310] binder: 22298:22310 ioctl 541b 200002c0 returned -22 [ 2275.043080][T21720] binder: release 22298:22310 transaction 2960 out, still active 11:28:05 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x14\x00'}, 0x45c) [ 2275.064876][T22310] binder: BINDER_SET_CONTEXT_MGR already set [ 2275.084190][T21720] binder: send failed reply for transaction 2960, target dead [ 2275.093500][T22310] binder: 22298:22310 ioctl 40046207 0 returned -16 11:28:05 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319b") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) 11:28:05 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f00000002c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) [ 2275.183001][T22407] input: syz0 as /devices/virtual/input/input2901 [ 2275.288227][T22415] input: syz0 as /devices/virtual/input/input2902 [ 2275.319511][T22421] input: syz0 as /devices/virtual/input/input2903 11:28:05 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r1, 0xc02c5341, &(0x7f0000000280)={0x0, 0x0, 0x0, 'queue1\x00', 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfeffffff00000000]}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) 11:28:05 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x0, 0x100000000000000, 0x0}) 11:28:05 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0x5450, &(0x7f00000002c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) 11:28:05 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)) r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r1, 0xc0505350, &(0x7f0000000500)={{0xfffffffffffffffc, 0x80000000}, {0x3f, 0x8}, 0x2392, 0x5, 0x400}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) 11:28:05 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x15\x00'}, 0x45c) 11:28:05 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd0") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) [ 2275.556100][T22435] input: syz0 as /devices/virtual/input/input2904 [ 2275.583109][T22440] input: syz0 as /devices/virtual/input/input2905 11:28:05 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0x5451, &(0x7f00000002c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) 11:28:05 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x16\x00'}, 0x45c) 11:28:06 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x0, 0x200000000000000, 0x0}) 11:28:06 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd0") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) [ 2275.797322][T22563] binder: BINDER_SET_CONTEXT_MGR already set [ 2275.826358][T22564] input: syz0 as /devices/virtual/input/input2907 [ 2275.850218][T22563] binder: 22561:22563 ioctl 40046207 0 returned -16 [ 2275.854206][T22567] binder_alloc: 22561: binder_alloc_buf, no vma [ 2275.876488][T22573] input: syz0 as /devices/virtual/input/input2908 [ 2275.893472][T22571] input: syz0 as /devices/virtual/input/input2909 [ 2275.913312][T22568] binder_alloc: 22561: binder_alloc_buf, no vma 11:28:06 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00/\x00'}, 0x45c) 11:28:06 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0x5452, &(0x7f00000002c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) [ 2276.063685][T22682] input: syz0 as /devices/virtual/input/input2910 [ 2276.107267][T22684] input: syz0 as /devices/virtual/input/input2911 [ 2276.142436][T22687] binder: BINDER_SET_CONTEXT_MGR already set [ 2276.167639][T22687] binder: 22685:22687 ioctl 40046207 0 returned -16 11:28:06 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r1, 0xc02c5341, &(0x7f0000000280)={0x0, 0x0, 0x0, 'queue1\x00', 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff00000000]}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) 11:28:06 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd0") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) 11:28:06 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x0, 0x300000000000000, 0x0}) 11:28:06 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x03\x00'}, 0x45c) 11:28:06 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0x5460, &(0x7f00000002c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) 11:28:06 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)) r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r1, 0xc0505350, &(0x7f0000000500)={{0xfffffffffffffffc, 0x80000000}, {0x3f, 0x8}, 0x2392, 0x5, 0x400}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) [ 2276.518041][T22702] binder: 22699:22702 got reply transaction with bad transaction stack, transaction 2981 has target 22700:0 [ 2276.539480][T22689] binder: send failed reply for transaction 2981 to 22699:22702 [ 2276.546017][T22696] input: syz0 as /devices/virtual/input/input2912 [ 2276.570311][T22705] input: syz0 as /devices/virtual/input/input2913 11:28:06 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) 11:28:06 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0x40046205, &(0x7f00000002c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) [ 2276.631729][T21720] binder: send failed reply for transaction 2985 to 22699:22702 11:28:07 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x05\x00'}, 0x45c) [ 2276.700697][T22793] input: syz0 as /devices/virtual/input/input2915 11:28:07 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) 11:28:07 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x0, 0x400000000000000, 0x0}) 11:28:07 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0x40046207, &(0x7f00000002c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) [ 2276.854205][T22832] input: syz0 as /devices/virtual/input/input2916 [ 2276.913489][T22840] input: syz0 as /devices/virtual/input/input2918 [ 2276.919953][T22838] input: syz0 as /devices/virtual/input/input2917 [ 2276.927389][T21720] binder_release_work: 13 callbacks suppressed [ 2276.927397][T21720] binder: undelivered TRANSACTION_ERROR: 29189 [ 2276.945487][T22837] binder_transaction: 10 callbacks suppressed [ 2276.945502][T22837] binder: 22836:22837 transaction failed 29189/-22, size 0-0 line 2995 [ 2276.954694][T22843] binder: BINDER_SET_CONTEXT_MGR already set [ 2277.017995][T22843] binder: 22841:22843 ioctl 40046207 200002c0 returned -16 [ 2277.088599][T22909] binder: BINDER_SET_CONTEXT_MGR already set [ 2277.105970][T22843] binder: BINDER_SET_CONTEXT_MGR already set [ 2277.113656][T22909] binder: 22841:22909 ioctl 40046207 0 returned -16 [ 2277.120420][T22843] binder: 22841:22843 ioctl 40046207 200002c0 returned -16 [ 2277.145017][T22689] binder: undelivered TRANSACTION_ERROR: 29189 11:28:07 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x11\x00'}, 0x45c) 11:28:07 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) 11:28:07 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r1, 0xc02c5341, &(0x7f0000000280)={0x0, 0x0, 0x0, 'queue1\x00', 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe]}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) 11:28:07 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x0, 0x500000000000000, 0x0}) 11:28:07 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0x40046208, &(0x7f00000002c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) 11:28:07 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)) r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r1, 0xc0505350, &(0x7f0000000500)={{0xfffffffffffffffc, 0x80000000}, {0x3f, 0x8}, 0x2392, 0x5, 0x400}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) [ 2277.476115][T22956] input: syz0 as /devices/virtual/input/input2919 [ 2277.496611][T22960] binder: 22957:22960 transaction failed 29189/-22, size 0-0 line 2995 [ 2277.517006][T22965] input: syz0 as /devices/virtual/input/input2920 11:28:07 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, 0x0, 0x0) [ 2277.569918][T22996] input: syz0 as /devices/virtual/input/input2921 11:28:07 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0x40049409, &(0x7f00000002c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) 11:28:07 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x12\x00'}, 0x45c) [ 2277.728810][T23077] input: syz0 as /devices/virtual/input/input2922 11:28:08 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x0, 0x600000000000000, 0x0}) [ 2277.778709][T23087] input: syz0 as /devices/virtual/input/input2923 [ 2277.790007][T22689] binder: undelivered TRANSACTION_ERROR: 29189 11:28:08 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f00000002c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) [ 2277.845603][T23093] input: syz0 as /devices/virtual/input/input2924 11:28:08 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, 0x0, 0x0) [ 2277.918413][T23098] binder: 23097:23098 transaction failed 29189/-22, size 0-0 line 2995 [ 2277.937771][T23100] binder: 23099:23100 ioctl 40086602 200002c0 returned -22 11:28:08 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0x40087602, &(0x7f00000002c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) [ 2277.964561][T22689] binder: undelivered TRANSACTION_ERROR: 29189 [ 2277.972077][T23100] binder: BINDER_SET_CONTEXT_MGR already set [ 2277.983605][T23100] binder: 23099:23100 ioctl 40046207 0 returned -16 [ 2277.984968][T22689] binder: send failed reply for transaction 3006 to 23099:23100 [ 2277.992265][T23103] binder: 23099:23103 transaction failed 29189/-22, size 0-0 line 2995 [ 2277.999925][T23098] binder: 23097:23098 transaction failed 29189/-22, size 0-0 line 2995 11:28:08 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x14\x00'}, 0x45c) [ 2278.031803][T23109] input: syz0 as /devices/virtual/input/input2925 [ 2278.075162][T22689] binder: undelivered TRANSACTION_ERROR: 29189 [ 2278.101699][T23130] binder: 23120:23130 ioctl 40087602 200002c0 returned -22 [ 2278.115797][T22689] binder_release_work: 19 callbacks suppressed [ 2278.115802][T22689] binder: undelivered TRANSACTION_COMPLETE [ 2278.162223][T22689] binder: undelivered TRANSACTION_ERROR: 29189 [ 2278.173156][T23130] binder: BINDER_SET_CONTEXT_MGR already set [ 2278.184894][T23163] input: syz0 as /devices/virtual/input/input2926 [ 2278.212105][T23130] binder: 23120:23130 ioctl 40046207 0 returned -16 [ 2278.212187][T23197] binder_alloc: 23120: binder_alloc_buf, no vma [ 2278.226257][T22689] binder: send failed reply for transaction 3010 to 23120:23130 [ 2278.234462][T22689] binder: undelivered TRANSACTION_COMPLETE [ 2278.249033][T22689] binder: undelivered TRANSACTION_ERROR: 29189 [ 2278.265326][T23197] binder: 23120:23197 transaction failed 29189/-3, size 0-0 line 3148 [ 2278.291764][T22689] binder: undelivered TRANSACTION_ERROR: 29189 [ 2278.315942][T23215] input: syz0 as /devices/virtual/input/input2927 [ 2278.326464][T22689] binder: undelivered TRANSACTION_ERROR: 29189 11:28:08 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r1, 0xc02c5341, &(0x7f0000000280)={0x0, 0x0, 0x0, 'queue1\x00', 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe00]}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) 11:28:08 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, 0x0, 0x0) 11:28:08 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x0, 0x700000000000000, 0x0}) 11:28:08 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c12") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r1, 0xc0505350, &(0x7f0000000500)={{0xfffffffffffffffc, 0x80000000}, {0x3f, 0x8}, 0x2392, 0x5, 0x400}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) 11:28:08 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0x4018620d, &(0x7f00000002c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) 11:28:08 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x15\x00'}, 0x45c) [ 2278.463894][T23231] binder: 23227:23231 transaction failed 29189/-22, size 0-0 line 2995 [ 2278.487382][T21720] binder: undelivered TRANSACTION_ERROR: 29189 [ 2278.494520][T23231] binder: 23227:23231 transaction failed 29189/-22, size 0-0 line 2995 [ 2278.509504][T23234] input: syz0 as /devices/virtual/input/input2928 [ 2278.517501][T23240] input: syz0 as /devices/virtual/input/input2929 [ 2278.544482][T23242] binder: BINDER_SET_CONTEXT_MGR already set [ 2278.568436][T23242] binder: 23237:23242 ioctl 4018620d 200002c0 returned -16 11:28:08 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0x40046208, &(0x7f00000002c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) [ 2278.617577][T23271] input: syz0 as /devices/virtual/input/input2930 [ 2278.632263][T21720] binder_thread_release: 16 callbacks suppressed [ 2278.632274][T21720] binder: release 23237:23242 transaction 3015 out, still active 11:28:08 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x0, 0xa00000000000000, 0x0}) 11:28:09 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x16\x00'}, 0x45c) [ 2278.690463][T21720] binder: undelivered TRANSACTION_COMPLETE 11:28:09 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0x4020940d, &(0x7f00000002c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) [ 2278.738592][T21720] binder: release 23237:23352 transaction 3016 out, still active [ 2278.784321][T21720] binder: undelivered TRANSACTION_COMPLETE [ 2278.822088][T23363] input: syz0 as /devices/virtual/input/input2931 [ 2278.835789][T23361] binder: BINDER_SET_CONTEXT_MGR already set [ 2278.846494][T23361] binder: 23356:23361 ioctl 40046207 0 returned -16 [ 2278.853756][T23362] binder_alloc: 23237: binder_alloc_buf, no vma [ 2278.861611][T21720] binder_send_failed_reply: 16 callbacks suppressed [ 2278.861619][T21720] binder: send failed reply for transaction 3015, target dead [ 2278.870622][T23365] binder: BINDER_SET_CONTEXT_MGR already set [ 2278.881852][T23362] binder: 23357:23362 transaction failed 29189/-3, size 0-0 line 3148 [ 2278.891703][T23368] binder_alloc: 23360: binder_alloc_buf, no vma [ 2278.900596][T23365] binder: 23360:23365 ioctl 40046207 0 returned -16 [ 2278.912294][T23368] binder: 23356:23368 transaction failed 29189/-3, size 0-0 line 3148 [ 2278.916982][T21720] binder: send failed reply for transaction 3016, target dead [ 2278.922254][T23366] binder_alloc: 23360: binder_alloc_buf, no vma 11:28:09 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0x5451, &(0x7f00000002c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) 11:28:09 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0x80086601, &(0x7f00000002c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) [ 2278.951399][T21720] binder: send failed reply for transaction 3019 to 23360:23365 [ 2278.984608][T21720] binder: undelivered TRANSACTION_COMPLETE [ 2279.093721][T23476] binder: 23472:23476 ioctl 80086601 200002c0 returned -22 [ 2279.095338][T23475] binder: BINDER_SET_CONTEXT_MGR already set [ 2279.130543][T23475] binder: 23474:23475 ioctl 40046207 0 returned -16 [ 2279.130591][T22689] binder: release 23472:23476 transaction 3023 out, still active [ 2279.146460][T23476] binder: BINDER_SET_CONTEXT_MGR already set [ 2279.153323][T22689] binder: undelivered TRANSACTION_COMPLETE [ 2279.164150][T23476] binder: 23472:23476 ioctl 40046207 0 returned -16 [ 2279.173633][T22689] binder: send failed reply for transaction 3023, target dead 11:28:09 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r1, 0xc02c5341, &(0x7f0000000280)={0x0, 0x0, 0x0, 'queue1\x00', 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f00]}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) 11:28:09 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x1f\x00'}, 0x45c) 11:28:09 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x0, 0x3f00000000000000, 0x0}) 11:28:09 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0x5451, &(0x7f00000002c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) 11:28:09 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0x80087601, &(0x7f00000002c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) 11:28:09 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c12") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r1, 0xc0505350, &(0x7f0000000500)={{0xfffffffffffffffc, 0x80000000}, {0x3f, 0x8}, 0x2392, 0x5, 0x400}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) [ 2279.356034][T23492] binder: 23486:23492 ioctl 80087601 200002c0 returned -22 [ 2279.367152][T23494] binder: 23491:23494 got reply transaction with bad transaction stack, transaction 3028 has target 23486:0 [ 2279.378767][T23495] binder: BINDER_SET_CONTEXT_MGR already set [ 2279.378785][T23495] binder: 23489:23495 ioctl 40046207 0 returned -16 [ 2279.380439][T22689] binder: release 23489:23495 transaction 3030 out, still active [ 2279.403846][T23496] input: syz0 as /devices/virtual/input/input2933 11:28:09 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0x5451, &(0x7f00000002c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) [ 2279.430658][T23500] binder_alloc: 23486: binder_alloc_buf, no vma [ 2279.431594][T23492] binder: BINDER_SET_CONTEXT_MGR already set [ 2279.460500][T22689] binder: undelivered TRANSACTION_COMPLETE [ 2279.505647][T23552] input: syz0 as /devices/virtual/input/input2934 [ 2279.510063][T23492] binder: 23486:23492 ioctl 40046207 0 returned -16 [ 2279.513213][T23494] binder_alloc: 23486: binder_alloc_buf, no vma [ 2279.519179][T22689] binder: release 23491:23494 transaction 3028 out, still active [ 2279.544119][T23567] binder: BINDER_SET_CONTEXT_MGR already set [ 2279.552434][T22689] binder: undelivered TRANSACTION_COMPLETE [ 2279.563660][T23567] binder: 23554:23567 ioctl 40046207 0 returned -16 [ 2279.573979][T22689] binder: send failed reply for transaction 3027 to 23486:23492 11:28:09 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x0, 0x4800000000000000, 0x0}) 11:28:09 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0045878, &(0x7f00000002c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) [ 2279.600238][T22689] binder: send failed reply for transaction 3028, target dead [ 2279.636320][T22689] binder: send failed reply for transaction 3030, target dead [ 2279.644168][T22689] binder: undelivered TRANSACTION_COMPLETE 11:28:09 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00/\x00'}, 0x45c) 11:28:10 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0x4b47, &(0x7f00000002c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) [ 2279.782232][T21720] binder: release 23618:23657 transaction 3037 out, still active [ 2279.799641][T21720] binder: undelivered TRANSACTION_COMPLETE [ 2279.805991][T23687] input: syz0 as /devices/virtual/input/input2935 [ 2279.807857][T23657] binder: BINDER_SET_CONTEXT_MGR already set [ 2279.822474][T21720] binder: send failed reply for transaction 3037, target dead [ 2279.835197][T23657] binder: 23618:23657 ioctl 40046207 0 returned -16 [ 2279.854383][T23719] binder: 23703:23719 ioctl 4b47 200002c0 returned -22 [ 2279.874183][T23727] input: syz0 as /devices/virtual/input/input2936 11:28:10 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0045878, &(0x7f00000002c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) [ 2279.875123][T22689] binder: release 23703:23719 transaction 3040 out, still active [ 2279.962117][T21720] binder: send failed reply for transaction 3040, target dead [ 2279.996108][T22689] binder: release 23733:23734 transaction 3042 out, still active [ 2280.018066][T22689] binder: send failed reply for transaction 3042, target dead [ 2280.038698][T22689] binder: release 23733:23736 transaction 3044 out, still active [ 2280.078389][T22689] binder: send failed reply for transaction 3044, target dead 11:28:10 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r1, 0xc02c5341, &(0x7f0000000280)={0x0, 0x0, 0x0, 'queue1\x00', 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe000000]}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) 11:28:10 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x0, 0x4c00000000000000, 0x0}) 11:28:10 executing program 3 (fault-call:7 fault-nth:0): r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) 11:28:10 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00?\x00'}, 0x45c) 11:28:10 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0046209, &(0x7f00000002c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) 11:28:10 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c12") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r1, 0xc0505350, &(0x7f0000000500)={{0xfffffffffffffffc, 0x80000000}, {0x3f, 0x8}, 0x2392, 0x5, 0x400}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) [ 2280.365985][T23749] input: syz0 as /devices/virtual/input/input2937 [ 2280.374053][T23754] input: syz0 as /devices/virtual/input/input2938 [ 2280.399914][T22689] binder: release 23743:23771 transaction 3048 out, still active [ 2280.415585][T22689] binder: send failed reply for transaction 3048, target dead 11:28:10 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc018620b, &(0x7f00000002c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) [ 2280.468388][T23857] input: syz0 as /devices/virtual/input/input2939 11:28:10 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x0, 0x6800000000000000, 0x0}) 11:28:10 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) 11:28:10 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x00\x01\x00'}, 0x45c) [ 2280.650070][T23892] input: syz0 as /devices/virtual/input/input2940 [ 2280.670359][T23898] input: syz0 as /devices/virtual/input/input2941 11:28:11 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000002c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) 11:28:11 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x00\x02\x00'}, 0x45c) [ 2280.839909][T23991] binder: 23989 BINDER_GET_NODE_INFO_FOR_REF: only handle may be non-zero. [ 2280.839922][T23991] binder: 23989:23991 ioctl c018620c 200002c0 returned -22 [ 2280.879568][T23995] input: syz0 as /devices/virtual/input/input2943 11:28:11 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r1, 0xc02c5341, &(0x7f0000000280)={0x0, 0x0, 0x0, 'queue1\x00', 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f000000]}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) 11:28:11 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz\\\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) 11:28:11 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x0, 0x6c00000000000000, 0x0}) 11:28:11 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0189436, &(0x7f00000002c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) 11:28:11 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x00\x03\x00'}, 0x45c) 11:28:11 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319b") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r1, 0xc0505350, &(0x7f0000000500)={{0xfffffffffffffffc, 0x80000000}, {0x3f, 0x8}, 0x2392, 0x5, 0x400}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) [ 2281.305781][T24014] input: syz0 as /devices/virtual/input/input2945 [ 2281.321767][T24017] input: syz0 as /devices/virtual/input/input2946 11:28:11 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc020660b, &(0x7f00000002c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) 11:28:11 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x0, 0x7400000000000000, 0x0}) [ 2281.386876][T24113] input: syz0 as /devices/virtual/input/input2947 [ 2281.419489][T24126] input: syz0 as /devices/virtual/input/input2948 11:28:11 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x00\x04\x00'}, 0x45c) 11:28:11 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) 11:28:11 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306202, &(0x7f00000002c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) [ 2281.658567][T24217] input: syz0 as /devices/virtual/input/input2949 11:28:12 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x0, 0x7a00000000000000, 0x0}) [ 2281.705235][T24245] input: syz0 as /devices/virtual/input/input2950 [ 2281.726579][T24247] input: syz0 as /devices/virtual/input/input2951 [ 2281.739298][T24249] binder: 24244:24249 ioctl c0306202 200002c0 returned -22 [ 2281.795416][T24250] input: syz0 as /devices/virtual/input/input2952 [ 2281.807813][T24253] binder: BINDER_SET_CONTEXT_MGR already set [ 2281.834285][T24257] binder: 24254:24257 got reply transaction with bad transaction stack, transaction 3076 has target 24244:0 [ 2281.853177][T24253] binder: 24244:24253 ioctl 40046207 0 returned -16 [ 2281.901975][T22689] binder: send failed reply for transaction 3078 to 24254:24257 [ 2281.998367][T22689] binder_release_work: 24 callbacks suppressed [ 2281.998375][T22689] binder: undelivered TRANSACTION_ERROR: 29189 11:28:12 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r1, 0xc02c5341, &(0x7f0000000280)={0x0, 0x0, 0x0, 'queue1\x00', 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfeffffff]}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) 11:28:12 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) 11:28:12 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306225, &(0x7f00000002c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) 11:28:12 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x00\x05\x00'}, 0x45c) 11:28:12 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063bd570000000000000000000000000000000000000000000000000000000000000000000000000006a0331c0c000000000000000000000000000000000000000000000000000002"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x0, 0x0, 0x0}) r1 = syz_open_dev$dspn(&(0x7f0000000080)='/dev/dsp#\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_GET_EVENT(r1, &(0x7f0000000240)={0xc, 0x8, 0xfa00, {&(0x7f00000000c0)}}, 0x10) 11:28:12 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319b") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r1, 0xc0505350, &(0x7f0000000500)={{0xfffffffffffffffc, 0x80000000}, {0x3f, 0x8}, 0x2392, 0x5, 0x400}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) [ 2282.162637][T24369] input: syz0 as /devices/virtual/input/input2954 [ 2282.180945][T24367] input: syz0 as /devices/virtual/input/input2953 [ 2282.187588][T24372] binder: 24365:24372 unknown command 1472029440 [ 2282.200580][T24377] binder: 24368:24377 ioctl c0306225 200002c0 returned -22 [ 2282.230071][T24372] binder: 24365:24372 ioctl c0306201 20000440 returned -22 [ 2282.237804][T24380] input: syz0 as /devices/virtual/input/input2955 [ 2282.254358][T24379] input: syz0 as /devices/virtual/input/input2956 11:28:12 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306241, &(0x7f00000002c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) 11:28:12 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x00\x11\x00'}, 0x45c) 11:28:12 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) 11:28:12 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/autofs\x00', 0x3, 0x0) ioctl$SNDRV_RAWMIDI_IOCTL_INFO(r1, 0x810c5701, &(0x7f0000000040)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x0, 0x0, 0x0}) ioctl$SIOCX25SCALLUSERDATA(r1, 0x89e5, &(0x7f0000000180)={0x7e, "ffcd1237eb820e577619b300d3a9bd09a89f38bcd5d29722e3c211cb2b63b32102ee51ddb10b732e3b090b2df80b5436ef0b3aa32765cef018fd29f728391784be6a5e6cc935f2f3b282a7238c70c805aa6c05c94d0d3f7509916c5ac26fef470fd213b83b132119df70d98cceef0d0879694ca0785fd3b841c3bf3c1d47ff99"}) [ 2282.491877][T24499] input: syz0 as /devices/virtual/input/input2957 [ 2282.498381][T24504] binder_transaction: 19 callbacks suppressed [ 2282.498397][T24504] binder: 24501:24504 transaction failed 29189/-22, size 0-0 line 2995 [ 2282.501970][T22689] binder: undelivered TRANSACTION_ERROR: 29189 [ 2282.526325][T24496] binder: 24495:24496 ioctl c0306241 200002c0 returned -22 [ 2282.555883][T24500] input: syz0 as /devices/virtual/input/input2958 [ 2282.565539][T22689] binder: send failed reply for transaction 3086 to 24501:24504 [ 2282.600972][T24499] input: syz0 as /devices/virtual/input/input2959 11:28:12 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306250, &(0x7f00000002c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) 11:28:12 executing program 0: r0 = syz_open_dev$dspn(&(0x7f0000000040)='/dev/dsp#\x00', 0x3, 0x8000) setsockopt$netrom_NETROM_T2(r0, 0x103, 0x2, &(0x7f0000000080)=0xff, 0x4) r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0xfffffffffffffed5, 0x0, &(0x7f0000000000)=[@increfs_done={0x40406301}], 0x0, 0x0, 0x0}) [ 2282.684502][T21720] binder: undelivered TRANSACTION_ERROR: 29189 [ 2282.720534][T24613] binder: 24612:24613 ioctl c0306250 200002c0 returned -22 11:28:13 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r1, 0xc02c5341, &(0x7f0000000280)={0x0, 0x0, 0x0, 'queue1\x00', 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe]}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) 11:28:13 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x05\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) 11:28:13 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x00\x12\x00'}, 0x45c) 11:28:13 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x0, 0x0, 0x0}) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x90141, 0x0) ioctl$sock_bt_cmtp_CMTPGETCONNLIST(r1, 0x800443d2, &(0x7f0000000080)={0x2, &(0x7f0000000040)=[{}, {}]}) 11:28:13 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x9, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) 11:28:13 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319b") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r1, 0xc0505350, &(0x7f0000000500)={{0xfffffffffffffffc, 0x80000000}, {0x3f, 0x8}, 0x2392, 0x5, 0x400}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) [ 2283.144385][T24727] input: syz0 as /devices/virtual/input/input2962 [ 2283.158443][T24728] input: syz0 as /devices/virtual/input/input2961 [ 2283.166052][T24736] binder: 24731:24736 transaction failed 29189/-22, size 0-0 line 2995 [ 2283.183057][T24738] binder: 24729:24738 unknown command -8196 [ 2283.206748][T24738] binder: 24729:24738 ioctl c0306201 200002c0 returned -22 [ 2283.220386][T24740] input: syz0 as /devices/virtual/input/input2963 [ 2283.234721][T24743] input: syz0 as /devices/virtual/input/input2964 [ 2283.264778][T21720] binder_release_work: 25 callbacks suppressed [ 2283.264783][T21720] binder: undelivered TRANSACTION_COMPLETE [ 2283.280574][T24772] binder: BINDER_SET_CONTEXT_MGR already set 11:28:13 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x11\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) 11:28:13 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x00\x14\x00'}, 0x45c) [ 2283.319898][T24772] binder: 24729:24772 ioctl 40046207 0 returned -16 [ 2283.320831][T21720] binder: undelivered TRANSACTION_COMPLETE 11:28:13 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x22, 0x0, &(0x7f0000000300), 0x398, 0x0, 0x0}) r1 = syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x401, 0x501600) ioctl$sock_inet_SIOCSIFBRDADDR(r1, 0x891a, &(0x7f0000000040)={'nlmon0\x00', {0x2, 0x4e20, @multicast2}}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x0, 0x0, 0x0}) 11:28:13 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x41, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) [ 2283.420410][T24857] input: syz0 as /devices/virtual/input/input2965 [ 2283.440091][T22689] binder: undelivered TRANSACTION_ERROR: 29189 [ 2283.446390][T24858] input: syz0 as /devices/virtual/input/input2966 [ 2283.499457][T24864] input: syz0 as /devices/virtual/input/input2967 [ 2283.556813][T24867] input: syz0 as /devices/virtual/input/input2968 [ 2283.570774][T24870] binder: 24869:24870 unknown command 0 [ 2283.603538][T24870] binder: 24869:24870 ioctl c0306201 20000440 returned -22 [ 2283.620600][T24872] binder: 24871:24872 unknown command -8196 11:28:13 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x00\x15\x00'}, 0x45c) 11:28:13 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) [ 2283.657235][T24872] binder: 24871:24872 ioctl c0306201 200002c0 returned -22 [ 2283.718046][T24934] input: syz0 as /devices/virtual/input/input2969 [ 2283.737183][T24950] input: syz0 as /devices/virtual/input/input2970 [ 2283.759279][T22689] binder_thread_release: 21 callbacks suppressed [ 2283.759289][T22689] binder: release 24871:24872 transaction 3099 out, still active [ 2283.771941][T24980] binder_alloc: 24871: binder_alloc_buf, no vma [ 2283.791604][T22689] binder: undelivered TRANSACTION_COMPLETE [ 2283.841039][T24980] binder: 24871:24980 transaction failed 29189/-3, size 0-0 line 3148 [ 2283.876377][T22689] binder: undelivered TRANSACTION_ERROR: 29189 11:28:14 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r1, 0xc02c5341, &(0x7f0000000280)={0x0, 0x0, 0x0, 'queue1\x00', 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe00000000000000]}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) 11:28:14 executing program 0: openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dlm-monitor\x00', 0x44701, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000f0000000000000000000000000400"/68], 0x0, 0x0, 0x0}) get_thread_area(&(0x7f0000000000)={0x3, 0x1000, 0x2000, 0x100000001, 0xcad, 0x8, 0x1, 0x3f, 0x9, 0x5602}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x0, 0x0, 0x0}) 11:28:14 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x14\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) 11:28:14 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x00\x16\x00'}, 0x45c) 11:28:14 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x50, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) 11:28:14 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd0") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r1, 0xc0505350, &(0x7f0000000500)={{0xfffffffffffffffc, 0x80000000}, {0x3f, 0x8}, 0x2392, 0x5, 0x400}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) [ 2284.135098][T24995] input: syz0 as /devices/virtual/input/input2973 [ 2284.155999][T25000] binder: 24996:25000 transaction failed 29189/-22, size 0-17179869184 line 2995 [ 2284.178573][T25005] input: syz0 as /devices/virtual/input/input2974 [ 2284.197115][T25008] binder: 25003:25008 unknown command -8196 [ 2284.225291][T25006] input: syz0 as /devices/virtual/input/input2975 11:28:14 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x00\x1f\x00'}, 0x45c) [ 2284.255564][T25008] binder: 25003:25008 ioctl c0306201 200002c0 returned -22 11:28:14 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x15\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) [ 2284.308934][T21720] binder: release 25003:25008 transaction 3104 out, still active 11:28:14 executing program 0: openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0x40800, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="006340040000000000000000000000002ef8fc1ad700e084d2a2c37891b06b00"/83], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x0, 0x0, 0x0}) [ 2284.353739][T25008] binder: BINDER_SET_CONTEXT_MGR already set [ 2284.359916][T21720] binder: undelivered TRANSACTION_COMPLETE [ 2284.380752][T21720] binder_send_failed_reply: 22 callbacks suppressed [ 2284.380758][T21720] binder: send failed reply for transaction 3104, target dead [ 2284.409519][T21720] binder: undelivered TRANSACTION_ERROR: 29189 [ 2284.417226][T25118] binder: 25003:25118 transaction failed 29189/-22, size 0-0 line 2995 [ 2284.427245][T25008] binder: 25003:25008 ioctl 40046207 0 returned -16 [ 2284.429704][T25122] input: syz0 as /devices/virtual/input/input2977 [ 2284.446365][T25126] input: syz0 as /devices/virtual/input/input2978 [ 2284.474207][T21720] binder: undelivered TRANSACTION_ERROR: 29189 11:28:14 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x63, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) [ 2284.525679][T25132] input: syz0 as /devices/virtual/input/input2979 [ 2284.537691][T25133] binder: 25130:25133 unknown command 71328512 [ 2284.553227][T25133] binder: 25130:25133 ioctl c0306201 20000440 returned -22 [ 2284.565099][T25133] binder: 25130:25133 got reply transaction with no transaction stack [ 2284.589153][T25131] input: syz0 as /devices/virtual/input/input2980 [ 2284.604178][T25133] binder: 25130:25133 transaction failed 29201/-71, size 0-0 line 2900 11:28:14 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x00/\x00'}, 0x45c) [ 2284.665189][T25138] binder: 25137:25138 unknown command -8196 [ 2284.665679][T22689] binder: undelivered TRANSACTION_ERROR: 29201 [ 2284.672846][T25138] binder: 25137:25138 ioctl c0306201 200002c0 returned -22 11:28:15 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x16\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) [ 2284.707516][T21720] binder: release 25137:25138 transaction 3108 out, still active [ 2284.723042][T25138] binder: BINDER_SET_CONTEXT_MGR already set [ 2284.723066][T25170] binder_alloc: 25137: binder_alloc_buf, no vma [ 2284.729276][T21720] binder: undelivered TRANSACTION_COMPLETE [ 2284.775545][T21720] binder: send failed reply for transaction 3108, target dead [ 2284.784738][T25138] binder: 25137:25138 ioctl 40046207 0 returned -16 [ 2284.809608][T25170] binder: 25137:25170 transaction failed 29189/-3, size 0-0 line 3148 [ 2284.810016][T25201] input: syz0 as /devices/virtual/input/input2981 [ 2284.827075][T25247] input: syz0 as /devices/virtual/input/input2982 [ 2284.858247][T21720] binder: undelivered TRANSACTION_ERROR: 29189 [ 2284.898218][T25250] input: syz0 as /devices/virtual/input/input2983 11:28:15 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r1, 0xc02c5341, &(0x7f0000000280)={0x0, 0x0, 0x0, 'queue1\x00', 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f00000000000000]}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) 11:28:15 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000096cbc1cf77f06dedab5200622a6a83c835f3af48eb429d30489d9c7d9f39187b06d7246d7cbfa5897ab9005a5e3908a16901434f410e0981c01d81bf59918b44789fa496b36b7e21680f747a49b1251552838e20ac2f224d3f2516d80b3a63a834f6ec987d15a7180b384f2665dab8fe7c288b91c4d80c8d7b0782ed996c8e558be3893c45"], 0x0, 0x0, 0x0}) syz_open_dev$mouse(&(0x7f0000000200)='/dev/input/mouse#\x00', 0xa9, 0x1) fsetxattr$security_selinux(r0, &(0x7f0000000040)='security.selinux\x00', &(0x7f0000000080)='system_u:object_r:console_device_t:s0\x00', 0x26, 0x1) ioctl$FIGETBSZ(r0, 0x2, &(0x7f00000001c0)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="97f65aa02f8201736a2e1ac5", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) 11:28:15 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x2, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) 11:28:15 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x00?\x00'}, 0x45c) 11:28:15 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd0") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r1, 0xc0505350, &(0x7f0000000500)={{0xfffffffffffffffc, 0x80000000}, {0x3f, 0x8}, 0x2392, 0x5, 0x400}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) 11:28:15 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0/\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) [ 2285.122210][T25264] binder: 25261:25264 transaction failed 29189/-22, size 0-0 line 2995 [ 2285.136774][T25267] binder: 25262:25267 unknown command -1 [ 2285.143633][T25266] input: syz0 as /devices/virtual/input/input2985 [ 2285.160976][T25267] binder: 25262:25267 ioctl c0306201 200002c0 returned -22 [ 2285.170501][T25270] input: syz0 as /devices/virtual/input/input2986 [ 2285.206904][T19542] binder: release 25262:25267 transaction 3112 out, still active [ 2285.222816][T19542] binder: undelivered TRANSACTION_COMPLETE [ 2285.230071][T25267] binder: BINDER_SET_CONTEXT_MGR already set [ 2285.232702][T25278] binder_alloc: 25262: binder_alloc_buf, no vma 11:28:15 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\xff\xff\xff\xfe\x00'}, 0x45c) [ 2285.257681][T25270] input: syz0 as /devices/virtual/input/input2988 [ 2285.258424][T25278] binder: 25262:25278 transaction failed 29189/-3, size 0-0 line 3148 [ 2285.285957][T25267] binder: 25262:25267 ioctl 40046207 0 returned -16 [ 2285.285963][T19542] binder: undelivered TRANSACTION_ERROR: 29189 [ 2285.286013][T19542] binder: send failed reply for transaction 3112, target dead [ 2285.325828][T19542] binder: send failed reply for transaction 3113 to 25261:25264 11:28:15 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x3, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) 11:28:15 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x100000219, 0x0, &(0x7f0000000100)=[@request_death={0x400c630e, 0x2, 0x4}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="01634040", @ANYRES64=0x0, @ANYBLOB="0000000000000004"], 0x0, 0x0, 0x0}) prctl$PR_SET_KEEPCAPS(0x8, 0x1) r1 = dup(r0) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f0000000000)={0x10001, 0x80, 0x10001, 0x3, 0x6}, 0x14) 11:28:15 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) [ 2285.395247][T19542] binder: undelivered TRANSACTION_COMPLETE [ 2285.462870][T25391] input: syz0 as /devices/virtual/input/input2989 [ 2285.507935][T25395] input: syz0 as /devices/virtual/input/input2990 [ 2285.517721][T25397] binder: 25396:25397 BC_REQUEST_DEATH_NOTIFICATION invalid ref 2 [ 2285.538350][T25399] binder: 25392:25399 unknown command -1 [ 2285.553780][T25397] binder: 25396:25397 unknown command 0 [ 2285.562989][T25401] input: syz0 as /devices/virtual/input/input2991 [ 2285.579785][T25397] binder: 25396:25397 ioctl c0306201 20000080 returned -22 [ 2285.589859][T25399] binder: 25392:25399 ioctl c0306201 200002c0 returned -22 [ 2285.600216][T21720] binder: release 25392:25399 transaction 3116 out, still active [ 2285.612023][T25420] binder: BINDER_SET_CONTEXT_MGR already set [ 2285.620660][T21720] binder: undelivered TRANSACTION_COMPLETE [ 2285.627725][T25404] input: syz0 as /devices/virtual/input/input2992 [ 2285.635897][T25421] binder_alloc: 25392: binder_alloc_buf, no vma [ 2285.642396][T21720] binder: send failed reply for transaction 3116, target dead [ 2285.654694][T25420] binder: 25392:25420 ioctl 40046207 0 returned -16 11:28:15 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x05\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) [ 2285.684868][T25399] binder: 25392:25399 unknown command -1 11:28:16 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\xfe\xff\xff\xff\x00'}, 0x45c) [ 2285.725687][T25399] binder: 25392:25399 ioctl c0306201 200002c0 returned -22 [ 2285.749431][T25421] binder: 25392:25421 transaction failed 29189/-3, size 0-0 line 3148 [ 2285.773108][T25510] input: syz0 as /devices/virtual/input/input2993 [ 2285.840535][T25515] input: syz0 as /devices/virtual/input/input2995 [ 2285.849304][T25513] input: syz0 as /devices/virtual/input/input2994 [ 2285.908873][T25520] input: syz0 as /devices/virtual/input/input2996 11:28:16 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r1, 0xc02c5341, &(0x7f0000000280)={0x0, 0x0, 0x0, 'queue1\x00', 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfeffffff00000000]}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) 11:28:16 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/mixer\x00', 0x200, 0x0) ioctl$TCSBRK(r1, 0x5409, 0xef63) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x0, 0x0, 0x0}) 11:28:16 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) 11:28:16 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x11\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) 11:28:16 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd0") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r1, 0xc0505350, &(0x7f0000000500)={{0xfffffffffffffffc, 0x80000000}, {0x3f, 0x8}, 0x2392, 0x5, 0x400}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) 11:28:16 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00'}, 0x45c) [ 2286.161075][T25533] input: syz0 as /devices/virtual/input/input2997 [ 2286.201833][T25562] input: syz0 as /devices/virtual/input/input2998 [ 2286.230179][T25563] binder: 25528:25563 unknown command -1 [ 2286.240610][T25575] input: syz0 as /devices/virtual/input/input2999 [ 2286.263966][T25563] binder: 25528:25563 ioctl c0306201 200002c0 returned -22 11:28:16 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x4000000000006) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="06630440030058ca"], 0xfffffffffffffe93, 0x0, 0x0}) r1 = syz_open_dev$vcsa(&(0x7f0000000080)='/dev/vcsa#\x00', 0x4800000000, 0xc100) msgget$private(0x0, 0x2000012) fstat(r1, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0}) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000140)={{{@in6=@mcast2, @in6=@mcast1, 0x4e24, 0x3, 0x4e21, 0x3, 0x2, 0x80, 0x20, 0x1d, 0x0, r2}, {0x20, 0x7, 0x3, 0x220dba34, 0x4, 0x4, 0x0, 0x9}, {0x1, 0x400, 0x80, 0x8}, 0x7, 0x6e6bbf, 0x2, 0x1, 0x2, 0x2}, {{@in=@local, 0x4d2, 0x32}, 0x0, @in6=@initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x34ff, 0x1, 0x0, 0x2f, 0x200, 0xffffffffffff0000, 0x4}}, 0xe8) ioctl$KVM_SET_XSAVE(r1, 0x5000aea5, &(0x7f0000000780)={"041983eac56caea2cc236866dbcecf13f1ecd2a365a44aed22f6fcc984a0faa1b880352c70ba603015057139b8892a84b801c9569ea3249291207536699c75fc95d8de5fd4d2da408bfe170de8253fa72687e03bcd50050b63ce62ceabfbef61f4f3d7754ab7d01fc3c268191c23c890f18eb3c20d4771d3ab0c09dca910e83487bffa45b333697747a623bc7cc5a345ab1056d297bbc19c68ca43e07893189360268bd4eec3259481abc133898a0b5c9b027a403c72b531d664013af3753fecf6af646bc43c4dc538a076a888ca1107cf21b8b1c1ddfc132e2cf3cbe260b88d0a11389e7deba1f2b36caa8cb6adf47f9953ea9c3cfb5e2b1d98b1991917442ce2ae2e57009f5125b55d9c5fe3f3ff8bf9443e9ac3d0a7124a011955fe58e3762cfd2521cacb7e03ec9e1f875a4878072e3387b8190a27ef85a1e9fb75fe895dfd1c76013068870316356bd09f8d0fa8a53b8f92a33e3ffe6b058a27eb6a7c5584e58af6c9b45a30a4f1481eaac43602eb76583467e10f499aab4f0fc111290e6488adc4bc52179aed46636a0a800e62d5bcdd60d07101e6271644adbb18c44af31a0868d76d44374649ade26e5b7ad549ece518259df39244ff0d83ddaab36b1660f4eab12f99ef99f0948172bcbbd432314bece4fc7c5b09628505f12e46a0552e4e46bf22542ac953d55962d355396bfe29582650fcf26ca621acb0b855bccb2d5c72354fb82c6197bdaee8981f473e4d0f403b420fbca8ae9d7c2e4d92d9a60f877c5dbe82ff2ef175fd4ee6d97bf5ca1fb189b4dd82ab35068a6dd0600bd449b02a86b9e248007a234dd323bfcf7de0a2cca23008921ce7f8b2a0083a14c1292654fe52e00c21d36b65f6bb7e6d415789f09a13a27c27a0baccbfa565ee8221a2c9eec811244f0be50899eb96e1102edf4c68e0e4a8bb627dcc077f7ca33bb31bb133abb18ce43e242dd2fabfebd2d355d5b9dd79a705a91859dd5ebc6ec920612fd0f6bdb654ad192aa6a63aa5faca230232220244fba2cd3d925af042942d76fe1f4d74c4022c1f02ca9474f1b0ac01e50181bebdf40c344eec7a66b65ff7d3171c4be57e9d2ddaaa36bb14f0be466e99e5ea818f9063d1b123278415f7a2b8d47c8808475d1e572647405562fb5fc0495959d2b12c21bc585e0774e38d2d689c9c2ba690ef55c2bd376150fa5ebfe5ed26e5e400e0b1133d64174fa27dac38a26bf355bef0b946dba6a093345800c3e925a6642b0d3b296abeda31ab6a667954bb18168e1b4628151538ad93220ad9bcd316b897c538075a06224994fe86300fb5efe3fbde27331d5a162721dfca45bff073a91d926f6510974e4f44d15cca1f8a130d1d994ec7c31d1460a7e52154c911e03f5762a4bcda3cd0b49f2da88fdf5549bdef8b5e0dd7bda0bdc6ff718e477021339bdb47dada1a8fde68"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x0, 0x0, 0x0}) 11:28:16 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00'}, 0x45c) [ 2286.305177][T25610] input: syz0 as /devices/virtual/input/input3000 [ 2286.313807][T19542] binder: release 25528:25563 transaction 3120 out, still active [ 2286.336938][T25563] binder: BINDER_SET_CONTEXT_MGR already set [ 2286.345390][T19542] binder: undelivered TRANSACTION_COMPLETE [ 2286.375747][T25563] binder: 25528:25563 ioctl 40046207 0 returned -16 [ 2286.383641][T19542] binder: send failed reply for transaction 3120, target dead 11:28:16 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) 11:28:16 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) [ 2286.473502][T25661] binder: 25659:25661 Release 1 refcount change on invalid ref -900202493 ret -22 [ 2286.490727][T25662] input: syz0 as /devices/virtual/input/input3001 [ 2286.534823][T25661] binder: 25659:25661 unknown command 0 [ 2286.555683][T25661] binder: 25659:25661 ioctl c0306201 20000040 returned -22 [ 2286.565767][T25668] binder: 25663:25668 unknown command 939524095 [ 2286.584294][T25668] binder: 25663:25668 ioctl c0306201 200002c0 returned -22 [ 2286.613375][T19542] binder: release 25663:25668 transaction 3123 out, still active [ 2286.614093][T25670] input: syz0 as /devices/virtual/input/input3002 [ 2286.626457][T19542] binder: undelivered TRANSACTION_COMPLETE 11:28:16 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00'}, 0x45c) [ 2286.634461][T25668] binder: BINDER_SET_CONTEXT_MGR already set [ 2286.648603][T19542] binder: send failed reply for transaction 3123, target dead [ 2286.661067][T25668] binder: 25663:25668 ioctl 40046207 0 returned -16 [ 2286.714198][T25733] input: syz0 as /devices/virtual/input/input3004 11:28:17 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x6, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) [ 2286.809561][T25777] input: syz0 as /devices/virtual/input/input3005 [ 2286.867793][T25781] input: syz0 as /devices/virtual/input/input3006 [ 2286.905799][T25784] binder: 25783:25784 unknown command 775421951 [ 2286.916530][T25784] binder: 25783:25784 ioctl c0306201 200002c0 returned -22 [ 2286.924709][T21720] binder: release 25783:25784 transaction 3126 out, still active [ 2286.935152][T25784] binder: BINDER_SET_CONTEXT_MGR already set [ 2286.942091][T21720] binder: send failed reply for transaction 3126, target dead [ 2286.950508][T25784] binder: 25783:25784 ioctl 40046207 0 returned -16 11:28:17 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r1, 0xc02c5341, &(0x7f0000000280)={0x0, 0x0, 0x0, 'queue1\x00', 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff00000000]}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) 11:28:17 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000), 0xf, 0x0, 0x0}) 11:28:17 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x14\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) 11:28:17 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x7, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) 11:28:17 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(0x0, 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r1, 0xc0505350, &(0x7f0000000500)={{0xfffffffffffffffc, 0x80000000}, {0x3f, 0x8}, 0x2392, 0x5, 0x400}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) 11:28:17 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x04\x00'}, 0x45c) [ 2287.114970][T25804] input: syz0 as /devices/virtual/input/input3007 [ 2287.134084][T25806] binder: 25796:25806 unknown command 472791039 [ 2287.137774][T25803] binder: 25797:25803 ioctl c0306201 200002c0 returned -14 [ 2287.152773][T25802] input: syz0 as /devices/virtual/input/input3008 [ 2287.160819][T25806] binder: 25796:25806 ioctl c0306201 200002c0 returned -22 [ 2287.187977][T25809] input: syz0 as /devices/virtual/input/input3009 [ 2287.207325][T19542] binder: release 25796:25806 transaction 3129 out, still active [ 2287.223217][T25814] input: syz0 as /devices/virtual/input/input3010 [ 2287.231256][T25806] binder: BINDER_SET_CONTEXT_MGR already set 11:28:17 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(0x0, 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r1, 0xc0505350, &(0x7f0000000500)={{0xfffffffffffffffc, 0x80000000}, {0x3f, 0x8}, 0x2392, 0x5, 0x400}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) [ 2287.243768][T25806] binder: 25796:25806 ioctl 40046207 0 returned -16 [ 2287.248224][T19542] binder: send failed reply for transaction 3129, target dead 11:28:17 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x05\x00'}, 0x45c) [ 2287.291002][T19542] binder: send failed reply for transaction 3130 to 25797:25803 [ 2287.329824][T19542] binder_release_work: 7 callbacks suppressed 11:28:17 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x48, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) [ 2287.329832][T19542] binder: undelivered TRANSACTION_ERROR: 29189 [ 2287.350919][T19542] binder: undelivered TRANSACTION_ERROR: 29189 11:28:17 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(0x0, 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r1, 0xc0505350, &(0x7f0000000500)={{0xfffffffffffffffc, 0x80000000}, {0x3f, 0x8}, 0x2392, 0x5, 0x400}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) 11:28:17 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x15\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) 11:28:17 executing program 0: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000200)='/dev/ubi_ctrl\x00', 0x20000, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x18, 0xfa00, {0x4, &(0x7f0000000240)={0xffffffffffffffff}, 0x13f, 0x9}}, 0x20) write$RDMA_USER_CM_CMD_ACCEPT(r0, &(0x7f0000000480)={0x8, 0x120, 0xfa00, {0x8, {0x1f, 0x101, "cac76aa2b2781067b04bfe1da9e6a334d09f8525852a7f5c24c2c0da13349c3f40883f0f0bfb241f4b0d068217e2c3e9870c75e318e0620dba3a25cd86c12eca29d793721128132fbdc985540bad00ba4e33ca2420175b2420037305b0d11edf982d18a3007dbb318c496c6c83eeba2d741a97ddf9cee9410de5e8af83b3b8fc9567f1ca0f2354b6cf8f92b61d96dfd9eec68eacbd632012e199c1443262e0ff6cf23f0d080a952a2dbe40849486ff145ed42ef7064bbfa65e99db6d144d4cc1609a19f956951651995d73ddfd3a57a04dddcb21fc6d525c57fc5f2027387794e9ffef9ddcbaedf30b63673096ec9008180f3f92ba2c8b2436b11017b7a1180b", 0x83, 0x3, 0x1, 0x3, 0x3, 0x77b, 0x3f, 0x1}, r1}}, 0x128) r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x5e7661c6459474e4, 0x0, &(0x7f0000000180)=[@increfs_done={0x40406301}], 0x0, 0x0, 0x0}) time(&(0x7f0000000380)) r3 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snapshot\x00', 0x101080, 0x0) write$cgroup_type(r3, &(0x7f0000000040)='threaded\x00', 0x9) r4 = getuid() r5 = getegid() fsetxattr$system_posix_acl(r3, &(0x7f0000000080)='system.posix_acl_access\x00', &(0x7f00000000c0)={{}, {0x1, 0x1}, [{0x2, 0x1, r4}], {0x4, 0x2}, [{0x8, 0x1, r5}], {0x10, 0x4}, {0x20, 0x1}}, 0x34, 0x3) symlinkat(&(0x7f0000000100)='./file0\x00', r3, &(0x7f0000000140)='./file0\x00') [ 2287.435106][T25923] input: syz0 as /devices/virtual/input/input3011 [ 2287.462093][T19542] binder: undelivered TRANSACTION_ERROR: 29189 [ 2287.554066][T19542] binder: release 25926:25936 transaction 3134 out, still active [ 2287.573029][T25936] binder: BINDER_SET_CONTEXT_MGR already set [ 2287.590804][T25935] input: syz0 as /devices/virtual/input/input3013 [ 2287.607006][T25936] binder: 25926:25936 ioctl 40046207 0 returned -16 [ 2287.607047][T19542] binder: send failed reply for transaction 3134, target dead [ 2287.633608][T25940] binder_transaction: 6 callbacks suppressed [ 2287.633626][T25940] binder: 25926:25940 transaction failed 29189/-22, size 0-0 line 2995 [ 2287.717089][T25947] input: syz0 as /devices/virtual/input/input3014 [ 2287.731744][T21720] binder: undelivered TRANSACTION_ERROR: 29189 11:28:18 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r1, 0xc02c5341, &(0x7f0000000280)={0x0, 0x0, 0x0, 'queue1\x00', 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe]}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) 11:28:18 executing program 0: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) prctl$PR_SET_MM_EXE_FILE(0x23, 0xd, 0xffffffffffffffff) fchmod(0xffffffffffffffff, 0x40) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x0, 0x0, 0x0}) openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm_plock\x00', 0x101000, 0x0) 11:28:18 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00'}, 0x45c) 11:28:18 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r1, 0xc0505350, &(0x7f0000000500)={{0xfffffffffffffffc, 0x80000000}, {0x3f, 0x8}, 0x2392, 0x5, 0x400}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) 11:28:18 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x16\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) 11:28:18 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x4c, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) [ 2288.097852][T25961] input: syz0 as /devices/virtual/input/input3015 [ 2288.130693][T25983] input: syz0 as /devices/virtual/input/input3016 [ 2288.149123][T21720] binder: send failed reply for transaction 3137, target dead 11:28:18 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r1, 0xc0505350, &(0x7f0000000500)={{0xfffffffffffffffc, 0x80000000}, {0x3f, 0x8}, 0x2392, 0x5, 0x400}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) 11:28:18 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000000000000000000000000000000fa47af36000000000000000000000000000000000000000000000000000000000048e764080172555227e114f2b32fb28be3bca9f849b62c4f445707a98dff5ec91db0aeb36c535b57628d0f8c3eab104562bcf1ebd61180a86e7815d8c44666cba22306af54748416a4d9b6b861e0416d4aa8f17e48132af76df1db3638efe1d84a88945b97f3e3da"], 0x0, 0x0, 0x0}) r1 = syz_open_dev$vcsn(&(0x7f0000000080)='/dev/vcs#\x00', 0x1, 0x0) ioctl$TIOCSERGETLSR(r1, 0x5459, &(0x7f0000000140)) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm_plock\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(r1, 0x6, 0x15, &(0x7f0000000100)=0x8, 0x4) ioctl$RNDADDTOENTCNT(r2, 0x40045201, &(0x7f0000000040)=0x2000000) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="01634040", @ANYRES64=0x0, @ANYBLOB="00000000000000a0"], 0x0, 0x0, 0x0}) ioctl$VIDIOC_G_AUDOUT(r1, 0x80345631, &(0x7f00000000c0)) openat$uhid(0xffffffffffffff9c, &(0x7f0000000240)='/dev/uhid\x00', 0x0, 0x0) [ 2288.199365][T26001] input: syz0 as /devices/virtual/input/input3017 11:28:18 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x60, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) 11:28:18 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x12\x00'}, 0x45c) 11:28:18 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) 11:28:18 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r1, 0xc0505350, &(0x7f0000000500)={{0xfffffffffffffffc, 0x80000000}, {0x3f, 0x8}, 0x2392, 0x5, 0x400}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) [ 2288.359944][T26086] binder: 26083:26086 transaction failed 29189/-22, size 3583815-0 line 2995 [ 2288.405324][T21720] binder_release_work: 6 callbacks suppressed [ 2288.405329][T21720] binder: undelivered TRANSACTION_COMPLETE [ 2288.417841][T26089] input: syz0 as /devices/virtual/input/input3019 [ 2288.433039][T26090] binder: BINDER_SET_CONTEXT_MGR already set [ 2288.454088][T26090] binder: 26085:26090 ioctl 40046207 0 returned -16 [ 2288.462626][T26086] binder_alloc: 26085: binder_alloc_buf size 3583816 failed, no address space [ 2288.490054][T26111] input: syz0 as /devices/virtual/input/input3020 [ 2288.541389][T21720] binder: undelivered TRANSACTION_ERROR: 29189 [ 2288.580344][T26086] binder_alloc: allocated: 8 (num: 1 largest: 8), free: 12280 (num: 1 largest: 12280) [ 2288.606731][T21720] binder: undelivered TRANSACTION_COMPLETE [ 2288.610230][T26086] binder: 26083:26086 transaction failed 29201/-28, size 3583815-0 line 3148 [ 2288.687010][T21720] binder: undelivered TRANSACTION_ERROR: 29201 [ 2288.707558][T26203] input: syz0 as /devices/virtual/input/input3021 [ 2288.767426][T26209] input: syz0 as /devices/virtual/input/input3022 11:28:19 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x68, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) 11:28:19 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x14\x00'}, 0x45c) 11:28:19 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r1, 0xc02c5341, &(0x7f0000000280)={0x0, 0x0, 0x0, 'queue1\x00', 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe00]}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) 11:28:19 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280), 0x0, 0x0, 0x0}) 11:28:19 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r1, 0xc0505350, &(0x7f0000000500)={{0xfffffffffffffffc, 0x80000000}, {0x3f, 0x8}, 0x2392, 0x5, 0x400}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) 11:28:19 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00/\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) [ 2289.031516][T26218] input: syz0 as /devices/virtual/input/input3023 [ 2289.052571][T26221] binder: 26220:26221 transaction failed 29189/-22, size 0-0 line 2995 [ 2289.070806][T26226] input: syz0 as /devices/virtual/input/input3024 [ 2289.084188][T21720] binder_thread_release: 4 callbacks suppressed [ 2289.084199][T21720] binder: release 26216:26227 transaction 3147 out, still active [ 2289.101457][T26227] binder: BINDER_SET_CONTEXT_MGR already set [ 2289.117306][T26229] binder_alloc: 26216: binder_alloc_buf, no vma [ 2289.123770][T21720] binder: undelivered TRANSACTION_COMPLETE [ 2289.130492][T26227] binder: 26216:26227 ioctl 40046207 0 returned -16 11:28:19 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r1, 0xc0505350, &(0x7f0000000500)={{0xfffffffffffffffc, 0x80000000}, {0x3f, 0x8}, 0x2392, 0x5, 0x400}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) [ 2289.159023][T26243] input: syz0 as /devices/virtual/input/input3026 [ 2289.168325][T26252] input: syz0 as /devices/virtual/input/input3025 [ 2289.182886][T26229] binder: 26216:26229 transaction failed 29189/-3, size 0-0 line 3148 11:28:19 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x15\x00'}, 0x45c) 11:28:19 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00?\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) [ 2289.245009][T21720] binder: undelivered TRANSACTION_ERROR: 29189 11:28:19 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_mtu(r1, 0x29, 0x17, &(0x7f0000000300), &(0x7f0000000340)=0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000001a80)=ANY=[@ANYBLOB="00634040000000000000008eba04b50000000400000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000267b31bcbc284761e6ebe01088297cb1227ed737c9246412640eb28a417c2b4ad55efb123ff71509337081430afa45ddefafe58ae375344535fa1a401972d6fd95e866bc24b37fba30a24faf1ec7faada1d3993178c11aded85a23608d3233fa5646ddcacb2fa801c05e06baaa7528c74a91157ef572818e5bcc1eb337b078e4f6659c770be05903cbb7710c1cdbf704a37fe200cec583f93b07fb58d591eb3bbb989577287dc49fc4e6f60b27384a2d1917913f5392eabd3ce6fb1a11d42ea6bf0accd4c8b15795c19cfce16b84a2ff09edc36520f06e906508f9455332f7ad"], 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000001940)='./file0\x00', 0x521100, 0x1) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_REM(r2, 0x84, 0x65, &(0x7f00000019c0)=[@in6={0xa, 0x4e23, 0x35c13e14, @mcast2, 0x4}, @in6={0xa, 0x4e21, 0x9, @mcast1, 0x7}, @in6={0xa, 0x4e21, 0x8, @local, 0xe00}, @in={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1f}}, @in={0x2, 0x4e22, @multicast2}, @in={0x2, 0x4e24, @multicast1}, @in={0x2, 0x4e23, @rand_addr=0x8}], 0x94) ioctl$DRM_IOCTL_MODE_GETCRTC(r2, 0xc06864a1, &(0x7f0000001bc0)={&(0x7f0000000300), 0x0, 0x6, 0x4, 0x3f, 0xffff, 0x7, {0x3f80000000, 0x6, 0x84, 0xa0, 0x7fffffff, 0x6, 0x100, 0x3447, 0x1000, 0xffffffff, 0x5, 0x0, 0x8, 0x0, "c4f0080abb9164f56e9f2cf9b5a1d62d276eaf204a0a22a8ce0dd9745225bfa5"}}) recvmsg$kcm(0xffffffffffffff9c, &(0x7f0000001680)={&(0x7f0000000000)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff}}, 0x80, &(0x7f0000000380)=[{&(0x7f0000000080)=""/119, 0x77}, {&(0x7f0000000100)=""/65, 0x41}, {&(0x7f0000000180)=""/61, 0x3d}, {&(0x7f0000000480)=""/223, 0xdf}, {&(0x7f0000000580)=""/193, 0xc1}, {&(0x7f0000000680)=""/4096, 0x1000}, {&(0x7f00000001c0)=""/113, 0x71}], 0x7, &(0x7f0000000240)=""/62, 0x3e}, 0x40002000) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000001700)='IPVS\x00') sendmsg$IPVS_CMD_GET_DAEMON(r3, &(0x7f00000018c0)={&(0x7f00000016c0)={0x10, 0x0, 0x0, 0x10001080}, 0xfffffffffffffe6a, &(0x7f0000001880)={&(0x7f0000001740)={0x1d, r4, 0x4, 0x70bd2e, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x8001}, @IPVS_CMD_ATTR_DEST={0x38, 0x2, [@IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@local}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x3ff}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x7}, @IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e21}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0x2}]}, @IPVS_CMD_ATTR_DEST={0x60, 0x2, [@IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e23}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x63}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x2}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x6}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x9}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x4}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x6}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x81}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@loopback}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x7ff}, @IPVS_CMD_ATTR_DEST={0xc, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x3}]}, @IPVS_CMD_ATTR_DEST={0x54, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x6}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xff}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e22}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0xfffffffffffffff9}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x2}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x2acd}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x8001}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x1ff}]}, @IPVS_CMD_ATTR_DEST={0xc, 0x2, [@IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x5}]}, @IPVS_CMD_ATTR_DEST={0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x6}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x1}]}, 0x13c}, 0x1, 0x0, 0x0, 0x84}, 0x20004000) openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000001900)='/selinux/enforce\x00', 0x0, 0x0) bind$isdn_base(r3, &(0x7f0000001980)={0x22, 0xceb7, 0x4, 0x0, 0x8}, 0x2f2) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x0, 0x0, 0x0}) 11:28:19 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x6c, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) [ 2289.329516][T19542] binder: undelivered TRANSACTION_ERROR: 29189 11:28:19 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r1, 0xc0505350, &(0x7f0000000500)={{0xfffffffffffffffc, 0x80000000}, {0x3f, 0x8}, 0x2392, 0x5, 0x400}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) [ 2289.394056][T26351] input: syz0 as /devices/virtual/input/input3027 [ 2289.468749][T26359] binder: 26355:26359 transaction failed 29189/-22, size 0-4194304 line 2995 [ 2289.494151][T26353] input: syz0 as /devices/virtual/input/input3028 [ 2289.508498][T26351] input: syz0 as /devices/virtual/input/input3029 [ 2289.516569][T21720] binder: release 26354:26361 transaction 3151 out, still active [ 2289.525837][T21720] binder: undelivered TRANSACTION_COMPLETE [ 2289.537136][T26361] binder: BINDER_SET_CONTEXT_MGR already set [ 2289.556375][T26361] binder: 26354:26361 ioctl 40046207 0 returned -16 [ 2289.563349][T21720] binder_send_failed_reply: 4 callbacks suppressed [ 2289.563357][T21720] binder: send failed reply for transaction 3151, target dead [ 2289.585482][T26363] binder: 26354:26363 transaction failed 29189/-22, size 0-0 line 2995 11:28:19 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x16\x00'}, 0x45c) 11:28:19 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x74, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) [ 2289.617958][T21720] binder: undelivered TRANSACTION_ERROR: 29189 [ 2289.672086][T26353] input: syz0 as /devices/virtual/input/input3030 [ 2289.697466][T21720] binder: undelivered TRANSACTION_ERROR: 29189 [ 2289.778058][T19542] binder: release 26470:26476 transaction 3154 out, still active [ 2289.791474][T26476] binder: BINDER_SET_CONTEXT_MGR already set [ 2289.800831][T26477] binder_alloc: 26470: binder_alloc_buf, no vma [ 2289.803300][T19542] binder: undelivered TRANSACTION_COMPLETE [ 2289.825022][T26475] input: syz0 as /devices/virtual/input/input3031 [ 2289.847558][T19542] binder: send failed reply for transaction 3154, target dead [ 2289.853302][T26476] binder: 26470:26476 ioctl 40046207 0 returned -16 [ 2289.863903][T26477] binder: 26470:26477 transaction failed 29189/-3, size 0-0 line 3148 11:28:20 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r1, 0xc02c5341, &(0x7f0000000280)={0x0, 0x0, 0x0, 'queue1\x00', 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f00]}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) 11:28:20 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x0, 0x0, 0x0}) r1 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r1, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000040)=0x14) 11:28:20 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r1, 0xc0505350, &(0x7f0000000500)={{0xfffffffffffffffc, 0x80000000}, {0x3f, 0x8}, 0x2392, 0x5, 0x400}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) 11:28:20 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) 11:28:20 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x7a, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) 11:28:20 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00'}, 0x45c) [ 2290.037629][T26494] input: syz0 as /devices/virtual/input/input3033 [ 2290.066499][T26493] binder: 26487:26493 transaction failed 29189/-22, size 0-0 line 2995 [ 2290.105281][T26493] binder: 26487:26493 transaction failed 29189/-22, size 0-0 line 2995 [ 2290.115588][T26498] input: syz0 as /devices/virtual/input/input3034 [ 2290.122882][T26499] input: syz0 as /devices/virtual/input/input3035 [ 2290.126419][T19542] binder: release 26489:26513 transaction 3159 out, still active 11:28:20 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00/\x00'}, 0x45c) [ 2290.163611][T26513] binder: BINDER_SET_CONTEXT_MGR already set [ 2290.172695][T19542] binder: undelivered TRANSACTION_COMPLETE [ 2290.191049][T26563] binder_alloc: 26489: binder_alloc_buf, no vma [ 2290.201696][T19542] binder: send failed reply for transaction 3159, target dead 11:28:20 executing program 0: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000)='/dev/hwrng\x00', 0x100, 0x0) recvfrom$llc(r0, &(0x7f0000000040)=""/179, 0xb3, 0x40000101, &(0x7f0000000100)={0x1a, 0x337, 0x5, 0x7fff, 0x2533, 0x4, @dev={[], 0x26}}, 0x10) r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x0, 0x0, 0x0}) [ 2290.253869][T26513] binder: 26489:26513 ioctl 40046207 0 returned -16 [ 2290.271270][T26560] input: syz0 as /devices/virtual/input/input3036 [ 2290.294722][T26613] input: syz0 as /devices/virtual/input/input3037 11:28:20 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) 11:28:20 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x300, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) [ 2290.356333][T26619] input: syz0 as /devices/virtual/input/input3038 11:28:20 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00?\x00'}, 0x45c) 11:28:20 executing program 0: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000059d54902ad881ffe3f06f8fc0fbade384e9249cc3a698e3788baf3e3ed9b58eef192cbfb55449bc10c6a5e353828f832152bf47deaebffbd214cad3a44ea7f82bc21af552415fba2e584766e3ba8e61108e0eed46b28fa5c32879a3f296d07d7c8b044eb0f9487c09a83674ae2f2705d1c57dae830672600"/187], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x0, 0x0, 0x0}) r0 = syz_open_dev$cec(&(0x7f00000000c0)='/dev/cec#\x00', 0x3, 0x2) setsockopt$inet6_icmp_ICMP_FILTER(r0, 0x1, 0x1, &(0x7f0000000100)={0x4}, 0x4) [ 2290.511247][T19542] binder: release 26705:26726 transaction 3163 out, still active [ 2290.521402][T26727] input: syz0 as /devices/virtual/input/input3039 [ 2290.528651][T26728] binder_alloc: 26705: binder_alloc_buf, no vma [ 2290.534276][T26726] binder: BINDER_SET_CONTEXT_MGR already set [ 2290.543809][T19542] binder: undelivered TRANSACTION_COMPLETE [ 2290.575605][T26731] input: syz0 as /devices/virtual/input/input3040 [ 2290.587873][T26726] binder: 26705:26726 ioctl 40046207 0 returned -16 [ 2290.589045][T19542] binder: send failed reply for transaction 3163, target dead [ 2290.645109][T26737] input: syz0 as /devices/virtual/input/input3042 11:28:21 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r1, 0xc02c5341, &(0x7f0000000280)={0x0, 0x0, 0x0, 'queue1\x00', 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe000000]}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) 11:28:21 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x500, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) 11:28:21 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) 11:28:21 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x00\x00\xff\xff\xff\xfe\x00'}, 0x45c) 11:28:21 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x1d0, 0x0, &(0x7f00000000c0), 0x8e, 0x0, 0x0}) r1 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x10000, 0x0) getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f0000000040)={0x0}, &(0x7f00000000c0)=0xc) r3 = geteuid() ioctl$DRM_IOCTL_GET_CLIENT(r1, 0xc0286405, &(0x7f0000000100)={0x10001, 0x4, r2, 0x0, r3, 0x0, 0x8, 0x1}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x0, 0x0, 0x0}) 11:28:21 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r1, 0xc0505350, &(0x7f0000000500)={{0xfffffffffffffffc, 0x80000000}, {0x3f, 0x8}, 0x2392, 0x5, 0x400}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) [ 2291.053191][T26858] input: syz0 as /devices/virtual/input/input3043 [ 2291.060545][T26857] binder: 26852:26857 unknown command 0 [ 2291.086823][T26859] input: syz0 as /devices/virtual/input/input3044 [ 2291.093840][T26857] binder: 26852:26857 ioctl c0306201 20000080 returned -22 [ 2291.102748][T21720] binder: release 26854:26862 transaction 3166 out, still active [ 2291.114040][T26862] binder: BINDER_SET_CONTEXT_MGR already set [ 2291.124085][T21720] binder: undelivered TRANSACTION_COMPLETE [ 2291.135809][T26865] binder_alloc: 26854: binder_alloc_buf, no vma 11:28:21 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = msgget(0x2, 0x2) msgsnd(r1, &(0x7f0000000000)={0x2, "b8321844bfee4c71807128e3e536121f3459e8f74fe0d29c5e2427cb1d84d404b71b4117f8bd6693acacda5c5d094cc9b9da27021fd891156d587c65c51b92006c3b9720f2869bc5ae52c56e636505791be2ea5bd6d7535fd1e159d0292b38b1a93398ce2e949a05595ccf4ef04b1f7bc3fcf3397e3d89ef229907016a0e0eae82ed9e9d055084e60264c417915d9df079e4fdc21cf5166f0aafee9d312ac6e719cfabfaf8f11f42a62961380c1ab94414c3d213b7095a513a159dff2e6f625dfbffe0ff97719df4643a9309c7a0bbbc900f4e22e85c1142311b44"}, 0xe3, 0x800) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x0, 0x0, 0x0}) [ 2291.157311][T26862] binder: 26854:26862 ioctl 40046207 0 returned -16 [ 2291.159400][T21720] binder: send failed reply for transaction 3166, target dead [ 2291.176974][T26866] input: syz0 as /devices/virtual/input/input3045 11:28:21 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x600, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) 11:28:21 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) 11:28:21 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x02\x00'}, 0x45c) [ 2291.361686][T21720] binder: release 26878:26882 transaction 3169 out, still active [ 2291.371759][T26884] binder: 26877:26884 got reply transaction with no transaction stack [ 2291.384130][T21720] binder: undelivered TRANSACTION_COMPLETE [ 2291.390459][T26882] binder: BINDER_SET_CONTEXT_MGR already set [ 2291.405334][T26882] binder: 26878:26882 ioctl 40046207 0 returned -16 [ 2291.414053][T26883] input: syz0 as /devices/virtual/input/input3047 [ 2291.421652][T26885] input: syz0 as /devices/virtual/input/input3048 [ 2291.432192][T21720] binder: send failed reply for transaction 3169, target dead [ 2291.463464][T26886] binder_alloc: 26878: binder_alloc_buf, no vma 11:28:21 executing program 0: r0 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dlm_plock\x00', 0x0, 0x0) getsockname(r0, &(0x7f00000000c0)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @dev}}}, &(0x7f0000000140)=0x80) syz_open_dev$amidi(&(0x7f0000000000)='/dev/amidi#\x00', 0x1, 0x2) chdir(&(0x7f0000000040)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xfffffffffffffeb1, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="01634040", @ANYRES64=0x0, @ANYBLOB="0000000000000400"], 0x0, 0x0, 0x0}) [ 2291.505311][T26994] input: syz0 as /devices/virtual/input/input3050 11:28:21 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x700, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) [ 2291.608037][T27000] binder: 26999:27000 ioctl c0306201 20000440 returned -14 [ 2291.688610][T19542] binder: release 27024:27083 transaction 3174 out, still active [ 2291.698509][T27083] binder: BINDER_SET_CONTEXT_MGR already set [ 2291.707720][T19542] binder: undelivered TRANSACTION_COMPLETE [ 2291.707987][T27089] binder_alloc: 27024: binder_alloc_buf, no vma [ 2291.716659][T19542] binder: send failed reply for transaction 3174, target dead [ 2291.724192][T27083] binder: 27024:27083 ioctl 40046207 0 returned -16 11:28:22 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r1, 0xc02c5341, &(0x7f0000000280)={0x0, 0x0, 0x0, 'queue1\x00', 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f000000]}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) 11:28:22 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x05\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) 11:28:22 executing program 0: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='cpuacct.usage_percpu\x00', 0x0, 0x0) ioctl$UI_SET_PROPBIT(r0, 0x4004556e, 0x19) r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$usbmon(&(0x7f0000000000)='/dev/usbmon#\x00', 0xfff, 0x240) ioctl$int_out(r1, 0x2, &(0x7f0000000040)) ioctl$VIDIOC_SUBSCRIBE_EVENT(r2, 0x4020565a, &(0x7f0000000080)={0x8001007, 0x4}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000029e7bc4a9606d5c008a8a6a92e28d8e7ba23a4bfc365632489967baa0ed53970f561f1f63b89484ecd516239ee20a38dc86019e28b1c0e254c01228960f990f04af41ddcb94e8157a3bb2e086573ba73da2256294e"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="f285924dc2c8fda61dbbf27f129c2b4e85edc66850ea639402533876d93a9fdd85bfb6eae6b314ec7eb54b66df77d5409836f2ab0cb73538896e006adfbe0c3c8e5adeb17f5a6606b003d1f16f399d58c68201f33e1685303be7a3370d4af3dd71636e46cc6fbb6524051b2bc2b46c0411dbe3470178215eb8a7fa0bf43920df43ad0aba76b1363b877a966e1cf16b1ac0bc02b2ef2b36675f21c5418e191a47c78d3d9d25517be505173b31cabe4ee1f68827cc57871b44e117b58e3022", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) 11:28:22 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x03\x00'}, 0x45c) 11:28:22 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r1, 0xc0505350, &(0x7f0000000500)={{0xfffffffffffffffc, 0x80000000}, {0x3f, 0x8}, 0x2392, 0x5, 0x400}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) 11:28:22 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x2000, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) [ 2292.004610][T27117] input: syz0 as /devices/virtual/input/input3051 [ 2292.039210][T27119] input: syz0 as /devices/virtual/input/input3052 [ 2292.050652][T19542] binder: release 27112:27130 transaction 3178 out, still active [ 2292.068699][T19542] binder: send failed reply for transaction 3178, target dead [ 2292.082071][T27142] input: syz0 as /devices/virtual/input/input3053 11:28:22 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x04\x00'}, 0x45c) 11:28:22 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0600af7a8c", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) 11:28:22 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x3f00, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) [ 2292.152335][T19542] binder: release 27112:27140 transaction 3180 out, still active [ 2292.202206][T19542] binder: send failed reply for transaction 3180, target dead 11:28:22 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x11\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) [ 2292.270271][T27241] input: syz0 as /devices/virtual/input/input3055 [ 2292.336072][T27318] input: syz0 as /devices/virtual/input/input3056 [ 2292.394663][T19542] binder: send failed reply for transaction 3184, target dead 11:28:22 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x05\x00'}, 0x45c) 11:28:22 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x4800, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) [ 2292.451653][T19542] binder_release_work: 13 callbacks suppressed [ 2292.451661][T19542] binder: undelivered TRANSACTION_ERROR: 29189 [ 2292.469644][T27350] input: syz0 as /devices/virtual/input/input3057 [ 2292.601468][T27359] input: syz0 as /devices/virtual/input/input3059 [ 2292.635289][T27364] input: syz0 as /devices/virtual/input/input3060 11:28:23 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r1, 0xc02c5341, &(0x7f0000000280)={0x0, 0x0, 0x0, 'queue1\x00', 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfeffffff]}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) 11:28:23 executing program 0: clock_gettime(0x4, &(0x7f0000000280)) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x2) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="006340400000000000000000000077b53f3000"/72], 0x0, 0x0, 0x0}) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/vga_arbiter\x00', 0x4000000000, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffff9c, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x3c, &(0x7f0000000480)=[@in6={0xa, 0x4e23, 0x4, @empty, 0x5}, @in={0x2, 0x4e24, @loopback}, @in6={0xa, 0x4e21, 0xfb, @mcast1, 0x3}]}, &(0x7f0000000240)=0xffffffffffffff02) setsockopt$inet_sctp_SCTP_SET_PEER_PRIMARY_ADDR(r1, 0x84, 0x5, &(0x7f0000000300)={r2, @in6={{0xa, 0x4e21, 0xff, @loopback}}}, 0x84) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="72634040358e2ebaa9b129c83292e4c7322412e6685c377ae9b06ee94b410d4ec9777c82fe66dd03f553", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) ioctl$IMGETVERSION(r1, 0x80044942, &(0x7f00000001c0)) r3 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r3, 0x84, 0x1d, &(0x7f0000000080)={0x8, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, &(0x7f00000000c0)=0xfffffffffffffd09) 11:28:23 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) 11:28:23 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x4c00, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) 11:28:23 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x11\x00'}, 0x45c) 11:28:23 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r1, 0xc0505350, &(0x7f0000000500)={{0xfffffffffffffffc, 0x80000000}, {0x3f, 0x8}, 0x2392, 0x5, 0x400}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) [ 2292.918725][T27375] binder_transaction: 11 callbacks suppressed [ 2292.918741][T27375] binder: 27372:27375 transaction failed 29189/-22, size 0-0 line 2995 [ 2292.938287][T27376] input: syz0 as /devices/virtual/input/input3061 [ 2292.971649][T27377] input: syz0 as /devices/virtual/input/input3062 [ 2292.981961][T27384] input: syz0 as /devices/virtual/input/input3063 11:28:23 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x6000, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) 11:28:23 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x14\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) 11:28:23 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0xfffffffffffffffc) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="00634040000000000520000027260fff3a000000000000000000000000000037515e4d488e1a39ae2aaf0000000008000000000000000000000000a698637900000000ab25589f95"], 0xfffffcd8, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="01634040", @ANYRES64=0x0, @ANYBLOB="0000000000000000e23d8bf15bd3d5a12427bd8f05c7e2c428092b93265bb7"], 0x0, 0x0, 0x0}) r1 = accept4$vsock_stream(0xffffffffffffff9c, &(0x7f0000000100)={0x28, 0x0, 0x2711}, 0x10, 0x800) accept4(r1, &(0x7f0000000140)=@pppol2tpv3, &(0x7f00000001c0)=0x80, 0x80800) 11:28:23 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x12\x00'}, 0x45c) [ 2293.103835][T21720] binder: undelivered TRANSACTION_ERROR: 29189 [ 2293.161932][T27400] input: syz0 as /devices/virtual/input/input3065 11:28:23 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x6800, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) [ 2293.247707][T27404] input: syz0 as /devices/virtual/input/input3066 [ 2293.261763][T27431] input: syz0 as /devices/virtual/input/input3067 11:28:23 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x15\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) [ 2293.345639][T27513] input: syz0 as /devices/virtual/input/input3068 [ 2293.503407][T27522] input: syz0 as /devices/virtual/input/input3069 [ 2293.533903][T27524] input: syz0 as /devices/virtual/input/input3070 11:28:24 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r1, 0xc02c5341, &(0x7f0000000280)={0x0, 0x0, 0x0, 'queue1\x00', 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe]}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) 11:28:24 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x800) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x0, 0x0, 0x0}) r1 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/qat_adf_ctl\x00', 0x143102, 0x0) ioctl$NBD_SET_SIZE_BLOCKS(r1, 0xab07, 0xff) r2 = semget(0x0, 0x0, 0x1b8) semctl$SETALL(r2, 0x0, 0x11, &(0x7f0000000040)=[0x19a, 0x4, 0x81, 0x0, 0xfffffffffffffffb]) ioctl$TIOCGWINSZ(r1, 0x5413, &(0x7f0000000080)) 11:28:24 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x6c00, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) 11:28:24 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x14\x00'}, 0x45c) 11:28:24 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x16\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) 11:28:24 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r1, 0xc0505350, &(0x7f0000000500)={{0xfffffffffffffffc, 0x80000000}, {0x3f, 0x8}, 0x2392, 0x5, 0x400}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) [ 2293.878985][T27539] input: syz0 as /devices/virtual/input/input3071 [ 2293.901620][T19542] binder_release_work: 12 callbacks suppressed [ 2293.901627][T19542] binder: undelivered TRANSACTION_COMPLETE [ 2293.917040][T27545] binder: BINDER_SET_CONTEXT_MGR already set [ 2293.925767][T27542] input: syz0 as /devices/virtual/input/input3072 [ 2293.953642][T27545] binder: 27531:27545 ioctl 40046207 0 returned -16 [ 2293.954037][T27541] binder: 27535:27541 got reply transaction with bad transaction stack, transaction 3206 has target 27531:0 [ 2293.984146][T27547] input: syz0 as /devices/virtual/input/input3073 [ 2294.000264][T27552] input: syz0 as /devices/virtual/input/input3074 [ 2294.023382][ T1470] binder: undelivered TRANSACTION_COMPLETE [ 2294.040863][T27541] binder: 27535:27541 transaction failed 29201/-71, size 0-0 line 2915 11:28:24 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x15\x00'}, 0x45c) 11:28:24 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x7400, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) 11:28:24 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) [ 2294.096631][ T1470] binder: send failed reply for transaction 3206 to 27535:27541 11:28:24 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = creat(&(0x7f0000000000)='./file1\x00', 0x92) stat(&(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$nl_netfilter(r1, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000140)={&(0x7f0000000480)={0x1038, 0x12, 0x5, 0x200, 0x70bd28, 0x25dfdbff, {0x7, 0x0, 0xa}, [@nested={0x18, 0x1e, [@typed={0xc, 0x61, @str=',ppp1@\x00'}, @typed={0x8, 0x4, @uid=r2}]}, @generic="c474f46934eaed8254f154c8f2d9055d1dafc503e51ba94c0c91d8ae7bd25e6b2becd9a74f23ab88183d48bf88c3f2021ca3f84deafb6fbc320a3b7aa97db44c7a4ac994484f1774bdfb47ed2b3376abdb45e4672dedf189b5dc0d1b0a0cb5476377111e8db9ec6f8e1d49add802cf9705dfed4c56d171b9ab073b9f937dce1990c7cbcb277ca063853f2667194345eca0278ada94e9a1c6d71ab4eb04fd5547bb8b6d923861daa55374b11b9fa19dd057eb381a04205ed51fea9ffb084ca7b22cbda413d050f59809c7987bc4b8983c1aa76997c3bfb906e76052c7255470d084029d79ddc49fdf9f58ef3a0a0763b580946cd65c0ab7b687c8cea9071a2be29364e34c6b30848b554ea9996b7d841d4f37f67dc8354335c6a190b25ac033db446a92038fbd777c21adb5006c0bd8264df002e3d3e249073fa1137931b86798f3b9f8fa4244bbafa5cb7f63a04c0b3512622fd995a59c8dd1fccfcbee94737dcfac18253e979673c0d703c156cc80d50bbca471dca416c34241996e161443d3fb6382035f716d7fee5ec6d1cd25036df303f67c77f972785eac89946b0d6aa8fa49aa8a4b9a6c82551fc36d45ca96b81364c857e57161cd457d158a22041398f5711df7a6546f2e96d5ccade0d69b612f2e6da531357057bc7b8d35455d32f992602d39f35e420036c4fc34ccc454ae2acc4742976e95ee92fa6e0e054d6edbce3a3cbd799535219e3ffa73a21bb4f24e66247fbcdc133c24b6f3743691df11c60609f0bd172b4cf36ee14b103cd43a527d9c3149cfc7865cff6710d90844b67d4a261d506a66cbdc154358b71f2e4b107644e5372601a7dfafccc3c9e340d0aa07cc64c48327f07f26c4c1a5f4f1902d94b0fd41e7e3a20498867f93b538acc2e564f494872c2e008a01213109175f76f3b06cfecf2d9f8929d96f4e81717eb8bc973ecb8f6d3073a599b5c7e2b945eedeb1d7783c23225e633ace7afa12fa2f25835510d1e0efeb8e2bee8cf29b1978e2bd74c9180e1b35d1745f2baef02c28faf99421d199f597e3e2a6798a49d3201c3bc22295241a1aeab00132220b1039975e7fa37214e96344150dafa21dc5c7065540ddd76b550b3d3a03bf49cde0b0f379f4d0b1751d04bc31b82ccfcef9b8309eccb0761d12ad4535069f800c583deff679f6e9af67df4c3971173dbec44be92083280721ee93aabf4b73e202c2aff4c2b015bbb157f5894838414d008f07a184949907b9ed920fd91f82d8d036fbbf983fbbb864054fba99f28a6cdb869dc4c838d6de8e6bcf130432d999a10a186feef2b0b97fd26a098c7abc5ab784e0e8962de4671c3f2c437088493a6088f20603ef6f0eafe3f96224919bfad01db6d3965ffa2694233084fc4102d0c5967cfae61de53697fc7afca242852e1ce32f1f76718d934af7a221774eb4e433431dcba7865c8f177a39de58f5cbc9da1f7401ef44f10440596678ce3711c33b1336e5fefb954d05022ad8eb1ad95babfc0f1d98ab2a4009329891f277155fc9605ae56a922bf37754d6aa7a02caf32f362584318ee88bd841614d5a3ebf85198cff87a69a195d28bf2d8e1e616627d55028d4747f8d29f7d50de9fd7fc9205fc796109241abc454ac5b745bea5b561322b397f1e20f823fc004b6cb72face2258d0c3e218a23da96b81136bbb5208e4b2805c542519b2605f8137cc565dfc2b628bac4c5ab00b589c65f105157c3bcb8e1da20444d753b0b47c80e1b847d3a792021bc72ae7265595ad31a62e4a1a2f3c8a2d67e4ec12d62125536cf1c3f6acd59fc75e4100fbc4be9d3cd63e306e2a2121cea21fc380b175dd73add3f0ddc30944f757ff16d1f42be891675b2aaddcb4f6f459c713a3683bd39f3816c9c988d3f608b2b97dc336a1157a386b015f32ea7d95a78c274f0d923f87abac24d60468ce8404d500fc743b85765a0ae1dd4be09354c8847284b234fd6791ddab33088543a2c944310246fb923fa12a4e971918f735dd43b8c9d601f2907bfa6b68af5011aa11e7cbbee91e0d3e28e2afb8936e42f1460a20c42b3c16405ede9e54cb94a6420d69e0ca0956e8c96f0ea35e8c32031041e6616af8ebab3e1087ee4c71c64eb6e1bffd3b58ff6e15726c2423594457cb539e09769224a8b16480c7ec2448ab7820189e6ce4402bb2ce284c7b7b8dbd35f442a91d3af0020dc5207990f61c2825bd122e7364abd8020548cdc1fb79dddb575125abf424b0e5d3692bef4359afdc113efdab9fe23776e2bd45e6adb8f26c7a3f4dc7bbd9c38cc9ed5035a24fb5241c041c3eca4670977d7675fef6796abdc8f5da4056dbb454ae6ccd1cf082c591505dd17886dd0ce9826b39572f17a2dc4df4843b34df8d84b6b78918f774fe61c708362f1dadac6c9346ee9a9fd4d54238f972a4004b6b677de868c84593f6e88b5f68498358ca34a2c50673a5f3691ac19a93d8a01740e548382e032523439652ecabb616536007286cde016f255e3f98f0423cfc5db639886d3a477b29073ae4f6dcb2e21338136db689ac9ea4a5ff9e39cafecb6678f8082b2577dd063a0a90a54d02b9a0e10723415b441f14be2d6a9465de27e02bb9bb4c1b7454fe95a5063f777b40a25657141d845b2bce8616c0fe51d4ccc536a367a5b4f2bb4c7f51ae7b3b118658159acbf95b7a57c41d5844df84ceb4a8ba1d6a6e5439083a70c1bddec7ce6c3e6d1bb0d819aad1e7761e5963013ab35a7d44ff4c35c22a26205495cab7badd4a5ac6f0b816bc027409a6eeee5843c15c345719b81cf2026d58d91839f6e7df85c1c6715fc5b4a9d8e8be6dfee41b7d81c05c124ef80ef8e995325ef39ddad43257e21097d0481b1c5820d90ab582b808e4db0193d48d5280cf6f2663af2c5a099bde1c3826ceb6bd1b4d4504ba07eff85496f20c0a554145e7b2697f04d455b330e706ac89b2a9e1167bf0f20f46ee65def28f128ecc0b6dcaa0ec67cfbdde96f69e25e06f75b9acc9e8430fb50a9fe854bad8dc0aa8a3d746a62f5e6a3614f87804ccb3212f7f78827393589876028866daba448a52967feadb6a7252e8798caac066382f4fb3e516c812e389bbf21c244085dcc85d0380c3885d570fa11cebd05f014532e27a1d929a94e3927293a0d623b440edb90cb79925aa0a2c228a32f4b2ce8fb6126b6c2b21cff27a4cc294da70323f7cb5366e6a381c3e766bf98a6a43c74ca528259bc5e327e32ed2b962b70e9999afc7bc197e1f290f3ad33064757821ef2d736227c308699907af77c67119c685016b61aca6a7adad4e3d60b92df65bf87faf48ab5fa94cfd57a4ec9599792034afafd6ed7768689ca8269a4e6c075e6d14fdf269ac62912fa3cc1a94cf7f0b6027eb9ec0e6adde20c1981ed7fcc2706189a84d48d7e5dff95d359c8df08130f22bff35ba821219e05a5216e38f8a1c1589a96655ac5470d0507ac9a545650c82ad844e488a1c078a5eca5e4973385e0937f42b8a968486ae2bdb66538f3805b537ee2efa6e4115cff518cba93ba21d0fbb447d2a10dd052ed9e0ca45505f2023c8bf4ddc2de8ff96c0e68b2faf8a484cea4d9dad8dc39c1d792ac576ce6a90fc0ecf4e45f05badde9d0b1c1428a7c6b056b13cc5bf6c0e8153fc2f65bb8f303de22fe1bb01db415f81e735398ce3788c39aa444a6b13a591c9ccbf2116404454067899dedebe9ce9d72cd74378a910f07dcbcb2f0d50731d1f602f7e296e9a32fb667ec1d9d3c6405cfed5b673ecb7312fdda9b90e2bb19827b091726eefce7bb6caed34fb4164e3ceb3e9cd74f62db9a5d5e04c357304282748b8f5d61e9cabe2941731f699bb408d2f10c0436b467cf766301730ce2bbd95feb2b3034b1468b1dbcb7230c5e3f1e43fd3df575bec27e4b767b16e0299ae45f7a13184f5e6a76252c467057a505817526d7506b79850737ba463a440cb8952b302af6f356610a9eecd6035eb1aabbe951596d6d0afc3df89ede1df843e405131abf338dce8b4696269d6eb6a773aa3de2f24178a1ee7504d9c0ddcd1cdbbac437b0fa9be22f4427018ae8287521bfdc2562964dd8cea7c2c145ec105a1cabc918e8e511243c0b839e4494e3660aef04fc4a4f74a5dc8a65d8e41c9426dceefd3c446cf3a72b89c908a5061bbd900d6886abf69cae84e2bff764dde473ebb88ba498346952bdd697bc257b59e10ad4ec19625fc348cb0a9d4fec39487c95f0ca8c4e03f4ecb6d68952617c40feeed56b3d5af7573ad9d10ff24a35710bf412781cdc460874e17261a71eac387e3f4015cdb30bba00b7051c8a771bc754aa1d2e0f7b2db133945d4c1c32f80accb2a54b1fc75e8ce3e9e04d57863e5bb99458725e9a4cedc85e7b10e835c23f55433591ddae69555eca3f9e78c79b4f198501b6e247f8337ade7a69e2acaf5dc678da137732b9af20a0d41df1da6711fa5cb46c2392593f4da9bbacb7104b96fe43fd6d8a5b63618c29972f5ffa4b65db7b4aa20b5803327883ff887198f1c0ba2eeb6240d502948c6ab62e0dbf563064da2cc95a980ffae1eefc7c4de540c7a3115e860fec12c5785a8a934aacfa829bb2f0d7e3fc093976688172796d7975ac8255ee15f38ccf780fa4b114f354376a8169ee726449e44ef6368fe331fe4bbf48ef4104e41ba8e41f3ec0666a75dc8af0a3cb951b14f584ced0568fa9e0a78b6d8d0e2a03b1e218f30ac05d8f4fdab6a61280664ffc1fc36f07ad047a929c9ad7e855b044000bb036a9e18bff15ebca49a2bfa4e5edc7cfd4ef5be4f92f40449b0a389e32a361b8720624b02cf0bc166ba41a4e7e3600003b4fb0e4052918bca64615b590ff543b8b924a7ad5189f7af357182cbdd931fcd2cfcdccbeb0e2e985b92d944cc0a520ed98d9494f561eac64e313134b70f4c3c081c7b8f5e7db6224a6422bf0e5e8b989b1bdb229f59ae45eda676ef50d370173de18e7ef90608d7ac7fd222370bf15f0ce6a569601a0429b8f923272e723eaf1d8bd661b0f11c767f9e09a68f0e86921a63de4c126722777c493d9394d6e56caa6eae5e1c456e75fecbd3df4de5dc09f5c2032c8e25d3d8c28194c3e089ea8ff7c6d31d9c03ec99c014feb6d9736e9a47ef9e739fb9e90ad400521f65c84ed229851002837842b0a5f6062b0affe7ed4f179d2f0b083fa51b919a3bbe3d70615ce1267a827cd6ecba6b3d1acfb19f9f08897372250e2bd1528a4aff27ec7b2a69c7a804d046de2b08524b6861337fc2c71389567fdca77eb4cab759c804b739b577b85f8ad1c9786885a55dcea91a597ee83922007d2382680d9d485203382752668ce0dc0f3ded1bc64c2d2569960a8a32e0323556bebc81cd3452565e93315894ff35856bbcf2dfdd0673517739ea12fd67ccc5b73fbf42154789a53d2d7559de4133588d99375fdc47ffc0eb5c8e15df197e0645019d827c0b9472e44c64201d59dbc3e9eef936a3e0cd8fd70ae5db0916086012ab0237a73b42541d62d2034623be575aae77ffe44e94d9f30a41bf30ecb8604b284ced5f48b87a634bd5f2b7113c3983be1775fe31d65adfcda00d62b91b772ee63714c1cf3cdbcce88f19d8d01d9cefbca956ad8f8b00e3efe6c9818699638ceb795703a1aa45de31ceb885621c4a832557223dade290e48bd79c007a876a4c3783b90c6d88bdcfacce548d288cb38c4888e3c466ad3d95bbf14cfa13de69d3bf735f9e922ac04436c20766fecb4163ee1a4f5b12005ca86d6dbeed28f49670320a241111bd839db442078e8dc54a", @typed={0xc, 0x63, @u64=0xffffffffffff526d}]}, 0x1038}, 0x1, 0x0, 0x0, 0x4}, 0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f00000001c0)=ANY=[@ANYRES64=r2], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x0, 0x0, 0x0}) [ 2294.217723][T27664] input: syz0 as /devices/virtual/input/input3075 [ 2294.228471][T19542] binder_thread_release: 12 callbacks suppressed [ 2294.228482][T19542] binder: release 27626:27665 transaction 3210 out, still active [ 2294.260517][T27665] binder: BINDER_SET_CONTEXT_MGR already set [ 2294.272022][T27669] input: syz0 as /devices/virtual/input/input3076 [ 2294.279610][T19542] binder: undelivered TRANSACTION_COMPLETE [ 2294.294565][T27668] binder_alloc: 27626: binder_alloc_buf, no vma [ 2294.304803][T19542] binder: undelivered TRANSACTION_COMPLETE [ 2294.317513][T27665] binder: 27626:27665 ioctl 40046207 0 returned -16 [ 2294.331784][T19542] binder: undelivered TRANSACTION_ERROR: 29201 [ 2294.339383][T19542] binder: undelivered TRANSACTION_ERROR: 29189 [ 2294.346041][T27668] binder: 27626:27668 transaction failed 29189/-3, size 0-0 line 3148 [ 2294.360621][T27675] input: syz0 as /devices/virtual/input/input3077 [ 2294.382650][T27670] input: syz0 as /devices/virtual/input/input3078 [ 2294.398630][T19542] binder: undelivered TRANSACTION_ERROR: 29189 11:28:24 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x10006) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000000006e9000000000000000000000000000000000000000000000000000000000100000000000000000000000000007083c39cfc74d7595c9ed944dfe6c43a32256b17aeabc8d5ff1d0a8885006922479d751e96a294ace7ce8df68ca66ff4e8855ccc6121b6a75a276a4ca85bf90eb7e225fffb7fffdfdf874f83ca6e75e9074495791e4553ada2bf0b816a90ff602bd38f792eef0e3a19e401a93d333020922ec888e28e59c3d5788b447a2b9c471899f89a6408e617010c156cb68564cd18f0fc08238ac0701cd4004"], 0x0, 0x0, 0x0}) r1 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vsock\x00', 0x80000, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffff9c, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x0, 0x0, 0x0}) ioctl$TIOCGLCKTRMIOS(r1, 0x5456, &(0x7f0000000100)={0x10000, 0x0, 0x8, 0x0, 0x7, 0x3, 0x9, 0x3, 0x8, 0x100, 0x6, 0x2}) r2 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) ioctl$NBD_CLEAR_SOCK(r1, 0xab04) getsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r2, 0x84, 0x8, &(0x7f0000000040), &(0x7f0000000080)=0x4) 11:28:24 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x7a00, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) [ 2294.504167][T27680] Unknown ioctl 21590 [ 2294.509250][T27680] Unknown ioctl 43780 [ 2294.600691][ T1470] binder: release 27761:27786 transaction 3213 out, still active [ 2294.622173][ T1470] binder: undelivered TRANSACTION_COMPLETE [ 2294.629788][T27786] binder: BINDER_SET_CONTEXT_MGR already set [ 2294.640863][T27786] binder: 27761:27786 ioctl 40046207 0 returned -16 [ 2294.640952][T27787] binder_alloc: 27761: binder_alloc_buf, no vma [ 2294.654236][ T1470] binder_send_failed_reply: 12 callbacks suppressed [ 2294.654243][ T1470] binder: send failed reply for transaction 3213, target dead [ 2294.669265][T27787] binder: 27761:27787 transaction failed 29189/-3, size 0-0 line 3148 [ 2294.678836][ T1470] binder: undelivered TRANSACTION_ERROR: 29189 11:28:25 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r1, 0xc02c5341, &(0x7f0000000280)={0x0, 0x0, 0x0, 'queue1\x00', 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe00000000000000]}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) 11:28:25 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00/\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) 11:28:25 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x16\x00'}, 0x45c) 11:28:25 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x1000000, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) 11:28:25 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = syz_open_dev$adsp(&(0x7f0000000000)='/dev/adsp#\x00', 0x7fff, 0x80000) ioctl$LOOP_SET_FD(r1, 0x4c00, r0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) ioctl$VIDIOC_QUERYBUF(r1, 0xc0585609, &(0x7f0000000080)={0x100, 0xf, 0x4, 0x200000, {r2, r3/1000+10000}, {0x4, 0xc, 0x140000000000000, 0x2, 0x8742, 0x7fffffff, "58a2f096"}, 0x10001, 0x3, @fd, 0x4}) ioctl$VIDIOC_ENUM_FRAMEINTERVALS(r1, 0xc034564b, &(0x7f0000000100)={0x0, 0x4f565559, 0x787, 0xffffffff, 0x3, @stepwise={{0x5, 0x40}, {0x100000001}, {0x2, 0x4}}}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="01634040", @ANYRES64=0x0, @ANYBLOB='\x00\x00 \x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) 11:28:25 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r1, 0xc0505350, &(0x7f0000000500)={{0xfffffffffffffffc, 0x80000000}, {0x3f, 0x8}, 0x2392, 0x5, 0x400}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) [ 2294.852786][T27801] binder: 27799:27801 transaction failed 29189/-22, size 0-0 line 2995 [ 2294.870939][T27802] input: syz0 as /devices/virtual/input/input3080 [ 2294.884792][T27800] input: syz0 as /devices/virtual/input/input3079 [ 2294.887014][ T1470] binder: release 27796:27803 transaction 3217 out, still active 11:28:25 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x2000000, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) [ 2294.915149][ T1470] binder: undelivered TRANSACTION_COMPLETE [ 2294.949278][ T1470] binder: release 27796:27813 transaction 3218 out, still active [ 2294.981825][ T1470] binder: undelivered TRANSACTION_COMPLETE [ 2294.990048][ T1470] binder: send failed reply for transaction 3217, target dead [ 2295.001912][ T1470] binder: send failed reply for transaction 3218, target dead [ 2295.020372][T27823] input: syz0 as /devices/virtual/input/input3081 11:28:25 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/policy\x00', 0x0, 0x0) recvfrom$llc(r1, &(0x7f0000000040)=""/151, 0x97, 0x20, &(0x7f0000000100)={0x1a, 0x0, 0x6, 0x200, 0x8, 0x4, @broadcast}, 0x10) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000001737a5d0912a0f29c158fe09470479a300"/68], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="01634040", @ANYRES64=0x0, @ANYBLOB="4444c222b27b1af5a3821f64a588e2a64bd69c9bf4c11476047e3ef2aff45f1d0c248524bc5e803800000000000000c8389aea520a0e4ab9f94e03fc"], 0x0, 0x0, 0x0}) prctl$PR_CAP_AMBIENT(0x2f, 0x1, 0x11) [ 2295.050095][T27829] input: syz0 as /devices/virtual/input/input3082 [ 2295.063983][T27919] binder: BINDER_SET_CONTEXT_MGR already set [ 2295.083463][ T1470] binder: send failed reply for transaction 3220 to 27864:27919 [ 2295.094465][T27920] binder: 27864:27920 transaction failed 29189/-22, size 0-0 line 2995 [ 2295.112813][ T1470] binder: undelivered TRANSACTION_ERROR: 29189 11:28:25 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00/\x00'}, 0x45c) [ 2295.142682][ T1470] binder: undelivered TRANSACTION_COMPLETE [ 2295.151389][T27919] binder: 27864:27919 ioctl 40046207 0 returned -16 [ 2295.164174][ T1470] binder: undelivered TRANSACTION_ERROR: 29189 [ 2295.193962][ T1470] binder: undelivered TRANSACTION_ERROR: 29189 [ 2295.215606][T27928] binder: 27925:27928 transaction failed 29189/-22, size 720110577066650257-2742617159 line 2995 11:28:25 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x3000000, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) 11:28:25 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00?\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) [ 2295.242017][T19542] binder: undelivered TRANSACTION_ERROR: 29189 [ 2295.305180][T27942] input: syz0 as /devices/virtual/input/input3083 [ 2295.358095][T27999] input: syz0 as /devices/virtual/input/input3084 [ 2295.384778][T28035] input: syz0 as /devices/virtual/input/input3085 11:28:25 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x0, 0x0, 0x0}) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x10000, 0x0) ioctl$sock_bt_bnep_BNEPCONNDEL(r1, 0x400442c9, &(0x7f0000000040)={0x200, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) [ 2295.414897][ T1470] binder: release 27979:28041 transaction 3224 out, still active [ 2295.429009][ T1470] binder: undelivered TRANSACTION_COMPLETE [ 2295.438140][T28041] binder: BINDER_SET_CONTEXT_MGR already set [ 2295.474070][T28041] binder: 27979:28041 ioctl 40046207 0 returned -16 [ 2295.483370][ T1470] binder: send failed reply for transaction 3224, target dead [ 2295.504231][T28047] binder: 28046:28047 transaction failed 29189/-22, size 0-0 line 2995 [ 2295.519802][T28043] binder: 27979:28043 transaction failed 29189/-22, size 0-0 line 2995 11:28:26 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r1, 0xc02c5341, &(0x7f0000000280)={0x0, 0x0, 0x0, 'queue1\x00', 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f00000000000000]}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) 11:28:26 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\xff\xff\xff\xfe\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) 11:28:26 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x4000000, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) 11:28:26 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x03\x00'}, 0x45c) 11:28:26 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x0, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r1, 0xc0505350, &(0x7f0000000500)={{0xfffffffffffffffc, 0x80000000}, {0x3f, 0x8}, 0x2392, 0x5, 0x400}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) 11:28:26 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@\x00'/68], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x0, 0x0, 0x0}) [ 2295.836384][T28161] binder: 28160:28161 transaction failed 29189/-22, size 0-0 line 2995 [ 2295.859276][ T1470] binder: release 28156:28168 transaction 3229 out, still active [ 2295.868634][T28166] input: syz0 as /devices/virtual/input/input3088 [ 2295.879789][T28164] input: syz0 as /devices/virtual/input/input3087 [ 2295.892728][T28168] binder: BINDER_SET_CONTEXT_MGR already set [ 2295.899925][ T1470] binder: undelivered TRANSACTION_COMPLETE [ 2295.918787][T28168] binder: 28156:28168 ioctl 40046207 0 returned -16 [ 2295.927074][ T1470] binder: send failed reply for transaction 3229, target dead [ 2295.959808][T28231] input: syz0 as /devices/virtual/input/input3089 [ 2295.980526][T28170] input: syz0 as /devices/virtual/input/input3090 11:28:26 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x5000000, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) 11:28:26 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\xfe\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) 11:28:26 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20ncci\x00', 0x4a0200, 0x0) setsockopt$netrom_NETROM_T1(r1, 0x103, 0x1, &(0x7f0000000200)=0x3, 0x4) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000000080)='TIPC\x00') sendmsg$TIPC_CMD_SHOW_LINK_STATS(r1, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0xb00}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x30, r2, 0x100, 0x70bd2b, 0x25dfdbfb, {{}, 0x0, 0xb, 0x0, {0x14, 0x14, 'broadcast-link\x00'}}, ["", "", "", "", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0xbe7d78288e385d02}, 0x40081) link(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)='./file0\x00') ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="01634040", @ANYRES64=0x0, @ANYBLOB="00000504009b0a6403e8cc15ad5bbf21dd61f8a1e1e1305ef250b6c08b0c0426b4d7a6fecce475ca069689715eceda8a537e1a4f39c7ebf1708dd04ba3cddae8d8edc2754b04f6512b18bd7df78009d8cf3771f2f88a88f543dc3d3f9dd4fc6265b6d43a34d4aff17763816f3a65b2467321dc475b86cb4bb0"], 0x0, 0x0, 0x0}) 11:28:26 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x05\x00'}, 0x45c) [ 2296.191003][T28288] input: syz0 as /devices/virtual/input/input3091 [ 2296.199573][ T1470] binder: release 28286:28291 transaction 3232 out, still active [ 2296.214554][T28291] binder: BINDER_SET_CONTEXT_MGR already set [ 2296.244112][T28291] binder: 28286:28291 ioctl 40046207 0 returned -16 [ 2296.251419][T28294] input: syz0 as /devices/virtual/input/input3092 [ 2296.272120][T28297] input: syz0 as /devices/virtual/input/input3093 [ 2296.282167][ T1470] binder: release 28286:28293 transaction 3233 out, still active [ 2296.328869][T28363] input: syz0 as /devices/virtual/input/input3094 11:28:26 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x6000000, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) 11:28:26 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) [ 2296.379291][ T1470] binder: send failed reply for transaction 3232, target dead [ 2296.409816][ T1470] binder: send failed reply for transaction 3234 to 28290:28295 [ 2296.476302][ T1470] binder: send failed reply for transaction 3233, target dead [ 2296.496394][T28408] binder: BINDER_SET_CONTEXT_MGR already set [ 2296.505104][T28408] binder: 28405:28408 ioctl 40046207 0 returned -16 [ 2296.505204][T28409] binder_alloc: 28405: binder_alloc_buf, no vma [ 2296.512793][ T1470] binder: send failed reply for transaction 3236 to 28405:28408 [ 2296.530175][T28410] input: syz0 as /devices/virtual/input/input3095 [ 2296.575402][T28412] input: syz0 as /devices/virtual/input/input3096 11:28:27 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r1, 0xc02c5341, &(0x7f0000000280)={0x0, 0x0, 0x0, 'queue1\x00', 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfeffffff00000000]}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) 11:28:27 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000000000000000000000000000000000000000000006000000000000000000000000000000000000000000002de77aab"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x0, 0x0, 0x0}) 11:28:27 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x7000000, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) 11:28:27 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x11\x00'}, 0x45c) 11:28:27 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x02\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) 11:28:27 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x0, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r1, 0xc0505350, &(0x7f0000000500)={{0xfffffffffffffffc, 0x80000000}, {0x3f, 0x8}, 0x2392, 0x5, 0x400}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) [ 2296.814601][T28425] input: syz0 as /devices/virtual/input/input3097 [ 2296.823963][T28427] input: syz0 as /devices/virtual/input/input3098 [ 2296.900929][ T1470] binder: release 28422:28521 transaction 3241 out, still active [ 2296.912382][T28517] input: syz0 as /devices/virtual/input/input3099 [ 2296.933811][T28521] binder: BINDER_SET_CONTEXT_MGR already set 11:28:27 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$EXT4_IOC_ALLOC_DA_BLKS(r0, 0x660c) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000d00000000000000000100"/68], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="01634017ffce211e34d4906e7c839e330540", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) r1 = openat(0xffffffffffffffff, &(0x7f00000001c0)='./file0\x00', 0xa0881, 0x40) ioctl$SIOCGSTAMPNS(r1, 0x8907, &(0x7f0000000200)) r2 = fcntl$dupfd(r0, 0x406, r0) io_setup(0x1, &(0x7f0000000040)=0x0) io_cancel(r3, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x7, 0x2, r2, &(0x7f0000000080)="c1e01b3609f017911ae5f5c1bb22b0efc8de28e7f23d903a291a44591bbd0ea5e8a7e02730e488b6e8a65c09ac99b8fd285bc6de0b036872377abf6b12a877b6bbe584dfcc87b547e70b51dede8682eada482cb7ccfae611cb36908a431864cb051bd809faeec3f4093818c65e1f8ced54177262d6447b9b1b049d1cdee5", 0x7e, 0xffff, 0x0, 0x1, r2}, &(0x7f0000000140)) setsockopt$inet_mtu(r2, 0x0, 0xa, &(0x7f0000000000)=0x2, 0x4) [ 2296.953110][ T1470] binder: send failed reply for transaction 3241, target dead [ 2296.964541][T28521] binder: 28422:28521 ioctl 40046207 0 returned -16 [ 2296.971430][T28519] input: syz0 as /devices/virtual/input/input3100 11:28:27 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x20000000, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) 11:28:27 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) 11:28:27 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x12\x00'}, 0x45c) [ 2297.091421][T28549] binder: 28546:28549 ioctl 660c 0 returned -22 [ 2297.188457][T28600] input: syz0 as /devices/virtual/input/input3101 [ 2297.206139][T19542] binder: release 28550:28585 transaction 3244 out, still active [ 2297.222896][T28585] binder: BINDER_SET_CONTEXT_MGR already set [ 2297.238005][T28645] input: syz0 as /devices/virtual/input/input3102 [ 2297.261830][T28655] input: syz0 as /devices/virtual/input/input3103 [ 2297.278996][T19542] binder: send failed reply for transaction 3244, target dead 11:28:27 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) ioctl$PPPIOCSFLAGS(r1, 0x40047459, &(0x7f0000000040)=0x1000020) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x0, 0x0, 0x0}) [ 2297.286830][T28585] binder: 28550:28585 ioctl 40046207 0 returned -16 [ 2297.325466][T28665] input: syz0 as /devices/virtual/input/input3104 11:28:27 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x3f000000, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) [ 2297.525712][T19542] binder: send failed reply for transaction 3247, target dead 11:28:28 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r1, 0xc02c5341, &(0x7f0000000280)={0x0, 0x0, 0x0, 'queue1\x00', 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff00000000]}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) 11:28:28 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x04\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) 11:28:28 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x14\x00'}, 0x45c) 11:28:28 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000000)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x0, 0x0, 0x0}) 11:28:28 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x48000000, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) 11:28:28 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x0, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r1, 0xc0505350, &(0x7f0000000500)={{0xfffffffffffffffc, 0x80000000}, {0x3f, 0x8}, 0x2392, 0x5, 0x400}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) [ 2297.863876][T28788] input: syz0 as /devices/virtual/input/input3106 [ 2297.880124][T28790] input: syz0 as /devices/virtual/input/input3105 [ 2297.880621][T19542] binder_release_work: 11 callbacks suppressed [ 2297.880628][T19542] binder: undelivered TRANSACTION_ERROR: 29189 [ 2297.942758][T28797] input: syz0 as /devices/virtual/input/input3107 [ 2297.962835][T28788] input: syz0 as /devices/virtual/input/input3108 11:28:28 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x4c000000, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) 11:28:28 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x15\x00'}, 0x45c) 11:28:28 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x05\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) 11:28:28 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0x2, 0x101000) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dlm_plock\x00', 0x40000, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(r1, 0x89e1, &(0x7f0000000080)={r2}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x0, 0x0, 0x0}) [ 2298.104741][T19542] binder: undelivered TRANSACTION_ERROR: 29189 [ 2298.133111][T28910] binder: BINDER_SET_CONTEXT_MGR already set [ 2298.163151][T28913] binder_alloc: 28908: binder_alloc_buf, no vma [ 2298.166785][T19542] binder: send failed reply for transaction 3256 to 28908:28910 [ 2298.169702][T28910] binder: 28908:28910 ioctl 40046207 0 returned -16 [ 2298.195549][T28913] binder_transaction: 8 callbacks suppressed [ 2298.195567][T28913] binder: 28908:28913 transaction failed 29189/-3, size 0-0 line 3148 11:28:28 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x60000000, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) [ 2298.211170][T19542] binder: undelivered TRANSACTION_ERROR: 29189 [ 2298.219240][T28919] input: syz0 as /devices/virtual/input/input3110 [ 2298.234004][T19542] binder: undelivered TRANSACTION_ERROR: 29189 [ 2298.251116][T28920] input: syz0 as /devices/virtual/input/input3109 [ 2298.278847][T28925] binder: 28921:28925 transaction failed 29189/-22, size 0-0 line 2995 [ 2298.293501][T28927] input: syz0 as /devices/virtual/input/input3111 [ 2298.314980][T22689] binder: undelivered TRANSACTION_ERROR: 29189 [ 2298.340383][T28923] input: syz0 as /devices/virtual/input/input3112 11:28:28 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x11\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) [ 2298.542413][T29038] input: syz0 as /devices/virtual/input/input3113 [ 2298.588459][T29042] input: syz0 as /devices/virtual/input/input3114 11:28:29 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r1, 0xc02c5341, &(0x7f0000000280)={0x0, 0x0, 0x0, 'queue1\x00', 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe]}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) 11:28:29 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x16\x00'}, 0x45c) 11:28:29 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/qat_adf_ctl\x00', 0x200100, 0x0) ioctl$TIOCLINUX2(r1, 0x541c, &(0x7f0000000040)={0x2, 0xff, 0x80000001, 0x100000001, 0x419, 0x100}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x0, 0x0, 0x0}) 11:28:29 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x68000000, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) 11:28:29 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) 11:28:29 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(0xffffffffffffffff, 0xc0505350, &(0x7f0000000500)={{0xfffffffffffffffc, 0x80000000}, {0x3f, 0x8}, 0x2392, 0x5, 0x400}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) [ 2298.868093][T29053] input: syz0 as /devices/virtual/input/input3115 [ 2298.892644][T29052] input: syz0 as /devices/virtual/input/input3116 [ 2298.911395][T22689] binder_release_work: 13 callbacks suppressed [ 2298.911401][T22689] binder: undelivered TRANSACTION_COMPLETE [ 2298.935678][T29059] binder: 29051:29059 got reply transaction with bad transaction stack, transaction 3265 has target 29050:0 [ 2298.944892][T22689] binder: undelivered TRANSACTION_COMPLETE [ 2298.951366][T29059] binder: 29051:29059 transaction failed 29201/-71, size 0-0 line 2915 [ 2298.965778][T22689] binder: undelivered TRANSACTION_COMPLETE [ 2298.973123][T22689] binder: undelivered TRANSACTION_ERROR: 29201 11:28:29 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x6c000000, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) [ 2299.009783][T29089] input: syz0 as /devices/virtual/input/input3117 [ 2299.021103][T22689] binder: send failed reply for transaction 3268 to 29051:29059 [ 2299.038342][T29060] input: syz0 as /devices/virtual/input/input3118 11:28:29 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x14\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) 11:28:29 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x7ff) r1 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x10, r0, 0x0) r2 = open(&(0x7f0000000580)='./file0\x00', 0x0, 0x1) ioctl$SG_NEXT_CMD_LEN(r2, 0x2283, &(0x7f00000005c0)=0x42) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000300)='io.stat\x00', 0x0, 0x0) getsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(0xffffffffffffffff, 0x84, 0x22, &(0x7f0000000340)={0x6, 0x206, 0xde, 0x1f, 0x0}, &(0x7f0000000480)=0x10) setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r3, 0x84, 0x6, &(0x7f00000004c0)={r4, @in={{0x2, 0x4e23, @local}}}, 0x84) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0xffffffffffffff97, 0x0, &(0x7f0000000380)=[@free_buffer={0x40086303, r1}, @decrefs={0x40046307, 0x1}, @reply={0x40406301, {0x1, 0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=[@ptr={0x70742a85, 0x1, &(0x7f0000000040), 0x0, 0x3, 0x30}, @ptr={0x70742a85, 0x0, &(0x7f0000000080), 0x0, 0x0, 0x36}], &(0x7f0000000180)=[0x38, 0x78, 0x18, 0x28, 0x28, 0x70]}}, @transaction={0x40406300, {0x2, 0x0, 0x3, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)=[@fd={0x66642a85, 0x0, r0, 0x0, 0x3}, @fd={0x66642a85, 0x0, r0, 0x0, 0x4}, @ptr={0x70742a85, 0x0, &(0x7f00000001c0), 0x0, 0x1, 0x1e}], &(0x7f0000000280)=[0x38, 0x38, 0x48, 0x38, 0x48, 0x78, 0x30, 0x30]}}, @free_buffer={0x40086303, r1}], 0x0, 0x0, 0x0}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000600)={'syzkaller1\x00', 0x0}) ioctl$TUNSETIFINDEX(r3, 0x400454da, &(0x7f0000000640)=r5) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="01634040", @ANYRES64=0x0, @ANYBLOB="978eae2000e6fb01000000"], 0x0, 0x0, 0x0}) 11:28:29 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x1f\x00'}, 0x45c) [ 2299.155792][T22689] binder: undelivered TRANSACTION_COMPLETE [ 2299.162461][T22689] binder: undelivered TRANSACTION_ERROR: 29189 [ 2299.202192][T22689] binder: undelivered TRANSACTION_COMPLETE [ 2299.211121][T29180] binder: BINDER_SET_CONTEXT_MGR already set [ 2299.232129][T29180] binder: 29174:29180 ioctl 40046207 0 returned -16 11:28:29 executing program 0: r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000380)='/dev/dsp\x00', 0x101, 0x0) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, &(0x7f0000000040)={0x3, [0x0, 0x0, 0x0]}, &(0x7f0000000080)=0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f00000000c0)={r1, 0x3}, 0x8) r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x0, 0x0, 0x0}) write$UHID_CREATE(r0, &(0x7f0000000140)={0x0, 'syz0\x00', 'syz1\x00', 'syz0\x00', &(0x7f0000000100)=""/26, 0x1a, 0x8, 0xe000, 0x6, 0x3, 0x7}, 0x120) [ 2299.260307][T29181] binder: 29174:29181 transaction failed 29189/-22, size 0-0 line 2995 [ 2299.274128][T29185] input: syz0 as /devices/virtual/input/input3119 [ 2299.295793][T22689] binder: undelivered TRANSACTION_ERROR: 29189 11:28:29 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x74000000, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) [ 2299.319271][T29187] input: syz0 as /devices/virtual/input/input3120 [ 2299.400964][T29195] input: syz0 as /devices/virtual/input/input3122 [ 2299.523044][ T1470] binder_thread_release: 10 callbacks suppressed [ 2299.523056][ T1470] binder: release 29199:29202 transaction 3273 out, still active [ 2299.536521][ T1470] binder: undelivered TRANSACTION_COMPLETE [ 2299.543825][T29202] binder: BINDER_SET_CONTEXT_MGR already set [ 2299.557142][T29203] binder: 29199:29203 transaction failed 29189/-22, size 0-0 line 2995 [ 2299.569594][T29202] binder: 29199:29202 ioctl 40046207 0 returned -16 [ 2299.583017][ T1470] binder: undelivered TRANSACTION_ERROR: 29189 11:28:30 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r1, 0xc02c5341, &(0x7f0000000280)={0x0, 0x0, 0x0, 'queue1\x00', 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe00]}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) 11:28:30 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x15\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) 11:28:30 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/dsp\x00', 0x80, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_LIST(r1, 0xc0505510, &(0x7f0000000480)={0x9, 0x1, 0x6, 0x7, &(0x7f0000000380)=[{}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@\x00'/62], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xfffffffffffffe82, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x0, 0x0, 0x0}) r2 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x5, 0x40080) ioctl$EXT4_IOC_ALLOC_DA_BLKS(r1, 0x660c) ioctl$TIOCGSID(0xffffffffffffff9c, 0x5429, &(0x7f0000000040)=0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r2, 0xc1105511, &(0x7f0000000100)={{0x1, 0x5, 0x10200, 0x5, 'syz0\x00', 0x7}, 0x5, 0x400, 0x800, r3, 0x8, 0xfffffffffffffff8, 'syz1\x00', &(0x7f0000000080)=['/dev/binder#\x00', 'procproc,!(bdevcpuset\x00', '/dev/binder#\x00', '!em0bdev,\'GPL]user\x00', '/dev/binder#\x00', '/dev/binder#\x00', '\x00', '/dev/binder#\x00'], 0x6b, [], [0x1, 0x5, 0x1, 0x29]}) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000600)) getsockopt$inet_IP_IPSEC_POLICY(r2, 0x0, 0x10, &(0x7f0000000500)={{{@in6=@loopback, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast2}, 0x0, @in6=@dev}}, &(0x7f0000000340)=0xe8) getgroups(0x1, &(0x7f00000003c0)=[0xee00]) fchown(r2, r4, r5) 11:28:30 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00/\x00'}, 0x45c) 11:28:30 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x7a000000, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) 11:28:30 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(0xffffffffffffffff, 0xc0505350, &(0x7f0000000500)={{0xfffffffffffffffc, 0x80000000}, {0x3f, 0x8}, 0x2392, 0x5, 0x400}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) [ 2299.894015][T29218] input: syz0 as /devices/virtual/input/input3123 [ 2299.898147][T29217] binder: 29213:29217 transaction failed 29189/-22, size 0-0 line 2995 [ 2299.917304][T29216] input: syz0 as /devices/virtual/input/input3124 [ 2299.920164][ T1470] binder: release 29212:29222 transaction 3277 out, still active [ 2299.939031][T29222] binder: BINDER_SET_CONTEXT_MGR already set [ 2299.949692][ T1470] binder: undelivered TRANSACTION_COMPLETE [ 2299.962802][T29223] binder_alloc: 29212: binder_alloc_buf, no vma [ 2299.972896][ T1470] binder_send_failed_reply: 10 callbacks suppressed [ 2299.972903][ T1470] binder: send failed reply for transaction 3277, target dead [ 2299.987166][T29222] binder: 29212:29222 ioctl 40046207 0 returned -16 11:28:30 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000080)='/proc/self/net/pfkey\x00', 0x101000, 0x0) accept4$llc(r1, &(0x7f00000000c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, &(0x7f0000000100)=0x10, 0x80000) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r2 = socket$inet6_dccp(0xa, 0x6, 0x0) getpeername$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, &(0x7f0000000040)=0x1c) [ 2300.006951][T29223] binder: 29212:29223 transaction failed 29189/-3, size 0-0 line 3148 [ 2300.035555][T21720] binder: undelivered TRANSACTION_ERROR: 29189 [ 2300.043027][T29226] input: syz0 as /devices/virtual/input/input3125 11:28:30 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x16\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) 11:28:30 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x100000000000000, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) 11:28:30 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00?\x00'}, 0x45c) [ 2300.156062][T29238] binder: 29235:29238 transaction failed 29189/-22, size 0-0 line 2995 [ 2300.252390][T29264] input: syz0 as /devices/virtual/input/input3127 [ 2300.263403][T21720] binder: release 29242:29288 transaction 3281 out, still active [ 2300.278849][T29288] binder: BINDER_SET_CONTEXT_MGR already set [ 2300.286323][T21720] binder: undelivered TRANSACTION_COMPLETE [ 2300.295444][T29288] binder: 29242:29288 ioctl 40046207 0 returned -16 [ 2300.302957][T21720] binder: send failed reply for transaction 3281, target dead [ 2300.312678][T29335] input: syz0 as /devices/virtual/input/input3128 [ 2300.319501][T29313] binder: 29242:29313 transaction failed 29189/-22, size 0-0 line 2995 11:28:30 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="01634040", @ANYRES64=0x0, @ANYBLOB="00000000000000000ff3dbf4566753242176dce6a4fec93ee67656f043ab5ced74dbc712d6cc73adc8601c0945d1e0823ac9fe676d1b687aafc882c7ecb370771b4011c1ddfed8cb48a40397dd62eb0b0088eddb5ba051b0dd4433d1cf34d72f61c60584edd98478742c99084332ac8fda1635594ab1d1c4e9d6199ba383a8a09730cc25e4b48afe46d6179fddbdd1b8c1ed791959cbd40b57d6794cc1254a4eb774b427855f2863d85ee9fcca8548ed053369b7efa6e307deb85d3ecf3a36b5839b941da5"], 0x0, 0x0, 0x0}) [ 2300.367724][T29352] input: syz0 as /devices/virtual/input/input3129 [ 2300.405777][T29351] input: syz0 as /devices/virtual/input/input3130 11:28:30 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x200000000000000, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) [ 2300.512640][T29360] binder: 29356:29360 transaction failed 29189/-22, size 0-0 line 2995 [ 2300.584252][T21720] binder: release 29361:29364 transaction 3286 out, still active [ 2300.595125][T21720] binder: undelivered TRANSACTION_COMPLETE [ 2300.602543][T29364] binder: BINDER_SET_CONTEXT_MGR already set [ 2300.614508][T29364] binder: 29361:29364 ioctl 40046207 0 returned -16 [ 2300.621729][T21720] binder: send failed reply for transaction 3286, target dead 11:28:31 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r1, 0xc02c5341, &(0x7f0000000280)={0x0, 0x0, 0x0, 'queue1\x00', 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f00]}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) 11:28:31 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) 11:28:31 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x00\x00\x01\x00'}, 0x45c) 11:28:31 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x0, 0x0, 0x0}) syz_open_dev$rtc(&(0x7f0000000000)='/dev/rtc#\x00', 0x8000000000, 0x181042) 11:28:31 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x300000000000000, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) 11:28:31 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(0xffffffffffffffff, 0xc0505350, &(0x7f0000000500)={{0xfffffffffffffffc, 0x80000000}, {0x3f, 0x8}, 0x2392, 0x5, 0x400}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) [ 2300.898936][T22689] binder: release 29474:29480 transaction 3289 out, still active [ 2300.909264][T29480] binder: BINDER_SET_CONTEXT_MGR already set [ 2300.924806][T22689] binder: undelivered TRANSACTION_COMPLETE [ 2300.934695][T29482] binder_alloc: 29474: binder_alloc_buf, no vma [ 2300.941898][T22689] binder: send failed reply for transaction 3289, target dead 11:28:31 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x400000000000000, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) [ 2300.951168][T29480] binder: 29474:29480 ioctl 40046207 0 returned -16 [ 2300.957765][T29485] input: syz0 as /devices/virtual/input/input3131 [ 2300.981462][T29486] input: syz0 as /devices/virtual/input/input3132 [ 2301.045402][T29552] input: syz0 as /devices/virtual/input/input3133 [ 2301.067056][T29560] input: syz0 as /devices/virtual/input/input3134 11:28:31 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x0, 0x0, 0x0}) r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/mixer\x00', 0x40000, 0x0) write$P9_RSETATTR(r1, &(0x7f0000000040)={0x7, 0x1b, 0x1}, 0x7) 11:28:31 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00/\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) [ 2301.160037][T22689] binder: release 29597:29601 transaction 3294 out, still active [ 2301.172915][T29601] binder: BINDER_SET_CONTEXT_MGR already set 11:28:31 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x00\x00\x02\x00'}, 0x45c) [ 2301.213828][T29601] binder: 29597:29601 ioctl 40046207 0 returned -16 [ 2301.216655][T22689] binder: send failed reply for transaction 3294, target dead [ 2301.313548][T29614] input: syz0 as /devices/virtual/input/input3135 [ 2301.339486][T29659] input: syz0 as /devices/virtual/input/input3136 11:28:31 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00?\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) [ 2301.417720][T29715] input: syz0 as /devices/virtual/input/input3138 11:28:31 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x500000000000000, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) [ 2301.575317][T29725] input: syz0 as /devices/virtual/input/input3139 [ 2301.619371][T22689] binder: release 29726:29728 transaction 3299 out, still active [ 2301.640639][T21720] binder: send failed reply for transaction 3299, target dead [ 2301.660004][T29729] input: syz0 as /devices/virtual/input/input3140 [ 2301.673463][T21720] binder: send failed reply for transaction 3301 to 29726:29730 11:28:32 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r1, 0xc02c5341, &(0x7f0000000280)={0x0, 0x0, 0x0, 'queue1\x00', 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe000000]}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) 11:28:32 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x00\x00\x03\x00'}, 0x45c) 11:28:32 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\xff\xff\xff\xfe\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) 11:28:32 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x600000000000000, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) 11:28:32 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r1, 0xc0505350, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) 11:28:32 executing program 0: r0 = socket$inet_dccp(0x2, 0x6, 0x0) getpeername(r0, &(0x7f0000000000)=@vsock={0x28, 0x0, 0x0, @my}, &(0x7f0000000080)=0x80) r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x0, 0x0, 0x0}) [ 2301.818025][T29740] input: syz0 as /devices/virtual/input/input3141 [ 2301.849531][T29742] input: syz0 as /devices/virtual/input/input3142 [ 2301.884099][T29744] input: syz0 as /devices/virtual/input/input3143 11:28:32 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x00\x00\x04\x00'}, 0x45c) [ 2301.967365][T29769] input: syz0 as /devices/virtual/input/input3144 [ 2301.978305][T22689] binder: release 29750:29755 transaction 3304 out, still active [ 2301.997087][T29755] binder: BINDER_SET_CONTEXT_MGR already set 11:28:32 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) io_setup(0xffffffffffff0001, &(0x7f0000000000)=0x0) fsetxattr$trusted_overlay_opaque(r0, &(0x7f0000000100)='trusted.overlay.opaque\x00', &(0x7f0000000140)='y\x00', 0x2, 0x3) r2 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dsp\x00', 0x42000, 0x0) io_cancel(r1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x4, r0, &(0x7f0000000480)="c7c3dee2acda4cbc6fda15d123f4a8add5ac94a3598554d6d8e409d8084aa2ad7a30e87cee49f0d52bd0ceed4b88af566bfa861dd4aecff7c2da4f492e7983a269531cfa310cb90351789567ff1adaf220339777e8d193539229b1998bd379a728f895bb0f4d8965f9feb3e297a20c59fde074f201c33b792ff103c94304fb3fb2dbadd75144dbe2cfee5d0ec1aabae484ae091aaf52d7702cb289e093cffae7107f4c1e995c5a76d42b681a46c3ac1c8d3f08aa51c0e0fe944cfd44232bbccab74c9229ef002ddf80778f13e7f1e75b02d936d6a573fad3a46e5f80a550cce6a2dae7ceb8db405d3fa05f75bc1dcd5a936e955ea39baeb24daec439425851c026988c49230ef99c35d0ae0c3a1b59d22f748eb98386b71634c23106234b4ff8b6cbb3d3627bf46a8af50c23c7350c2f154879c58be124e52c9323f30ec16595fa6ac4c4044b05bf3b6e373dbe0941967935c6cac29129c348235918a1c91941603c9b1226b0535a3f469928b5cbe53b8427d16004b35121435beabee32090e8b59d3224d045f60d4863c8322b0a0a802d8c5f254b7ddee425019aede9d8df142e3580ce04866c7214b05a2a77c39c1fcbc4094a656f74fa5391fd21dc343dc5765813140128392cbfba974cfb98dfe34f1675f6024de92aaa05bf7c191b5a9e4aa8bd3eb45ed138a3dfa4150341e4e98b8cf68e2b1358d2cae3e38ccaa383521c8553dfb006026bc019d8dda1b204e14797dc576d771752351202e89c267f696cee599e5bcdc4e2602c9d74c4b4138cd003f9e97560db381c0f9ff56ce1ba6a206adc2918d1285784183a23f83c42fd387d9378a672c0540b7ea460ea892e085a571773a40f4e999d5ef57c0c4a76efeef4dff5977a872b3f491fa17258795f6c6da3bfaaf5897df1114935479276fce33bbb07d39f3db9e898adf6acafac73d3498691320481305cbb699a07c3cb0047c6ad699f98d9ff9cc54ae5fef16bc41760801898efd56df9067495c3e98e3ba6ea4b14d73da1681ec283da51f7d791bffdeec63ade2fb91807148127d3ffdf4c54c36c908ccffeeb2cbf38e4fd28f568d7ab90eb868a2dfe32fe2a5076c01092252fa49f910497b8be5efc085e7cbc2dd9c1cc579b5797c9c425eada84818243a2c5ff1255a16850c0ac42c5909ab567b7d2b1c4b6be1bd87c855b123a3b4dd9b6c87fc4c783760649527d7b4afd6895c4c6b7869f0ef625b98adf7c445b5d7de9109afa5b26825ccf6519c75c432cbaa1c741708ce412214b6ce6d67f878ea7e5322fa0cfdab510150458f6ac277067a8ffbf52d85e79271fd56b00ed4626a99a1349235cc8ca54b5d40b6321052b3de2d8d319f3f2194535edffb1e32cf0ece8c184cce91019c9e3c557b554d143d8d90e1b5ace4ae9cbe6f5aee55b77041e1e23394419c255bbb2f5fe5a07e82d15cd22c8f2fcffe3ae455637fb811cf4b9722210005f81debefb53da5e8e3c3669a53a31ccd8bec351500a5a94e742ccd3a3cfc31941c5019d89413e053422cc2a01e07a5ee48e4447f4d5af84a97a26425d46fec51d8888ffbc094ffe958d57d32c957986c733438fdf27f42f7f2b4400721b342e9ef2430828a22605fbaec74cd6886b68be3d86aef9442acddae81330b48a3da24cc40121c040d9c891eaa7f9840f4b00c9265fce4b38fd9539a95fedfa20a631132c6af7cc80c0f42ef6a07dc10db85971f565294932e155da10f31f1cd8704da11f316265d760582b43985d90a86b795567012b13190ce92b50b57e93e0e2bb9888328179dca15e92cf4a4ea4b0553ec6491f10244dfdc125082ff3c236c260ccfb9ba8f82b5428674534553a8abaffd5cd7ae4339117c3edc9e321b5ba116e6d40dc86d42a5c516c7901cac1690aa149fadd09b20b691204146f20ee6d71072de27971072cbaadac9fe2feeeee31844f4a86bbfde65ac6bea61f7d02d1350a8a5eec01eddb2f52ac3c591ec23e73cf8535bb082e127cab877ef26a12d69ac109278d475b3c09ba689050cb03664ff461679d7ea71c531303dfc35ec104d412843f2da920c9b34892a13f23b4b1a7454009512381abfc04508c73898d5b08147ff451358e62f93d9906ca95e75e49fc32b4417dcf4caee0dfbaea7e8fbf493a530a7816306b0fb9119cb75d7e5332ba1911b05256e4dd8fa4b878e462eed3b206909ed5e530b01ec6504512cc9650b652e641d196f8dc385557311d16be56a410ef965eaa8a476c9531a2bc30d015e0b9570cc27c830fb7c8719720edfaae24649eb690feb06570fa312a3d43b6606e061090bfc83e283bcaa0595420feee90052d09820fd845e802f50fc5b7339e0dc94eaf3c0c47701795790ffcee8658b49486d344496d17b1ce54a9f34b8c347f504e6e821c0bc0b3348fd3ae11012b6d7cea665987f61ae8a15bb2f0f43b8a9b46c8cf0cd015f93373d6a2b23fe8e0453783127ac6a8b1f8b318d94a11f9c4c65206a24b79b830d426ad377e20250195c133d602bda81440ca87b36f8ddac01261b2d8c44e2d004862708ab27d248446e783097dd317d90c86443539f21a4745a76cb9e707c6858a2eba7062ea3ce3f1d58449a7a8f750077beeb4c2c58238ac0b111aaa77b77473bc4aaf359c128bad69ebd8859f1ee1a18713bf3cd04239746e83afdbdefb728a782a25ec7305162d6aa2b989ea1d668f80fef693dfdbfec35e80123c13279b32b1e616c47fc9a10c4ea6d584666899dd919643d066f828a1af728f864fb2801cc53e759760bc946161cac075afd6b86d52178dc19c43867bb702a56440e1bcd98ec0d8b5c2294615fa32cabde8ff67a56fcdf564f1b2b8657bf38c418c42533877a582eb21acbacdede04dfe878373996576783ae46f1962fd5fb17d1e10bc18208ee5757361ed44528e5bf98d027592eaa2943f64246ac45038a78a28cf1c2998f9cdc295fa2ec739f9a2484a01031e91f95057c0333916a5170118f456d72fc2666c44810ebd8bb684284a158770850f74a72e88cfcca5be1a3e2f6a7dad8559fff8212aa4f53f050c58940b8f1a39dbbd3cf183c3bb6813ac734f81c756bce7b21c0c5136800eb3f4debdc75a93316353a2479594aa5a635b6851087620614e29b630cb151d8c4065038e36b5237b4eef7bb84dc12b9a72f28989b3d811820eab6baec08ad38ba9c185b53c85c9bfce9e8590e860370f64aa6ed6055917fd1f7fcae3ea49674dec4e38d5aea4f3228c2098ce78552b0b1c5c6269094736a82838248a3c10dc954c64b9397338f95d74d37fdab0fefc330d229a2c0e8736e9698c54d428446aa24862b26d33dac8cf427144dfbc59c180cddc441b017bd529cbc978707dc1c9fb497b19bfc10996a2b775d5f91e41211e3e8f48777716d0d3f69a2625530d16b328c7971146438933ca8f39ea3c72e99cacbef35f5a901948f34b20262e66b591ed5c541b47d2cfd1aa9c74e28f89e28b20cd9f55743bcd507c13893f59214113463be10870e918a7750e658773048a8b0ff040e28aa93f9ba573dceebe63ee953d2b7b74a61a689281043e4b8abf4e310bbcfd99dcd8b87ba5e56305598a6c85b5392ed53f9e36a893624f31dc12eb17c07cd587882fc0b96002b7f88b0cb78dd5dcd21240c2b589bfb6fac0cdc28c9498f2c9f91b3012881e4c884103f613f665d7e0832b762ca6b75ef14687e0aae595d4a43fb087133f74c45d658b7727af601bdbcb9f74143ba044035de09624c65bfbf937cf7d21b7309dea495a0c8674ad9a88d679eda9ba758bd98a4abdd266ecd052c0e0626d222d9852cee56b3923964e063e615eafab4244a3e05a687c5ba8ef7548721e02913716e0f6f14c1599104817b4dde4c0ddc42442120e25c6002e846a4b851d6f72a76d30902b68448f9768844b71a4e21a59e2655fb179cc0242b07bfd3bfcd64f459e1190810ace0126ea79c4f46f0a1bce472cf89a03e4d0e11e8b364b600085d14a931a46f99e2c7dc40a0b3cacaa0ea9dbba04bab6a7297f5e6686eb5245c3342b65ba4ba14d35551ea7057fe5efe127a3dd70a13a0677a0d4aee5dc43734c258141db90ee2d9634cdaa52e3a4a9a05f0c93d6bbb782430bc384e413d51d3d74c4cf3f6dbd2c702b15346c6fc9db958ab0779a47573f949747c6975db0d71347ca5f01cfb55f1ac99f3e869aa932af9372770e27a6ec07ffdb6a07b936887b74bab420a22363c6d7c1ae365109c1b9060d10ff38126b542858bf8fcbadb8b778eb49951f24d9efc8c595b18f0f513a01e0576c021505f14d8bc8dfdc8bedd666790994c6670bba5e96ccc2cf0bce81ecba80a01a6496eecec53fee00c1bf862f5787861adb172b0bc227fb206408759437d1061fd084ae1cbea694b47c484f8286c97868a84ce454fbd30da153e5c7c77377ef7999d359f153b783de376095c68aa936fa0ec0bbb1cfa9ee8412eb07af75b21eee7c06ee1309553381a45e09a217051ee272445720ded6c5a7c85fddf36e859c01f951c562f40e509c8251f9e212f17a915a4ea56b77cbf20d8a568f713811e6e2799af5ef6ddeee0dade9a674f1d803854e554d22daa7097cce7128c0781794b7c7eabfc1d0f97eb373c0f257f1566b0bbf8718efb12e397d74682e4251769452f18bc6bf1a857614fd317fd253ae3dd83c389c3f54ca293d8c362f1a095a63fc43c2b3a9d4de3ee1d19c0698ccb171ec30fda637e67a1dd3c09f84aa716995ace1dc45af760eac1990d6b0e2c4c7fc6f64601c17a10a17399797a231e7e67bf235ab8e94d0f90f0a77a32a65d804f8fa489afa436b18abf2e8522eddf383433adfdea1da3d06f54f8498bd514290f9178da883b21e1592df2cb207e45c1cbfd48a9cc4b68664c118ec8c94095929d03d4f2fa7e309fa8d358c63789dbf8393b597d2ef791a5da73581d67c10b314a1d51010cfc399c0c292b74d49b207c793ba08926110a7bfbadf990be5ed8fb88552e33716d4f63d68478e084aa2ce8b9dc34b531e60b6488cea5587aff9a1534649b20c5465fda1202046acc5f24a62d6e3c4433877aa5c8360c608abe9ce29fd875f099975570a2f48a28ba313a8cbe984578426fef77546ca8b781770f40689ba85d0a40a45279dbc6bcad8903a31c9117555aea8df80e6a2266dfd1c3a7bade2fdef0a246192c81ad8f98fe5e5781f5d903669c08359186db26e8286647a9d1f510bea630138275957f92cf42249afca9c3cc54158b2ca0f277c348eaed48468206ef1c089930515fdb353078049a36911a820fa9b8dd8c495212a0346f67da2755384be2208e1ba218885f1c3d1021ddbfe23d918cc4266f1c1ef60b825aa05ff5fb23fe76c66833f77ff54722bba7ea4a99a0ae246d9eb9988eb5c94491df811f0bf962ba8561641e4f9e80a8835bfe4a7fbc144ecaecd09ec21b6ca4de725391165121eb3d852d2eec8240163e0c4711fcb696ed5bea30894e2946a13d7a80b6f74d72d30f2ba32b9ba69e789587a454b90bf90bc3b9bedeb9d2c3f770906491194027209be73d9558707769e77f0a5b198de029f739ab7df915c9657654f5b366e4f3aa02cd90d3619f3eff9267efb97ba6072ae52b73007dcf0bb1fb9132ab953664b6feb62a6c9ae1c7429c7ba13ae03c1b9999d7db928192c0c7943eb040bec8c124780c017c3fe1e8689315d81172dc1c518576552ded9c781bce990c55fb042efabac6e18f9a54c7d77fa34a2c31639a3a984530fd380587d436909ae4b8da404707c664e1225abdf27", 0x1000, 0x5, 0x0, 0x0, r2}, &(0x7f00000000c0)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000001580)=ANY=[@ANYBLOB="01634040", @ANYRES64=0x0, @ANYBLOB="0000000000000000f237483b7343a93fba123997f6c6a896c5a6d5f0aa08ef5d4dff28e72d48596395b73b9d710b8e8e9752f3faf7df5f33"], 0x0, 0x0, 0x0}) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r2, 0x84, 0x1a, &(0x7f0000000180)={0x0, 0xb9, "1a4842e2b25cbc2dd20b879ab18e60b0dc8247b2dde78e165bcd4981893e5ef669857b843e56317425d7fa3e27efe832e715265af339287fdbbdd4813565c5806ab75125a70df978b4ab4fa0a20088106abd820898162285302e68d86133e7321211cfa4e5e998210cc4a91dd3645382b37676490dffa52bd6d3226dcb6fe52bb4322e994a639824a983686b7a2efaec71ae5f7fd2fb11318785cc8ba008f4babad3ea4d87542101e01ba39383a0cda9be820763da00a121ad"}, &(0x7f0000000380)=0xc1) getsockopt$inet_sctp_SCTP_GET_ASSOC_STATS(r2, 0x84, 0x70, &(0x7f0000001480)={r3, @in6={{0xa, 0x4e23, 0xc50a, @remote, 0xdb5}}, [0x7f, 0x7f, 0x2, 0xfffffffffffffffc, 0x1010b42b, 0x7fff, 0x2, 0xd8c1, 0x9, 0x5, 0xfff, 0x9, 0x1, 0x695bc467, 0x9]}, &(0x7f00000003c0)=0x100) [ 2302.024599][T22689] binder: send failed reply for transaction 3304, target dead [ 2302.034650][T29755] binder: 29750:29755 ioctl 40046207 0 returned -16 [ 2302.119116][T29869] input: syz0 as /devices/virtual/input/input3145 [ 2302.158013][T29875] input: syz0 as /devices/virtual/input/input3146 11:28:32 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) 11:28:32 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x700000000000000, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) 11:28:32 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x00\x00\x05\x00'}, 0x45c) 11:28:32 executing program 0: syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340)='/dev/kvm\x00', 0x7fffd, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = syz_open_dev$usbmon(&(0x7f0000000100)='/dev/usbmon#\x00', 0xa7f, 0x4263c0) syz_genetlink_get_family_id$tipc2(&(0x7f00000001c0)='TIPCv2\x00') r3 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r3, 0x0, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000002c0)={{{@in=@broadcast, @in, 0x0, 0x0, 0x0, 0x0, 0x800000000000000a}, {}, {}, 0x0, 0x0, 0x1}, {{}, 0x0, @in, 0x0, 0x4}}, 0xe8) sendmmsg(r1, &(0x7f0000000180), 0x0, 0x4000) ioctl$EXT4_IOC_MOVE_EXT(r1, 0xc028660f, &(0x7f00000000c0)={0x0, r1, 0x401, 0x52, 0x0, 0x7}) r4 = socket(0x1e, 0x0, 0x0) r5 = syz_open_dev$dri(&(0x7f00000003c0)='/dev/dri/card#\x00', 0x60, 0x200000) ioctl$DRM_IOCTL_VERSION(r5, 0xc0406400, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000240), &(0x7f0000000280)=0xc) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000000, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffff9c, &(0x7f0000000780)={0x0, 0x18, 0xfa00, {0x0, 0x0, 0x111, 0x3}}, 0x20) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r4, 0x6, 0x1d, &(0x7f0000000040), 0x0) ioctl$TIOCOUTQ(0xffffffffffffffff, 0x5411, 0x0) getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(r4, 0x84, 0x70, &(0x7f0000000400)={0x0, @in={{0x2, 0x4e23, @multicast1}}, [0x5, 0x4, 0x81, 0x5, 0x0, 0x3, 0x1, 0xffff, 0x1, 0x8, 0x7fff, 0x2, 0x2, 0xd14b, 0x7ff]}, &(0x7f0000000500)=0x100) sendmsg$TIPC_CMD_GET_BEARER_NAMES(r2, &(0x7f0000000740)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000580)={&(0x7f0000000540)={0x1c, 0x0, 0x800, 0x70bd2d, 0x25dfdbfc, {}, [""]}, 0x1c}, 0x1, 0x0, 0x0, 0x40000}, 0x80) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, 0x0, 0x0) write$P9_RSTAT(r2, &(0x7f00000007c0)=ANY=[@ANYBLOB="510000007d020000004a000200060000008396c816d6c39ca39465000300000000000000000000000000100097ffffffff00000000000000900000000750437632000f002f6465762f73657175656e6365720001002c00005b04aa60fc4926ff4f297df8cbe9503185c403385b90"], 0x6e) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x10f, 0x87, &(0x7f0000000080)=@req={0x3fc}, 0xf6) r6 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000140)='/dev/sequencer\x00', 0x0, 0x0) ioctl$BLKIOMIN(r6, 0x1278, &(0x7f0000000200)) getrandom(&(0x7f00000005c0)=""/198, 0xc6, 0x3) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$DRM_IOCTL_RM_MAP(r2, 0x4028641b, &(0x7f0000000000)={&(0x7f0000ffd000/0x3000)=nil, 0x4, 0x2, 0x2, &(0x7f0000ff9000/0x4000)=nil, 0x9}) msync(&(0x7f0000952000/0x2000)=nil, 0x87abbe8d1cc6ad9, 0x4) [ 2302.259980][T29878] input: syz0 as /devices/virtual/input/input3147 [ 2302.344517][T29878] input: syz0 as /devices/virtual/input/input3148 [ 2302.401181][T21720] binder: release 29886:29888 transaction 3308 out, still active [ 2302.419317][T29888] binder: BINDER_SET_CONTEXT_MGR already set [ 2302.473709][T21720] binder: send failed reply for transaction 3308, target dead [ 2302.483984][T29888] binder: 29886:29888 ioctl 40046207 0 returned -16 [ 2302.512404][T29891] input: syz0 as /devices/virtual/input/input3149 [ 2302.584697][T29957] input: syz0 as /devices/virtual/input/input3150 11:28:33 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r1, 0xc02c5341, &(0x7f0000000280)={0x0, 0x0, 0x0, 'queue1\x00', 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f000000]}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) 11:28:33 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) 11:28:33 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x2000000000000000, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) 11:28:33 executing program 0: r0 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20ncci\x00', 0x40000, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000000340)={{0x1, 0xfff}, 'port0\x00', 0xa5, 0x20, 0x81, 0x8000, 0x47e2e599, 0x80000000, 0x80000001, 0x0, 0x0, 0x1}) ioctl$sock_bt_cmtp_CMTPGETCONNINFO(r0, 0x800443d3, &(0x7f00000005c0)={{0x10001, 0x7fffffff, 0x9, 0x7fff, 0x40003ffffffffc, 0x8}, 0xffff, 0x8, 0x2}) r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(r0, 0x84, 0x22, &(0x7f0000000600)={0xfff, 0x1, 0x8, 0x7ff, 0x0}, &(0x7f0000000640)=0x10) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000680)={r2, 0x7}, 0x8) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0xa1, 0x0, &(0x7f0000000780)=ANY=[@ANYBLOB="0463000000000000e569f00a44ded39933f78adedc874bb538ab6675907fc5765943b2de0a10313c22a70c721070db5737a4675b581e5289e64d12745947ec6344714783f3415f15b99ed5ce3d4f16a7ad2d7c0b25750c544b7eb63deda060eea32ea8ed8b3fdd4dea2ab65f67e33cb8f1eef1dd47921f10c96df7207a5cb8a908f92eac2db1aec3398ee569f94ed157bf14706afb1e352a6e6d0e1b0387bd342e4afffdb98a320bbc7e723f0a470718b74163c35c839ead3f34f6b57487c6f73daa264da311488f76658d2e15ce99e144fbb7c3ee5b3278a01dadd941f9f1b51cbad6ef009fabdac64163c85ce8a1da7e5f206805c50cb3f1712bf20b86c13c3a41975ec9c15a563820a10a3f65d378609ca9394da414c9b673c201e8a04036aae7e6fff290afb7fa3e2dc0d8f07bfc4d1e1d80e6357fa907dc3504b35fe0991bdf"], 0x0, 0x0, 0x0}) r3 = gettid() ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r0, 0xc1105517, &(0x7f0000000480)={{0x1, 0x4, 0xffffffffffffff81, 0x863, 'syz0\x00', 0x6}, 0x0, 0x30, 0x5, r3, 0x4, 0x400, 'syz1\x00', &(0x7f0000000240)=['port0\x00', '\x00', 'selinuxmime_type\'ppp1\x00', '{vmnet0\x00'], 0x25, [], [0x3, 0x4a, 0x0, 0x1]}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x0, 0x0, 0x0}) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000200)='/dev/vcs\x00', 0x400002, 0x0) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f00000006c0)='IPVS\x00') sendmsg$IPVS_CMD_GET_DAEMON(r4, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000180)={&(0x7f00000000c0)={0xb8, r5, 0x14, 0x70bd2a, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x3}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x8}, @IPVS_CMD_ATTR_DEST={0x60, 0x2, [@IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@dev={0xac, 0x14, 0x14, 0x27}}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x4}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x1}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x9}, @IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e23}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x4}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x1}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x29}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x10001}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0xaa}, @IPVS_CMD_ATTR_DEST={0x24, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x8001}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x400}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x313}]}, 0xb8}, 0x1, 0x0, 0x0, 0x80}, 0x20000090) 11:28:33 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x00\x00\x11\x00'}, 0x45c) 11:28:33 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r1, 0xc0505350, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) [ 2302.856060][T30007] input: syz0 as /devices/virtual/input/input3151 [ 2302.887094][T30015] input: syz0 as /devices/virtual/input/input3152 [ 2302.914430][T22689] binder: release 30010:30019 transaction 3310 out, still active [ 2302.927055][T30019] binder: BINDER_SET_CONTEXT_MGR already set 11:28:33 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x40100, 0x0) ioctl$UI_DEV_CREATE(r1, 0x5501) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x0, 0x0, 0x0}) [ 2302.979201][T22689] binder: send failed reply for transaction 3310, target dead [ 2302.989830][T30019] binder: 30010:30019 ioctl 40046207 0 returned -16 11:28:33 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) [ 2303.029196][T30024] input: syz0 as /devices/virtual/input/input3154 11:28:33 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x3f00000000000000, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) [ 2303.081164][T22689] binder_release_work: 16 callbacks suppressed [ 2303.081172][T22689] binder: undelivered TRANSACTION_ERROR: 29189 11:28:33 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x00\x00\x12\x00'}, 0x45c) [ 2303.229649][T30119] input: syz0 as /devices/virtual/input/input3155 [ 2303.264244][T21720] binder: send failed reply for transaction 3313, target dead 11:28:33 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0xffc4, 0x0, &(0x7f0000000040)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xfffffffffffffff7, 0x0, 0x0}) ioctl$FITRIM(r0, 0xc0185879, &(0x7f0000000000)={0x9, 0x1}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x0, 0x0, 0x0}) [ 2303.276845][T30143] binder_transaction: 12 callbacks suppressed [ 2303.276863][T30143] binder: 30107:30143 transaction failed 29189/-22, size 0-0 line 2995 [ 2303.310019][T30145] input: syz0 as /devices/virtual/input/input3156 [ 2303.348244][T30147] input: syz0 as /devices/virtual/input/input3157 [ 2303.413297][T30150] input: syz0 as /devices/virtual/input/input3158 [ 2303.413621][T30153] binder: 30152:30153 unknown command 0 [ 2303.437504][T21720] binder: undelivered TRANSACTION_ERROR: 29189 11:28:33 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x4800000000000000, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) [ 2303.476337][T30153] binder: 30152:30153 ioctl c0306201 20000440 returned -22 [ 2303.512145][T21720] binder: send failed reply for transaction 3316 to 30152:30153 11:28:34 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x00\x00\x14\x00'}, 0x45c) 11:28:34 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x05\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) 11:28:34 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r1, 0xc0505350, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) 11:28:34 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xffffffffffffff5c, 0x0, 0x0}) r1 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/qat_adf_ctl\x00', 0x4c100, 0x0) ioctl$BLKTRACESTOP(r1, 0x1275, 0x0) getsockopt$ARPT_SO_GET_ENTRIES(r1, 0x0, 0x61, &(0x7f0000000040)={'filter\x00', 0x77, "9acf0fb0bed68f1ebb76a60b0f1389efb9d17447791414b91374c02851ffea5175ae4866fbe03e16ff0277491e92a8273435f715f81c6788de3d468ef75471171354194a4c00e55b80bafbd911c6f3d07b59d9d569d2267504ccc3fb7441a73f9aa3b1564043fd54d6b165b8282f1e4cf19a2815824513"}, &(0x7f0000000100)=0x9b) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="01635340", @ANYRES64=0x0, @ANYBLOB="00fff40000000000"], 0x0, 0x0, 0x0}) 11:28:34 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r1, 0xc02c5341, &(0x7f0000000280)={0x0, 0x0, 0x0, 'queue1\x00', 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfeffffff]}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) 11:28:34 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x4c00000000000000, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) [ 2303.801667][T21720] binder: undelivered TRANSACTION_ERROR: 29189 [ 2303.830234][T30271] input: syz0 as /devices/virtual/input/input3159 [ 2303.902232][T30275] input: syz0 as /devices/virtual/input/input3160 [ 2303.947059][T22689] binder_release_work: 10 callbacks suppressed [ 2303.947065][T22689] binder: undelivered TRANSACTION_COMPLETE [ 2303.957058][T30289] binder: 30284:30289 ioctl c0306201 20000440 returned -14 [ 2303.969958][T30286] binder: BINDER_SET_CONTEXT_MGR already set [ 2303.980121][T21720] binder: send failed reply for transaction 3323 to 30284:30289 [ 2303.994065][T30292] binder: 30279:30292 transaction failed 29189/-22, size 0-0 line 2995 [ 2304.000302][T30289] binder: 30284:30289 unknown command 1079206657 [ 2304.021519][T30282] input: syz0 as /devices/virtual/input/input3162 [ 2304.040371][T30289] binder: 30284:30289 ioctl c0306201 200002c0 returned -22 11:28:34 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x11\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) [ 2304.049211][T30286] binder: 30279:30286 ioctl 40046207 0 returned -16 [ 2304.077252][T21720] binder: undelivered TRANSACTION_ERROR: 29189 [ 2304.084271][T30289] binder: 30284:30289 transaction failed 29189/-22, size 0-0 line 2995 [ 2304.086811][T21720] binder: undelivered TRANSACTION_COMPLETE 11:28:34 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x6000000000000000, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) 11:28:34 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x00\x00\x15\x00'}, 0x45c) [ 2304.127089][T30289] binder: 30284:30289 ioctl c0306201 20000440 returned -14 [ 2304.157120][T21720] binder: undelivered TRANSACTION_ERROR: 29189 [ 2304.194634][T30306] input: syz0 as /devices/virtual/input/input3163 [ 2304.250713][T30352] input: syz0 as /devices/virtual/input/input3164 [ 2304.271866][T21720] binder: undelivered TRANSACTION_COMPLETE [ 2304.283894][T30365] binder: BINDER_SET_CONTEXT_MGR already set [ 2304.319262][T30365] binder: 30330:30365 ioctl 40046207 0 returned -16 [ 2304.321303][T21720] binder: undelivered TRANSACTION_COMPLETE [ 2304.345041][T30411] input: syz0 as /devices/virtual/input/input3165 11:28:34 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x802) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = syz_open_dev$admmidi(&(0x7f0000000000)='/dev/admmidi#\x00', 0xfffffffffffff1f5, 0x10001) ioctl$NBD_DO_IT(r1, 0xab03) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x0, 0x0, 0x0}) 11:28:34 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) [ 2304.364740][T21720] binder: undelivered TRANSACTION_ERROR: 29189 11:28:34 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x6800000000000000, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) [ 2304.420643][T30414] input: syz0 as /devices/virtual/input/input3166 [ 2304.453515][T30418] binder: 30417:30418 got reply transaction with bad transaction stack, transaction 3329 has target 30330:0 [ 2304.494127][T21720] binder: send failed reply for transaction 3329 to 30417:30418 [ 2304.512381][T30418] binder: 30417:30418 transaction failed 29201/-71, size 0-0 line 2915 [ 2304.521598][T30422] input: syz0 as /devices/virtual/input/input3167 [ 2304.573251][T21720] binder: undelivered TRANSACTION_COMPLETE [ 2304.582125][T21720] binder: undelivered TRANSACTION_ERROR: 29189 [ 2304.582367][T30426] binder: BINDER_SET_CONTEXT_MGR already set [ 2304.602633][T30426] binder: 30424:30426 ioctl 40046207 0 returned -16 [ 2304.610036][T21720] binder: undelivered TRANSACTION_ERROR: 29201 [ 2304.624913][T30427] binder_alloc: 30424: binder_alloc_buf, no vma [ 2304.626986][T21720] binder: send failed reply for transaction 3332 to 30424:30426 [ 2304.641024][T21720] binder: undelivered TRANSACTION_COMPLETE [ 2304.647558][T21720] binder: undelivered TRANSACTION_ERROR: 29189 [ 2304.670171][T30427] binder: 30424:30427 transaction failed 29189/-3, size 0-0 line 3148 [ 2304.683878][T30425] input: syz0 as /devices/virtual/input/input3168 [ 2304.693782][T22689] binder: undelivered TRANSACTION_ERROR: 29189 11:28:35 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r1, 0xc02c5341, &(0x7f0000000280)={0x0, 0x0, 0x0, 'queue1\x00', 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe]}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) 11:28:35 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x00\x00\x16\x00'}, 0x45c) 11:28:35 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r1, 0xc0505350, &(0x7f0000000500)={{0x0, 0x80000000}, {0x3f, 0x8}, 0x2392, 0x5, 0x400}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) 11:28:35 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x14\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) 11:28:35 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x6c00000000000000, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) 11:28:35 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x68ad00, 0x0) setsockopt$MISDN_TIME_STAMP(r1, 0x0, 0x1, &(0x7f0000000040), 0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x0, 0x0, 0x0}) [ 2304.880839][T30540] input: syz0 as /devices/virtual/input/input3169 [ 2304.935409][T30547] binder: 30543:30547 transaction failed 29189/-22, size 0-0 line 2995 [ 2304.945483][T30546] input: syz0 as /devices/virtual/input/input3170 [ 2304.971718][T22689] binder_thread_release: 6 callbacks suppressed [ 2304.971737][T22689] binder: release 30544:30552 transaction 3336 out, still active [ 2304.987078][T30554] binder_alloc: 30544: binder_alloc_buf, no vma [ 2304.989900][T30552] binder: BINDER_SET_CONTEXT_MGR already set [ 2305.000048][T22689] binder: undelivered TRANSACTION_COMPLETE [ 2305.010629][T30554] binder: 30544:30554 transaction failed 29189/-3, size 0-0 line 3148 [ 2305.019142][T30540] input: syz0 as /devices/virtual/input/input3171 [ 2305.040242][T30546] input: syz0 as /devices/virtual/input/input3172 11:28:35 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x00\x00\x1f\x00'}, 0x45c) [ 2305.081925][T22689] binder_send_failed_reply: 5 callbacks suppressed [ 2305.081962][T22689] binder: send failed reply for transaction 3336, target dead [ 2305.100147][T30552] binder: 30544:30552 ioctl 40046207 0 returned -16 11:28:35 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x15\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) [ 2305.157363][T30641] input: syz0 as /devices/virtual/input/input3173 11:28:35 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="ef1e4b9bc35ff9da08cb71803fa2acc81a0eae7761c12a77f5194a195b90087013d70bd597336753a8b7ddc586b149b3596fb49ff287a576670577346142087931afd9e7779a017e5bf468384d63cd2f0fef394d9f903647fb5ea16eae94aafab9fa3e6e983329f53defee7fc7697bd4e549b40a0457aa0ed107c36795f2c55236d14ecfe927cfd3612448e93f85960ef25d5875958ffa4c7b95f0d3b1b9c25443a1777549bef7dae4ebbd594e7ab88c346aaf5621f18292f4cbae811ae55df0f1e72159c5cc05da5931bdffc8b9e21e4459e8e13dbd56e1943d89cd8a0e627f43d575a200fc72ac9ba6fea9003af78308e72215fbb56c3b2d31f276e9f945c09fe3126ed012ae5d8036afe3d70f1445884a0f2893f6eed2628c358e168897339d86f679ad901613b898df193616080e838cf9569eae97d2f19c335edaacca01b0687e8c48c3d144545ad05403b7e335bdd4d8ab4cb0e733dce0cdc5c86b5b07dc520a722b5e67661f41320e5328aca7ea1d8feed9d13d17c43be12af32003592257f0996c8fc927bc672fedb658c76516625978ba0053", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) 11:28:35 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x7400000000000000, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) [ 2305.278562][T30678] input: syz0 as /devices/virtual/input/input3175 11:28:35 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x00\x00/\x00'}, 0x45c) [ 2305.325068][T30684] binder: 30680:30684 transaction failed 29189/-22, size 0-0 line 2995 [ 2305.351887][T30684] binder: 30680:30684 transaction failed 29189/-22, size 0-0 line 2995 [ 2305.368755][T30685] input: syz0 as /devices/virtual/input/input3176 [ 2305.399723][T21720] binder: release 30683:30701 transaction 3341 out, still active [ 2305.412653][T30701] binder: BINDER_SET_CONTEXT_MGR already set [ 2305.425244][T21720] binder: undelivered TRANSACTION_COMPLETE 11:28:35 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x16\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) [ 2305.460633][T30727] input: syz0 as /devices/virtual/input/input3177 [ 2305.489755][T30701] binder: 30683:30701 ioctl 40046207 0 returned -16 [ 2305.522851][T21720] binder: send failed reply for transaction 3341, target dead [ 2305.531397][T30707] binder_alloc: 30683: binder_alloc_buf, no vma [ 2305.545658][T30707] binder: 30683:30707 transaction failed 29189/-3, size 0-0 line 3148 [ 2305.579145][T30727] input: syz0 as /devices/virtual/input/input3178 [ 2305.639842][T30798] input: syz0 as /devices/virtual/input/input3179 11:28:36 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r1, 0xc02c5341, &(0x7f0000000280)={0x0, 0x0, 0x0, 'queue1\x00', 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe00000000000000]}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) 11:28:36 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x10, 0x0, &(0x7f0000000300)=[@request_death={0x400c630e, 0x0, 0x1}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x0, 0x0, 0x0}) prctl$PR_SET_MM_EXE_FILE(0x23, 0xd, r0) 11:28:36 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x7a00000000000000, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) 11:28:36 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x00\x00?\x00'}, 0x45c) 11:28:36 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00/\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) 11:28:36 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r1, 0xc0505350, &(0x7f0000000500)={{0x0, 0x80000000}, {0x3f, 0x8}, 0x2392, 0x5, 0x400}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) [ 2305.875896][T30814] input: syz0 as /devices/virtual/input/input3181 [ 2305.882546][T30818] binder: 30813:30818 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 2305.898829][T30820] input: syz0 as /devices/virtual/input/input3182 [ 2305.913968][T21720] binder: release 30815:30821 transaction 3344 out, still active [ 2305.929574][T30821] binder: BINDER_SET_CONTEXT_MGR already set [ 2305.941396][T21720] binder: undelivered TRANSACTION_COMPLETE [ 2305.951040][T30834] binder_alloc: 30815: binder_alloc_buf, no vma [ 2305.958044][T21720] binder: send failed reply for transaction 3344, target dead [ 2305.965133][T30821] binder: 30815:30821 ioctl 40046207 0 returned -16 11:28:36 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0b630000ffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) [ 2305.992488][T30835] input: syz0 as /devices/virtual/input/input3184 [ 2306.014016][T30820] input: syz0 as /devices/virtual/input/input3183 11:28:36 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) 11:28:36 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x29a, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x53, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="ca76ae29b07662d68697ff86d520a228e160d5b7cbd5bd10227198f4762311466c2d296b7747508bfa3ad1cb7d8be9db163373a66c1763b1bd3e884558eaef5cb04dea", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) r1 = syz_open_dev$usbmon(&(0x7f0000000000)='/dev/usbmon#\x00', 0x6, 0x414000) ioctl$KDDISABIO(r1, 0x4b37) 11:28:36 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\xff\xff\xff\xfe\x00'}, 0x45c) [ 2306.212616][T30942] input: syz0 as /devices/virtual/input/input3185 [ 2306.216877][T30948] binder: 30943:30948 ERROR: BC_REGISTER_LOOPER called without request [ 2306.231426][T30949] input: syz0 as /devices/virtual/input/input3186 [ 2306.239012][T30948] binder: 30943:30948 unknown command -1 [ 2306.261073][T30948] binder: 30943:30948 ioctl c0306201 200002c0 returned -22 [ 2306.299758][T21720] binder: release 30943:30948 transaction 3347 out, still active [ 2306.314673][T21720] binder: undelivered TRANSACTION_COMPLETE [ 2306.321114][T30948] binder: BINDER_SET_CONTEXT_MGR already set [ 2306.330427][T30955] binder: 30947:30955 ioctl c0306201 20000440 returned -14 [ 2306.340832][T30951] input: syz0 as /devices/virtual/input/input3187 [ 2306.343870][T30948] binder: 30943:30948 ioctl 40046207 0 returned -16 [ 2306.354296][T21720] binder: send failed reply for transaction 3347, target dead 11:28:36 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0c630000ffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) [ 2306.362254][T30955] binder: 30947:30955 unknown command 699299530 [ 2306.373009][T30955] binder: 30947:30955 ioctl c0306201 200000c0 returned -22 [ 2306.384018][T30942] input: syz0 as /devices/virtual/input/input3188 11:28:36 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\xfe\xff\xff\xff\x00'}, 0x45c) [ 2306.481422][T31015] binder: 30987:31015 unknown command -1 [ 2306.534268][T31015] binder: 30987:31015 ioctl c0306201 200002c0 returned -22 [ 2306.564149][T21720] binder: release 30987:31015 transaction 3350 out, still active [ 2306.579645][T31015] binder: BINDER_SET_CONTEXT_MGR already set [ 2306.591004][T31066] input: syz0 as /devices/virtual/input/input3189 [ 2306.598046][T21720] binder: send failed reply for transaction 3350, target dead [ 2306.607090][T31015] binder: 30987:31015 ioctl 40046207 0 returned -16 [ 2306.650486][T31071] input: syz0 as /devices/virtual/input/input3190 11:28:37 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r1, 0xc02c5341, &(0x7f0000000280)={0x0, 0x0, 0x0, 'queue1\x00', 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f00000000000000]}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) 11:28:37 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x05\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) 11:28:37 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="08001000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) ioctl$TIOCNOTTY(r0, 0x5422) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) 11:28:37 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r1, 0xc0505350, &(0x7f0000000500)={{}, {0x3f, 0x8}, 0x2392, 0x5, 0x400}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) 11:28:37 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0d630000ffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) 11:28:37 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00'}, 0x45c) [ 2306.794522][T31081] binder: 31079:31081 ioctl 5422 0 returned -22 [ 2306.825358][T31081] binder: BINDER_SET_CONTEXT_MGR already set [ 2306.833201][T31086] binder: 31082:31086 unknown command -1 [ 2306.840095][T31087] input: syz0 as /devices/virtual/input/input3191 [ 2306.861489][T31081] binder: 31079:31081 ioctl 40046207 0 returned -16 [ 2306.869444][T31086] binder: 31082:31086 ioctl c0306201 200002c0 returned -22 [ 2306.870631][T31091] input: syz0 as /devices/virtual/input/input3192 [ 2306.892432][T22689] binder: release 31082:31086 transaction 3354 out, still active [ 2306.918183][T31087] input: syz0 as /devices/virtual/input/input3193 [ 2306.929069][T31086] binder: BINDER_SET_CONTEXT_MGR already set [ 2306.938615][T22689] binder: send failed reply for transaction 3354, target dead [ 2306.954339][T31086] binder: 31082:31086 ioctl 40046207 0 returned -16 [ 2306.963996][T22689] binder: send failed reply for transaction 3355 to 31079:31081 11:28:37 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="02630440ffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) 11:28:37 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x11\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) [ 2307.000884][T31172] input: syz0 as /devices/virtual/input/input3194 11:28:37 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = syz_open_dev$cec(&(0x7f00000000c0)='/dev/cec#\x00', 0x2, 0x2) ioctl$SIOCAX25DELFWD(r1, 0x89eb, &(0x7f0000000100)={@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @bcast}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x0, 0x0, 0x0}) 11:28:37 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00'}, 0x45c) [ 2307.148690][T31209] input: syz0 as /devices/virtual/input/input3195 [ 2307.185142][T31213] binder: BC_ACQUIRE_RESULT not supported [ 2307.203491][T31215] binder: 31211:31215 got reply transaction with bad transaction stack, transaction 3359 has target 31210:0 [ 2307.218929][T31213] binder: 31210:31213 ioctl c0306201 200002c0 returned -22 [ 2307.242729][T21720] binder: release 31210:31213 transaction 3358 out, still active 11:28:37 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) [ 2307.252821][T31213] binder: BINDER_SET_CONTEXT_MGR already set [ 2307.267560][T31215] binder_alloc: 31210: binder_alloc_buf, no vma [ 2307.274022][T21720] binder: release 31211:31215 transaction 3359 out, still active [ 2307.282421][T31213] binder: 31210:31213 ioctl 40046207 0 returned -16 [ 2307.293516][T21720] binder: send failed reply for transaction 3358, target dead [ 2307.304438][T31218] binder_alloc: 31210: binder_alloc_buf, no vma [ 2307.316396][T21720] binder: send failed reply for transaction 3359, target dead [ 2307.324650][T31233] input: syz0 as /devices/virtual/input/input3197 11:28:37 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="04630440ffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) [ 2307.395605][T31312] input: syz0 as /devices/virtual/input/input3198 [ 2307.428217][T31326] input: syz0 as /devices/virtual/input/input3199 [ 2307.525616][T31333] input: syz0 as /devices/virtual/input/input3200 [ 2307.552598][T31335] binder: 31332:31335 IncRefs 0 refcount change on invalid ref -1 ret -22 [ 2307.572767][T31335] binder: 31332:31335 unknown command 471608887 [ 2307.596994][T31335] binder: 31332:31335 ioctl c0306201 200002c0 returned -22 [ 2307.612865][T21720] binder: release 31332:31335 transaction 3364 out, still active [ 2307.641011][T21720] binder: release 31332:31339 transaction 3365 out, still active [ 2307.688635][T21720] binder: send failed reply for transaction 3364, target dead [ 2307.696146][T21720] binder: send failed reply for transaction 3365, target dead 11:28:38 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00'}, 0x45c) 11:28:38 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r1, 0xc02c5341, &(0x7f0000000280)={0x0, 0x0, 0x0, 'queue1\x00', 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfeffffff00000000]}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) 11:28:38 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x0, 0x0, 0x0}) r1 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0x0, 0x2) r2 = syz_open_dev$sg(&(0x7f0000000080)='/dev/sg#\x00', 0x329a, 0x400000) ioctl$VIDIOC_TRY_EXT_CTRLS(r2, 0xc0205649, &(0x7f0000000140)={0x980000, 0x0, 0x2, [], &(0x7f0000000100)={0xbb09ed, 0x3, [], @p_u8=&(0x7f00000000c0)=0x9}}) getsockname$netrom(r2, &(0x7f0000000180)={{0x3, @netrom}, [@null, @null, @rose, @default, @default, @remote, @netrom, @null]}, &(0x7f0000000200)=0x48) ioctl$KVM_GET_VCPU_EVENTS(r1, 0x8040ae9f, &(0x7f0000000040)) 11:28:38 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x14\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) 11:28:38 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r1, 0xc0505350, &(0x7f0000000500)={{}, {0x0, 0x8}, 0x2392, 0x5, 0x400}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) 11:28:38 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="07630440ffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) [ 2307.846424][T31352] input: syz0 as /devices/virtual/input/input3201 [ 2307.873919][T31369] binder: 31350:31369 DecRefs 0 refcount change on invalid ref -1 ret -22 [ 2307.884630][T31355] input: syz0 as /devices/virtual/input/input3202 [ 2307.903739][T31408] input: syz0 as /devices/virtual/input/input3203 [ 2307.929108][T31369] binder: 31350:31369 unknown command 471608887 11:28:38 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x0, 0x0, 0x0}) r1 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0x3, 0x2) setsockopt$inet_sctp_SCTP_I_WANT_MAPPED_V4_ADDR(r1, 0x84, 0xc, &(0x7f0000000040)=0xfffffffffffffffe, 0x4) writev(r1, &(0x7f0000000080)=[{&(0x7f0000000480)="5e7fb705cc41190993aef02b8f4d749d209f55718c102ade4c409c903a465b4ce3567d7c2ca839084db1d84ed8c2be3c8378a5cdbfbd3359f36e4bb4e4ce1f715a0f831ead15128c49f799030d5d0c8da491ca2de67c76e240b517e8cbf3ec9e29c045ce4886171a99b61742ad51aa63b6645bf759d6e4b050c6f25a72df6d68fea4bc43b978ff6057979eaa32e6d7f8e4dd8b9fb65e785c64887b135ae64fc6e5440b9dddc24618750425446360a493f5140c0f09a2140203afe507dd94f00f48291dd672494f94a74e1f6c9bd541dd716249953b239353a68a034a8a6db13a88d1b91c0179bfc2fdba4d72ec61eec6bf1b18e47b4d18d7770996c31d9a9664488d07f4a1421816d671dfa53f5b99af1c820fe07b6205a205f8b7bf6fb10bd6007991a836d6c8b8f243234fc1edabc32b90eb816080767f6b51c1cd97c3ae014333ef07a3455433e0c98eeeddc62ff52825e5412fd087ab81c01bab4a798b36f91cd91ab8e1b647aebe4101c3e2265f4496d8a87f06c59f5ff2a0079f5d9f95f2fb8be58d2cd3d94d7495adc14b5964b6054ac3d3b8c8a15bab0c28c423570be765f90665301fa02b89832aab9d3fbb07fca95cf6238451e308ca4412e64a43258011db1666e869c9ffb95e56046186776436eeebb512f8598043ee8057d9f475f0144deb419882622a1ac2dde923088ecde7164cb8954b2c41cad4682717a595fd0e700357c46cd9dab9181702354ae433b1c68a5f9139d0ab23967c39574e4c07c6908b84ec95d98376a6eca4c5b15abd985000d678b3040603bfe511e46813ec7b3edb2669824e9cde0450f395610699f2c7e9bda161d6669a213da04e8e75df2ab18249d91b5971ebabf8be16acd54e8d662ae3c003884b4e7b481e2f09b6c2120451b80e1251374078c95e9a230e97c94aa3c185c7489929797ce1bcb3743924f8d8e5441299f5af1a86d1b0fc9cb192e083db13605543714f1d983b697c4dcaf1e20d3d1d07fa4a7795bc4900a781786ab2fb163930bc5a2c3dc36d5f2a34a8f067eb166990f72a75d45850bed10090cbab639efd0bdd3e74a82caf084c996ac5d993d10b4f52852d340cba0cb9a20c17121759c71cbfe196ad08117e74020a2310d9f33888f018be6cbd16c9b0959c02b41fd8931fddce01139ede4e8213d99ac9bf98766d5179ef20d4d7a4832bd0f78cf4fde08ce55ffc9fe657ddee0e8e940a02d478d3b50cda7cd6506b1184bfa61388ecdf1311305b5d0495172567f6c43cf39bb347ab9a1069f3e15b9aa1437285c8377a641305d83c775fdd56fd9f6c90f8f56590d7870640acd7e4d9597b53c86091c6d2b4a0f9931107a91975cb4bc23923c21e9644353144f780ff54f54af8a8ad9c0fa701ead435523cfc3366069685d464aec56a1b779728236575f77ba92f8c72159d1fef992c633724ca07f5fbcb04ca868e07e912e7e7b704f5f561e85de4b413199698137f50e08dca7e237dfb8023c6d61d379b0e8f89e3aaf0f6d922d24cb9cbde981646b28bbac5e388444ca13abe3a9fabea37a66d1b6a2a26525f0bc5b73826e11738796da1919bd34e5061d7bb45fd77fed5313b11a0d418f39b3ba423f64c8813d4249c72d7154b2b001dc6638ab71d0023b5f0d4beb7f69bb5a6a0b94b6a80214e5bf54716e01e99ee4a8617421756cbd2d9667749c5892a3259cbcc2bf9c4a78e3b4cc3040bfe9ca27beb37be5f99b8a9bdddf8a7dbf62e823dab0d6d128d54604eae431259460207bbfed45020ca486f5860d4c57e09c81c4d1dfdd83ee6fd334b9c5d896dd061ed412567c5b7a6c1492900e9b7ab8ad10e2b5a0df8dd25824e506404cfe7d86f257aebae5e902c555d7ff8610635301e9435b1df20025bfb086eb9be8b9b58e1ef8c6243e341b3f16605838b4a908eece249ad18fcaf48d89a3ff207862f03b9236a5a183d655aeed145320fada9aeeba8187d979ddcab801054a53e1cc4e5f2e6d4c3953bb5b946299ed5320fdac96a03933da3318bcbbbde713804ad5881b6342b14f2333b8b54f9f2df20170d6d1397cfd66b773eb73d22afc87405ddcf8bfeaa2d80d806769bf7fa4cd183ab1e8689828efc6819bd9d4ec0e344ee6b18e9ca358557a87d7c8035bce8508685df0e3a811f11da285c42a74caf5d73320f01bd81def584de7f93d41824f5d8dd3530f3b314d908be4ab7c8f34276b4026dc4f5d049f1522d0f6979ce50b8f919df811cc28a93b0496562a7997c2bc70cccb5f3f8e476493c79f2242bd32fb50744876d62a2ff63d3dadf559e294e93408b5af0acd03b20e6c12fc05144e8fde717609dd77e73afd579d93eb2d3fd8dd127aa6ccbde53b4d578ba0f9a37502e129d08c4338d8f73d4cc00f8b4589a15971e160c3e517743dd7602614b8da22fd3abe0c1fae34c181452c4ce669371bceb5cbe746e8a1c69ef3d8c6e5ec168491ed16ac7a3ce23cd61194bc0936c24e7ced61fa44fe518b48519e0533f94a1fce507cd8f6aefd0c2289ecadc2a03ff30a51ecd59c199612930f42e1b0dc3f822fd5d415b884e0aee49850dce21dc2800d679d7abdeebd239a277f475a5ebe952aa30ef01a0ddb604df816fb728116212401ce63c1b97dab47b91d4bb076d42aad1d4e80311f6bcb4303aad3dc0885c9c866932c993ca67b6099423095587e0f91d119a854bbac91945680f80245513cfd5563ddb8986dd04dc2bd7593613d933bdf0bbe01dabff560fd08028c958c3eb86f48d94267770d026c633057c40a32ba4830160b9564e268bb51042545213d2328cce4b1c1220b2730223090176411a6bd704d6f10627f9146f4de0149cde2c2e10b83e8a380ad987a743e995c67cffb038d9b3e2f217a48040f8518b4442fa7d9c3cf8a35c220b4d7d97bcbb4b1b0d9eb8b59d2f2c10a0e16d17dee382c9d6f2885bec8809261064e47d071bf35fd31f5d03593adb53ecf640c6b459eada556a94fa2586f88634805fb72ba07898e7f14f57685b2d710311bd39216a65e175b9d2916ae1067a9b33c40ec562b66139d1b75ce5de6dd32601c15c174bcb3ce266e2066bcf3d0cf628afe2ded1dd4f2daf577300651d37266a3fd270d662dbe5ff73e3b3c493f53ccf02f4acfbf80eca2f0e61ef3726da44ab061bd22ecad4e4b7fe74ae30f57634e8bb7561863c50faea922aa6c98fc2f62b4d41d6dcfe0313411544d0b545bafc71cf7fe71864cbf1ca36d4ebcb1aacdfa687a0f74230db131ec74517055a36f41a83a144df2d7316a55e5e36dcef75375d124bfe502c0707695c2c24274c9500dd6edb76a04ccbe7a85c4fffbaacd68729afa411743fda2da93f01523f5390d805d7930549fbe6c05d3723651557baaed24a3ce22f9fa83e06bfa81802bd57a2f83fd947e56388ded2fa2e1ab8ecf4c320419230a18ab737b3a9633ad1b0a6759df5370203351de71356e4a7498641ec7898670aef33ef904996938e9740d1b2b83efadade180cacbae877f4a9804825767d40b5355894943461d8f4ba9edde4d8cf0f70590fc4f2f65183bf68f90ebc9df73c9ab79a0c2650276db42da7949e2102a778e9b532c103fdf5627bb59bcacdf2f7483fdb5052e558cbfa633cebd3a5da8c1c38e65b7f971f27fe6e5381c1aa2bc5f697f2ffa5a373a97a49fca1e839811c4d74924772de6e331e2a4f45aa6f2b4ef0137f79f9f7609bda38c5865d2f6c993ad7f03e8b6683f2e34556f71018fe291e4a8bf5645d9930c7c13762082c6a07f72d4aac47f6bb5cd844125d380f0f1ebdc9ae397a672ee7b623dffc59a89e49ae23015ed794b6029d16249c9db563aa90ecde8b877b0d7b6aa0cfbac14c30c40882881be1dfa1feeebc0944e270f1606440bf8ec67f4b5359fa241b7ce98543a26c9691654c9047b7628dc4dea635e65b3b96f22bd4fdbd53fd75f0366b7fd60d7706c8bb7dc328d3d164cdfeddf4737ddac59b3235e6b1baf670f16bccc29ef3404ea68061474702213d8196dac0acbbe70cca127d0bcd58f3e488697d208c4c32e7ece938cd1a730a0bf3cd357b57f84b78a58988223ee863e54bb779ee126754de704430cc4c67f4e5a42ce5d064db6ab2045d52ac9bf73d7b4b1294ba42084cbda29ac2bbcf0cb7366ebf1a78685824355116a423e08424da133aa6eb86bf099496e1d7b62ea163fa6725084dafbdedfd2f0816960841f0a6fca2744969f38cd29ee8bf9f7290c15a7e8d0c8812f3a72bc621a088b900ac13ab3c22493845c8c89e60c1ae650b45efe83cbe7cb5e52d23cd450eafcb1967080261d4dd38ea91597d0581b8a506d93e6169cfd38ac540669611511052c013a217853dd8ce5196e771551aaddb5a3a3e9667e80c77d34cd5e2dae23a3c01a0fe225965e93006cbabfec06401cb365102a02561b9ba44e73e0d3d11a581481b9faa15d0dcf340ae7e39a8867e85ba9dfeaf19a971375242a531559cfbc7afa4e0b8490671ec9dc1c5329b7c79aa094abe3df53d59b0d9fa4c63450e6c361809591fa84036c5dcea6ba73084d7410bd36a848265f5db993e838d8d4272916667e9589792a28786ae2c89968c09794d98e8b615a09e67b37f8137fc81ef6634c82462aaf7147f403d5473bdddfd60fd13094bbb4c410601f40142058fa86589eb414890db072ad9e68bfb62fc114de13d03a6b8c57e6e24c81ce1f813fd2345d59400ad9993db0d4e5b4876b250ff0ec9578487779d3d0e1124adf1a16d06d67f56bb80ed2caee46add3a2f6b2af19e8f65ddc88f4c456c9cbdd6d3bd2154c8ab42390ca537c6314aaffa8a013a7852ace89d8809445acd054ab06f8e37387b2b8f697cdb486578a0e925939de3fee8ed2576920ab22dd4aa8cd8afa74ad19eedd328ba15caa6e3c0e7369b1329e04124fc265423982f11548ff43053c3c0a5f01f22fe71785c3077afc7be5a8eda864b0b163d67f77df139b289db422700b7c9e3fa4bcfe2a6b371211cf9b851fc1e6b37e37c22606ca4768f6b17e0bd8185d82643f2a7d2000f968ae319bcbd4ac884536751dd8ac518d7159411f804533d883aa61b012f71faf76704a098858ee59f53210d35ac868339147de8fe6c51ab217593a6d0afe305d7b0856fa007794cc5679379fda311dc07372349de374358a791c7b1a6c736d6c619c2588b62272d070cac08df30fd0698e1c14c9b54fa8cf5c46eda60d895f0b577a0ca1c6a9273b9c2f75289531cb14d83c407cdd9e59fe60f7fdb7c3bb8f87fa94c3cb0738023a18ef88973d00e8e21ce2548419471fbe1cf12f73116d9de8f8e377baed87e5ea3a038cc70a9cb9fd5a90563ba213d7e6604551caf54943fb76b4e0655ed304b7606d837a480bca000d4672b66ef6a05778adf24b3e73c560f1ebff0ee22c855f05ca9a9e7836b3f922418268c4d24b1b2dceafaf46511744560ac201b7152eb253f4f46b969e3f17c2e638690feba570901fe1821b5edc4d8acd15ae65f6a65b46d31dfe8d6b1d80719b515170591658d0ef86e81277cf768039a1f5b2b19805c4d4a8c2f15ecfef2a712d555afa7fdc107ba459bba3d4b62e058749c9a62c4e3794be5789ee7a71562694138234011c97542e47e3837868f88b22f31bf777504c3d80e28c2a855b5567c0a5e053c2b66da9b9ec03902593d1c582782b9e71ee47e581b3b8be4df283ffec6b2e653a9ed0d1c1414d5216c89fb3ca247b8092aa4dc975fcfdc283ecb8f1bf550278c1e1e9ec0ee014b637d88366f7a5446308f029ede03bde2f991e504", 0x1000}, {&(0x7f0000000100)="afc7b974125a1b2144b3e3ee5ae272b467d370bdc81a51f171564a26cf3bee481b291bcf208a1f295f1d541399281bd88c1c258eed7e20798e59635343c3b21767e5428bf85fd8b2e8e64762eb3371d362cd15b8f560d6f84740530dfc149224ae69a1bb03694cbca10fe365f748aa5be4944750e314eff2223d7660dfc956e0ed46843a77201c955ca3be579bd20948b26f06795dee3f8790143fbeb3d1916775181e07cb747fd55e986e6f78ae086d853343", 0xb3}, {&(0x7f0000001480)="7acebd409a3bff68f37b7c46dce25259b9f3d17c9956c80a1b3044590d6ce460a56830876ef04d020a7b2d58ef3a23b8149b88d4a8e718cccc69d14b2dad172733be0fd9854bae7eb00fc641125e1595101996c0881f1d7ffcea310e6b59addfcbc4ede4898cf3bd9c93f2e53a7413e5c9a685b10eb574d591dc79679f21a8572fa0e5001d287ac48e0a429294af6e123208b5e569811333b2d4e0bcd59e35a2475b1d28796b7b11bfbff71480f2a2ef543b0abb86b4b91d3004769a8fe00a4923b69f928c12c97ed8a9153b9d494ffc36a5dfe71522323aafb64a52fbf26b5708f2", 0xe2}], 0x3) [ 2307.963054][T31369] binder: 31350:31369 ioctl c0306201 200002c0 returned -22 [ 2307.971151][T31424] input: syz0 as /devices/virtual/input/input3204 11:28:38 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x04\x00'}, 0x45c) 11:28:38 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="03630840ffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) 11:28:38 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x15\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) 11:28:38 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="006340400000000000000eda00"/70], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0163407c4258d240", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) [ 2308.182657][T31580] input: syz0 as /devices/virtual/input/input3205 [ 2308.201054][T21720] binder_release_work: 17 callbacks suppressed [ 2308.201062][T21720] binder: undelivered TRANSACTION_ERROR: 29189 [ 2308.228305][T31583] binder: 31579:31583 BC_FREE_BUFFER u1c1c2e37ffffffff no match [ 2308.252400][T31583] binder: 31579:31583 unknown command -922850423 [ 2308.264855][T31586] input: syz0 as /devices/virtual/input/input3207 [ 2308.282407][T31583] binder: 31579:31583 ioctl c0306201 200002c0 returned -22 [ 2308.293278][T31585] input: syz0 as /devices/virtual/input/input3206 11:28:38 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x05\x00'}, 0x45c) [ 2308.346858][T31591] binder: 31589:31591 unknown command 2084594433 [ 2308.356070][T31590] input: syz0 as /devices/virtual/input/input3208 [ 2308.363989][T31583] binder: BINDER_SET_CONTEXT_MGR already set [ 2308.384002][T31591] binder: 31589:31591 ioctl c0306201 200002c0 returned -22 [ 2308.393993][T31583] binder: 31579:31583 ioctl 40046207 0 returned -16 [ 2308.394059][T21720] binder: send failed reply for transaction 3376 to 31589:31591 [ 2308.434715][T31592] binder_transaction: 12 callbacks suppressed [ 2308.434741][T31592] binder: 31579:31592 transaction failed 29189/-22, size 0-0 line 2995 [ 2308.463506][T21720] binder: undelivered TRANSACTION_ERROR: 29189 [ 2308.471892][T31591] binder: 31589:31591 transaction failed 29189/-22, size 0-0 line 2995 11:28:38 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x16\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) [ 2308.501029][T31597] input: syz0 as /devices/virtual/input/input3209 [ 2308.522012][T22689] binder: undelivered TRANSACTION_ERROR: 29189 [ 2308.590381][T31702] input: syz0 as /devices/virtual/input/input3211 [ 2308.622916][T21720] binder: undelivered TRANSACTION_ERROR: 29189 [ 2308.667587][T31706] input: syz0 as /devices/virtual/input/input3212 11:28:39 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r1, 0xc02c5341, &(0x7f0000000280)={0x0, 0x0, 0x0, 'queue1\x00', 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff00000000]}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) 11:28:39 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0a630840ffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) 11:28:39 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000000000000f7ffffff0000000000000000000000000000000000000000000000000000000400000000000000000000423e70562382aec9dfde9fb716f6a27d34c9f3a25db31331e0d643dd89fe64222bd1a5fdb10749b5e86dc06917a1a3d5006af6e4257fb630d1"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x0, 0x0, 0x0}) 11:28:39 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r1, 0xc0505350, &(0x7f0000000500)={{}, {}, 0x2392, 0x5, 0x400}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) 11:28:39 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00'}, 0x45c) 11:28:39 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) [ 2308.842385][T31722] binder: 31716:31722 transaction failed 29189/-22, size 0-0 line 2995 [ 2308.857004][T31723] input: syz0 as /devices/virtual/input/input3213 [ 2308.864074][T31725] binder: BC_ATTEMPT_ACQUIRE not supported [ 2308.878716][T31721] input: syz0 as /devices/virtual/input/input3214 [ 2308.889877][T22689] binder: undelivered TRANSACTION_ERROR: 29189 [ 2308.897671][T31725] binder: 31719:31725 ioctl c0306201 200002c0 returned -22 [ 2308.920557][T31729] input: syz0 as /devices/virtual/input/input3215 11:28:39 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="10630840ffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) [ 2308.937485][T21720] binder: send failed reply for transaction 3382 to 31716:31722 [ 2308.959376][T21720] binder_release_work: 12 callbacks suppressed [ 2308.959382][T21720] binder: undelivered TRANSACTION_COMPLETE 11:28:39 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f00000000c0), 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x0, 0x0, 0x0}) 11:28:39 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00/\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) [ 2309.033258][T31737] input: syz0 as /devices/virtual/input/input3216 [ 2309.049842][T22689] binder: undelivered TRANSACTION_COMPLETE [ 2309.056165][T22689] binder: undelivered TRANSACTION_ERROR: 29189 [ 2309.149847][T31847] binder: 31844:31847 BC_DEAD_BINDER_DONE 1c1c2e37ffffffff not found [ 2309.165390][T31847] binder: 31844:31847 unknown command -922850423 [ 2309.188353][T31849] binder: 31846:31849 got reply transaction with no transaction stack 11:28:39 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x12\x00'}, 0x45c) [ 2309.195771][T31847] binder: 31844:31847 ioctl c0306201 200002c0 returned -22 [ 2309.225782][T31849] binder: 31846:31849 transaction failed 29201/-71, size 0-0 line 2900 [ 2309.234475][T31851] input: syz0 as /devices/virtual/input/input3217 [ 2309.246091][T21720] binder: undelivered TRANSACTION_COMPLETE [ 2309.258418][T21720] binder: undelivered TRANSACTION_COMPLETE 11:28:39 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0e630c40ffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) [ 2309.271694][T21720] binder: undelivered TRANSACTION_ERROR: 29201 [ 2309.285887][T31857] input: syz0 as /devices/virtual/input/input3218 [ 2309.312565][T31873] input: syz0 as /devices/virtual/input/input3219 [ 2309.365651][T31890] input: syz0 as /devices/virtual/input/input3220 11:28:39 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x14\x00'}, 0x45c) [ 2309.540213][T31970] binder: 31964:31970 BC_REQUEST_DEATH_NOTIFICATION invalid ref -1 [ 2309.561424][T31971] input: syz0 as /devices/virtual/input/input3221 [ 2309.574004][T31970] binder: 31964:31970 unknown command 967984310 [ 2309.582965][T31970] binder: 31964:31970 ioctl c0306201 200002c0 returned -22 [ 2309.602816][T22689] binder: undelivered TRANSACTION_COMPLETE [ 2309.621932][T22689] binder: undelivered TRANSACTION_COMPLETE 11:28:40 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r1, 0xc02c5341, &(0x7f0000000280)={0x0, 0x0, 0x0, 'queue1\x00', 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe]}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) 11:28:40 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00?\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) 11:28:40 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) pipe2(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) ioctl$KVM_GET_XSAVE(r1, 0x9000aea4, &(0x7f0000000480)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) getsockopt$netrom_NETROM_IDLE(r2, 0x103, 0x7, &(0x7f0000000040)=0x1, &(0x7f0000000080)=0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x0, 0x0, 0x0}) 11:28:40 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r1, 0xc0505350, &(0x7f0000000500)={{}, {}, 0x0, 0x5, 0x400}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) 11:28:40 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x15\x00'}, 0x45c) 11:28:40 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0f630c40ffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) [ 2309.810095][T31984] input: syz0 as /devices/virtual/input/input3223 [ 2309.828055][T31990] input: syz0 as /devices/virtual/input/input3224 11:28:40 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat(r0, &(0x7f0000000000)='./file0\x00', 0x20000, 0x30) accept$inet(r1, &(0x7f0000000040)={0x2, 0x0, @loopback}, &(0x7f0000000080)=0x10) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x0, 0x0, 0x0}) [ 2309.854228][T31993] binder: 31986:31993 BC_CLEAR_DEATH_NOTIFICATION invalid ref -1 [ 2309.883402][T31993] binder: 31986:31993 unknown command 967984310 [ 2309.920163][T31999] input: syz0 as /devices/virtual/input/input3225 [ 2309.939018][T31990] input: syz0 as /devices/virtual/input/input3226 [ 2309.949576][T32003] binder: 32001:32003 got reply transaction with bad transaction stack, transaction 3394 has target 31986:0 [ 2309.966075][T32003] binder: 32001:32003 transaction failed 29201/-71, size 0-0 line 2915 [ 2309.983304][T31993] binder: 31986:31993 ioctl c0306201 200002c0 returned -22 [ 2309.992637][T21720] binder_thread_release: 9 callbacks suppressed [ 2309.992647][T21720] binder: release 32001:32003 transaction 3394 out, still active [ 2310.001344][T21720] binder: undelivered TRANSACTION_COMPLETE 11:28:40 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) 11:28:40 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x16\x00'}, 0x45c) [ 2310.023405][T21720] binder: undelivered TRANSACTION_ERROR: 29201 [ 2310.041102][T22689] binder: release 31986:31993 transaction 3393 out, still active [ 2310.055317][T31993] binder: BINDER_SET_CONTEXT_MGR already set [ 2310.062166][T22689] binder: undelivered TRANSACTION_COMPLETE 11:28:40 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/policy\x00', 0x0, 0x0) getsockopt$bt_sco_SCO_OPTIONS(r1, 0x11, 0x1, &(0x7f0000000040)=""/92, &(0x7f00000000c0)=0x5c) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000280), 0x0, 0x0, 0x0}) [ 2310.102408][T31993] binder: 31986:31993 ioctl 40046207 0 returned -16 [ 2310.154115][T32116] input: syz0 as /devices/virtual/input/input3227 [ 2310.160657][T22689] binder_send_failed_reply: 9 callbacks suppressed [ 2310.160665][T22689] binder: send failed reply for transaction 3393, target dead [ 2310.160682][T22689] binder: send failed reply for transaction 3394, target dead [ 2310.164194][T32053] binder_alloc: 31986: binder_alloc_buf, no vma [ 2310.225877][T32118] input: syz0 as /devices/virtual/input/input3228 [ 2310.243586][T32123] binder: 32119:32123 transaction failed 29189/-22, size 0-0 line 2995 [ 2310.251725][T32053] binder: 31986:32053 transaction failed 29189/-3, size 0-0 line 3148 [ 2310.266059][T22689] binder: undelivered TRANSACTION_ERROR: 29189 11:28:40 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040ffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) [ 2310.299249][T32125] input: syz0 as /devices/virtual/input/input3229 [ 2310.331478][T32122] input: syz0 as /devices/virtual/input/input3230 11:28:40 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) [ 2310.488922][T32227] binder: 32200:32227 BC_INCREFS_DONE u1c1c2e37ffffffff no match [ 2310.513629][T32234] input: syz0 as /devices/virtual/input/input3231 [ 2310.521022][T32227] binder: 32200:32227 unknown command 788146283 [ 2310.530748][T32227] binder: 32200:32227 ioctl c0306201 200002c0 returned -22 [ 2310.551077][T22689] binder: undelivered TRANSACTION_ERROR: 29189 [ 2310.557352][T32236] input: syz0 as /devices/virtual/input/input3232 [ 2310.580816][T21720] binder: release 32200:32227 transaction 3399 out, still active [ 2310.594413][T32239] binder: BINDER_SET_CONTEXT_MGR already set [ 2310.596991][T21720] binder: undelivered TRANSACTION_COMPLETE [ 2310.615405][T32239] binder: 32200:32239 ioctl 40046207 0 returned -16 [ 2310.615644][T32240] binder_alloc: 32200: binder_alloc_buf, no vma [ 2310.645838][T21720] binder: send failed reply for transaction 3399, target dead [ 2310.663353][T32240] binder: 32200:32240 transaction failed 29189/-3, size 0-0 line 3148 11:28:41 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r1, 0xc02c5341, &(0x7f0000000280)={0x0, 0x0, 0x0, 'queue1\x00', 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe00]}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) 11:28:41 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00'}, 0x45c) 11:28:41 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00464040000000000000000000000000000000000000f9ffffffffffffff0000000000000000000000000000000000000000000000000000000000000000200000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x0, 0x0, 0x0}) mq_open(&(0x7f0000000000)='\xd0#posix_acl_access\x00', 0x40, 0x4c, &(0x7f0000000040)={0x3f, 0x5, 0x3ff, 0xffff, 0xff, 0x7fffffff, 0xffffffff7fffffff, 0x7c1}) openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/qat_adf_ctl\x00', 0x20c240, 0x0) 11:28:41 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r1, 0xc0505350, &(0x7f0000000500)={{}, {}, 0x0, 0x0, 0x400}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) 11:28:41 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) 11:28:41 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="09631040ffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) [ 2310.834836][T32254] input: syz0 as /devices/virtual/input/input3233 [ 2310.843757][T32255] input: syz0 as /devices/virtual/input/input3234 [ 2310.846846][T32256] binder: 32249:32256 BC_ACQUIRE_DONE u1c1c2e37ffffffff no match [ 2310.858599][T32258] binder: 32251:32258 unknown command 1077954048 [ 2310.888624][T32256] binder: 32249:32256 unknown command 788146283 [ 2310.895630][T32258] binder: 32251:32258 ioctl c0306201 20000440 returned -22 [ 2310.906518][T32256] binder: 32249:32256 ioctl c0306201 200002c0 returned -22 [ 2310.928381][ T1470] binder: release 32249:32256 transaction 3402 out, still active [ 2310.943125][T32295] binder: BINDER_SET_CONTEXT_MGR already set [ 2310.962506][ T1470] binder: undelivered TRANSACTION_COMPLETE [ 2310.962681][T32295] binder: 32249:32295 ioctl 40046207 0 returned -16 [ 2310.979854][T32316] input: syz0 as /devices/virtual/input/input3236 [ 2310.984763][T22689] binder: release 32249:32297 transaction 3403 out, still active 11:28:41 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) [ 2311.022166][T32263] input: syz0 as /devices/virtual/input/input3235 11:28:41 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/checkreqprot\x00', 0x80080, 0x0) ioctl$UI_DEV_SETUP(r1, 0x405c5503, &(0x7f0000000040)={{0x0, 0x2, 0xfffffffffffff5c5, 0x1}, 'syz1\x00', 0x37}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x0, 0x0, 0x0}) 11:28:41 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="00634040ffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) 11:28:41 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00/\x00'}, 0x45c) [ 2311.098439][T22689] binder: send failed reply for transaction 3402, target dead [ 2311.111644][T22689] binder: send failed reply for transaction 3403, target dead [ 2311.196800][T32382] input: syz0 as /devices/virtual/input/input3237 [ 2311.259097][T32387] binder: 32383:32387 transaction failed 29189/-22, size 0-0 line 2995 [ 2311.263440][T32388] binder: 32381:32388 got transaction to invalid handle [ 2311.275230][T32388] binder: 32381:32388 transaction failed 29201/-22, size 0-0 line 2995 [ 2311.287638][ T1470] binder: release 32381:32388 transaction 3406 out, still active [ 2311.302061][T32389] input: syz0 as /devices/virtual/input/input3238 [ 2311.307121][T32388] binder: BINDER_SET_CONTEXT_MGR already set [ 2311.315873][T32388] binder: 32381:32388 ioctl 40046207 0 returned -16 [ 2311.322718][T32387] binder_alloc: 32381: binder_alloc_buf, no vma [ 2311.323594][ T1470] binder: send failed reply for transaction 3406, target dead [ 2311.353172][T32382] input: syz0 as /devices/virtual/input/input3239 11:28:41 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="01634040ffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) 11:28:41 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00?\x00'}, 0x45c) [ 2311.533755][T32499] binder: 32497:32499 got reply transaction with bad transaction stack, transaction 3411 has target 32497:0 [ 2311.555622][T32503] input: syz0 as /devices/virtual/input/input3241 [ 2311.569934][ T1470] binder: release 32497:32499 transaction 3411 out, still active [ 2311.579597][T32499] binder: BINDER_SET_CONTEXT_MGR already set [ 2311.595242][ T1470] binder: send failed reply for transaction 3411, target dead [ 2311.617153][T32499] binder: 32497:32499 ioctl 40046207 0 returned -16 [ 2311.628827][T32506] input: syz0 as /devices/virtual/input/input3242 11:28:42 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r1, 0xc02c5341, &(0x7f0000000280)={0x0, 0x0, 0x0, 'queue1\x00', 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f00]}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) 11:28:42 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x8000, 0x0) getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(0xffffffffffffff9c, 0x84, 0x73, &(0x7f0000000040)={0x0, 0x6, 0x10, 0x4c52, 0x6}, &(0x7f0000000080)=0x18) getsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r1, 0x84, 0x72, &(0x7f00000000c0)={r2, 0x2}, &(0x7f0000000100)=0xc) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000380)={0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x14, 0x0, &(0x7f00000007c0)=[@acquire_done={0x40106309, r3, 0x4}, @transaction={0x40406300, {0x1, 0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@flat={0x0, 0xb, r3}], &(0x7f0000000480)=[0x0]}}, @increfs={0x40046304, 0x4}, @transaction_sg={0x40486311, {{0x4, 0x0, 0x3, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, &(0x7f00000005c0)=[@fd={0x66642a85, 0x0, r1, 0x0, 0x2}, @ptr={0x70742a85, 0x1, &(0x7f0000000580), 0x0, 0x4, 0x8}], &(0x7f0000000600)=[0x0, 0x28, 0x68, 0x38, 0x48]}, 0x4f3}}, @acquire={0x40046305, 0x1}, @exit_looper, @exit_looper, @acquire={0x40046305, 0x3}, @reply_sg={0x40486312, {{0x3, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)=[@fd={0x66642a85, 0x0, r0, 0x0, 0x3}, @fd={0x66642a85, 0x0, r1, 0x0, 0x3}], &(0x7f0000000680)=[0x28, 0x30, 0x78, 0x38]}, 0x10000}}, @transaction_sg={0x40486311, {{0x2, 0x0, 0x2, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, &(0x7f00000006c0)=[@flat={0x77682a85, 0xa, r3}, @flat={0x73682a85, 0x100, r3, 0x2}, @fd={0x66642a85, 0x0, r0, 0x0, 0x2}], &(0x7f0000000740)=[0x48, 0x48, 0x38, 0x48, 0x60, 0x20, 0x38, 0x38, 0x38, 0x60]}, 0x5}}], 0x17f, 0x0, 0x0}) 11:28:42 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x05\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) 11:28:42 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r1, 0xc0505350, &(0x7f0000000500)) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) 11:28:42 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x00\x00\x00\xff\xff\xff\xfe\x00'}, 0x45c) 11:28:42 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840ffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) [ 2311.832841][T32519] input: syz0 as /devices/virtual/input/input3243 [ 2311.848366][T32525] binder: 32515:32525 got transaction to invalid handle [ 2311.879807][T22689] binder: release 32515:32525 transaction 3415 out, still active [ 2311.887769][T32527] input: syz0 as /devices/virtual/input/input3245 [ 2311.905995][T32524] input: syz0 as /devices/virtual/input/input3244 [ 2311.913033][T32525] binder: BINDER_SET_CONTEXT_MGR already set 11:28:42 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x0, 0x0, 0x0}) r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/mixer\x00', 0x1, 0x0) ioctl$CAPI_SET_FLAGS(r1, 0x80044324, &(0x7f0000000080)) setsockopt$sock_linger(r1, 0x1, 0xd, &(0x7f0000000040)={0x0, 0x10001}, 0x8) [ 2311.937005][T32525] binder: 32515:32525 ioctl 40046207 0 returned -16 [ 2311.944512][T22689] binder: send failed reply for transaction 3415, target dead [ 2311.952695][T32531] binder_alloc: 32515: binder_alloc_buf, no vma [ 2311.973855][T22689] binder: send failed reply for transaction 3417 to 32516:32521 11:28:42 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="12634840ffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) 11:28:42 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x11\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) [ 2312.045902][T32534] input: syz0 as /devices/virtual/input/input3246 11:28:42 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x02\x00'}, 0x45c) 11:28:42 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = open(&(0x7f0000000000)='./file0\x00', 0x2, 0x40) ioctl$IMHOLD_L1(r1, 0x80044948, &(0x7f0000000040)=0xfffffffffffffff8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x0, 0x0, 0x0}) [ 2312.206623][T32651] input: syz0 as /devices/virtual/input/input3247 [ 2312.225265][T32654] binder: 32602:32654 got reply transaction with bad transaction stack, transaction 3422 has target 32602:0 [ 2312.304025][T32656] input: syz0 as /devices/virtual/input/input3248 [ 2312.318015][T22689] binder: release 32602:32654 transaction 3422 out, still active [ 2312.333667][T32661] binder: BINDER_SET_CONTEXT_MGR already set [ 2312.348790][T32660] input: syz0 as /devices/virtual/input/input3249 [ 2312.355984][ T1470] binder: release 32602:32662 transaction 3424 out, still active [ 2312.367445][T32665] binder: 32658:32665 got reply transaction with bad transaction stack, transaction 3425 has target 32602:0 [ 2312.370888][T32661] binder: 32602:32661 ioctl 40046207 0 returned -16 [ 2312.423942][T32666] input: syz0 as /devices/virtual/input/input3250 11:28:42 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) [ 2312.475707][T22689] binder: send failed reply for transaction 3422, target dead [ 2312.491125][T22689] binder: send failed reply for transaction 3424, target dead [ 2312.508250][T22689] binder: send failed reply for transaction 3427 to 32658:32665 [ 2312.629285][ T308] input: syz0 as /devices/virtual/input/input3251 11:28:43 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x03\x00'}, 0x45c) 11:28:43 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r1, 0xc02c5341, &(0x7f0000000280)={0x0, 0x0, 0x0, 'queue1\x00', 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe000000]}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) 11:28:43 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="12dfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) 11:28:43 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000e8e17e8f1ebc5c7ade2f2000"/71], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x0, 0x0, 0x0}) r1 = syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0x1, 0x2) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffff9c, 0x84, 0x6, &(0x7f00000000c0)={0x0, @in6={{0xa, 0x4e23, 0xfe, @local, 0xffffffff}}}, &(0x7f0000000180)=0x84) getsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(r1, 0x84, 0x18, &(0x7f00000001c0)={r2, 0x100000000}, &(0x7f0000000200)=0x8) 11:28:43 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r1, 0xc0505350, &(0x7f0000000500)) r2 = gettid() timer_create(0x0, 0x0, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) 11:28:43 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x14\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) [ 2312.793885][ T318] input: syz0 as /devices/virtual/input/input3253 [ 2312.847111][ T321] input: syz0 as /devices/virtual/input/input3254 [ 2312.848585][ T329] binder: 319:329 unknown command -8430 [ 2312.872868][ T331] input: syz0 as /devices/virtual/input/input3255 [ 2312.891031][ T333] input: syz0 as /devices/virtual/input/input3256 11:28:43 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0xfffffffffffeffff) r1 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffff9c, 0x0, 0x10, &(0x7f0000000040)={{{@in=@multicast2, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6}, 0x0, @in=@empty}}, &(0x7f0000000140)=0xe8) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0}) setsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000000480)={{{@in=@multicast2, @in6=@initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x4e20, 0xe28, 0x4e22, 0xe09, 0xa, 0x20, 0x80, 0x3e, r2, r3}, {0x100, 0x4, 0x2, 0x81, 0x9, 0x3, 0xf2a5}, {0x100000001, 0x0, 0x8, 0x80000000}, 0x101, 0x6e6bb6, 0x1, 0x1, 0x1, 0x3}, {{@in6=@mcast2, 0x4d2, 0x3f}, 0xa, @in6=@mcast2, 0x3503, 0x6, 0x0, 0x101, 0x3, 0x2, 0x81}}, 0xe8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x0, 0x0, 0x0}) syz_open_dev$usbmon(&(0x7f0000000000)='/dev/usbmon#\x00', 0x5a6, 0x181403) 11:28:43 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x04\x00'}, 0x45c) [ 2312.911596][ T329] binder: 319:329 ioctl c0306201 200002c0 returned -22 11:28:43 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x15\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) 11:28:43 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdffffffffeffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) 11:28:43 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r3, 0x4008ae89, &(0x7f0000000000)={0x1, 0x0, [0x10000040000021]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x0, 0x0, 0x0}) [ 2313.117917][ T350] input: syz0 as /devices/virtual/input/input3257 [ 2313.131030][ T351] input: syz0 as /devices/virtual/input/input3258 [ 2313.181244][ T357] input: syz0 as /devices/virtual/input/input3259 [ 2313.196122][ T359] input: syz0 as /devices/virtual/input/input3260 11:28:43 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x16\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) [ 2313.269251][ T363] binder: 353:363 unknown command -8196 [ 2313.306832][ T363] binder: 353:363 ioctl c0306201 200002c0 returned -22 11:28:43 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x05\x00'}, 0x45c) [ 2313.313711][T22689] binder_release_work: 16 callbacks suppressed [ 2313.313719][T22689] binder: undelivered TRANSACTION_ERROR: 29189 [ 2313.362106][ T378] binder: BINDER_SET_CONTEXT_MGR already set [ 2313.393116][ T378] binder: 353:378 ioctl 40046207 0 returned -16 [ 2313.434382][ T1470] binder: send failed reply for transaction 3436 to 358:364 [ 2313.443269][ T453] input: syz0 as /devices/virtual/input/input3262 [ 2313.473682][ T1470] binder: undelivered TRANSACTION_ERROR: 29189 [ 2313.499777][ T423] input: syz0 as /devices/virtual/input/input3261 [ 2313.524732][ T453] input: syz0 as /devices/virtual/input/input3263 [ 2313.578287][ T480] input: syz0 as /devices/virtual/input/input3264 11:28:44 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r1, 0xc02c5341, &(0x7f0000000280)={0x0, 0x0, 0x0, 'queue1\x00', 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f000000]}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) 11:28:44 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdffeffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) 11:28:44 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000000000000000000000000000000000000000000000000037b6d8dd354b2f889f8183d6ae527677cb251202f657da7400000000000000003100"/92], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x0, 0x0, 0x0}) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000)='/dev/hwrng\x00', 0x0, 0x0) r2 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) ioctl$LOOP_CTL_ADD(r1, 0x4c80, r2) [ 2313.750595][ T488] binder_transaction: 12 callbacks suppressed [ 2313.750610][ T488] binder: 486:488 transaction failed 29189/-22, size 0--8633599265918634441 line 2995 [ 2313.774914][ T1470] binder: undelivered TRANSACTION_ERROR: 29189 [ 2313.787845][ T488] binder: 486:488 transaction failed 29189/-22, size 0--8633599265918634441 line 2995 [ 2313.800268][ T490] binder: 487:490 unknown command -73732 [ 2313.805925][ T490] binder: 487:490 ioctl c0306201 200002c0 returned -22 [ 2313.893977][T22689] binder: undelivered TRANSACTION_ERROR: 29189 11:28:46 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r1, 0xc0505350, &(0x7f0000000500)) r2 = gettid() timer_create(0x0, 0x0, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) 11:28:46 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) 11:28:46 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x11\x00'}, 0x45c) 11:28:46 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdffffffffffeff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) 11:28:46 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB, @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) r1 = fcntl$dupfd(r0, 0x406, r0) recvmmsg(0xffffffffffffff9c, &(0x7f0000005700)=[{{&(0x7f0000000000)=@pppoe={0x18, 0x0, {0x0, @local}}, 0x80, &(0x7f0000000680)=[{&(0x7f0000000080)=""/233, 0xe9}, {&(0x7f0000000180)=""/96, 0x60}, {&(0x7f0000000200)=""/8, 0x8}, {&(0x7f0000000480)=""/149, 0x95}, {&(0x7f0000000380)=""/83, 0x53}, {&(0x7f0000000540)=""/138, 0x8a}, {&(0x7f0000000600)=""/117, 0x75}], 0x7, &(0x7f0000000700)=""/103, 0x67}, 0x37b}, {{&(0x7f0000000780)=@xdp={0x2c, 0x0, 0x0}, 0x80, &(0x7f0000001c00)=[{&(0x7f0000000800)=""/187, 0xbb}, {&(0x7f0000000240)=""/47, 0x2f}, {&(0x7f00000008c0)=""/96, 0x60}, {&(0x7f0000000940)=""/64, 0x40}, {&(0x7f0000000980)=""/11, 0xb}, {&(0x7f00000009c0)=""/184, 0xb8}, {&(0x7f0000000a80)=""/4096, 0x1000}, {&(0x7f0000001a80)=""/144, 0x90}, {&(0x7f0000001b40)=""/186, 0xba}], 0x9, &(0x7f0000001cc0)=""/139, 0x8b}, 0x9}, {{0x0, 0x0, &(0x7f0000001d80), 0x0, &(0x7f0000001dc0)=""/152, 0x98}, 0x4}, {{&(0x7f0000001e80)=@alg, 0x80, &(0x7f0000003200)=[{&(0x7f0000001f00)=""/180, 0xb4}, {&(0x7f0000001fc0)=""/245, 0xf5}, {&(0x7f00000020c0)=""/159, 0x9f}, {&(0x7f0000002180)=""/70, 0x46}, {&(0x7f0000002200)=""/4096, 0x1000}], 0x5, &(0x7f0000003280)=""/237, 0xed}, 0x1f}, {{&(0x7f0000003380)=@rxrpc=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x0, @multicast2}}, 0x80, &(0x7f00000046c0)=[{&(0x7f0000003400)=""/194, 0xc2}, {&(0x7f0000003500)=""/183, 0xb7}, {&(0x7f00000035c0)=""/4096, 0x1000}, {&(0x7f00000045c0)=""/203, 0xcb}], 0x4, &(0x7f0000004700)=""/4096, 0x1000}, 0x40}], 0x5, 0x40000141, 0x0) fstat(r0, &(0x7f0000005840)={0x0, 0x0, 0x0, 0x0, 0x0}) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000058c0)={{{@in6=@initdev={0xfe, 0x88, [], 0x0, 0x0}, @in6=@mcast1, 0x4e22, 0xffffffffffffff55, 0x4e23, 0xc29, 0x2, 0x80, 0xa0, 0xff, r2, r3}, {0x74, 0xdf, 0x4, 0x3, 0x8a9, 0x800, 0x0, 0x3}, {0x28d226d6, 0xfa96, 0x5, 0x5}, 0x8, 0x0, 0x1, 0x1, 0x2, 0x3}, {{@in=@rand_addr=0x6, 0x4d2, 0xff}, 0x0, @in=@multicast1, 0x0, 0x4, 0x3, 0xe4d, 0x0, 0xfffffffffffffc01, 0x3}}, 0xe8) 11:28:46 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r1, 0xc02c5341, &(0x7f0000000280)={0x0, 0x0, 0x0, 'queue1\x00', 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfeffffff]}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) [ 2315.869291][ T617] binder: 607:617 transaction failed 29189/-22, size 0-0 line 2995 [ 2315.885523][ T618] binder: 608:618 unknown command -8196 [ 2315.892017][ T615] input: syz0 as /devices/virtual/input/input3266 [ 2315.907658][ T616] input: syz0 as /devices/virtual/input/input3265 [ 2315.925383][ T618] binder: 608:618 ioctl c0306201 200002c0 returned -22 [ 2315.949062][T22689] binder_thread_release: 7 callbacks suppressed [ 2315.949073][T22689] binder: release 608:618 transaction 3446 out, still active [ 2315.966306][T22689] binder_release_work: 16 callbacks suppressed [ 2315.966312][T22689] binder: undelivered TRANSACTION_COMPLETE [ 2315.975733][ T618] binder: BINDER_SET_CONTEXT_MGR already set [ 2315.992129][ T616] input: syz0 as /devices/virtual/input/input3267 [ 2316.010577][ T628] binder_alloc: 608: binder_alloc_buf, no vma [ 2316.017284][T22689] binder_send_failed_reply: 7 callbacks suppressed 11:28:46 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x200000000) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000000020000000000000000000000000000000000000000000000002000"/68], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x0, 0x0, 0x0}) [ 2316.017291][T22689] binder: send failed reply for transaction 3446, target dead [ 2316.038021][T22689] binder: undelivered TRANSACTION_ERROR: 29189 [ 2316.059789][ T618] binder: 608:618 ioctl 40046207 0 returned -16 11:28:46 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x12\x00'}, 0x45c) [ 2316.083480][ T625] input: syz0 as /devices/virtual/input/input3268 [ 2316.106344][ T628] binder: 608:628 transaction failed 29189/-3, size 0-0 line 3148 [ 2316.114639][T22689] binder: undelivered TRANSACTION_ERROR: 29189 [ 2316.130743][ T637] binder: 635:637 transaction failed 29189/-22, size 0-137438953472 line 2995 [ 2316.175822][T22689] binder: undelivered TRANSACTION_ERROR: 29189 [ 2316.194980][ T637] binder: 635:637 transaction failed 29189/-22, size 0-137438953472 line 2995 11:28:46 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdffffeffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) 11:28:46 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00/\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) [ 2316.224703][ T643] input: syz0 as /devices/virtual/input/input3269 [ 2316.330901][ T709] input: syz0 as /devices/virtual/input/input3270 [ 2316.352003][ T723] input: syz0 as /devices/virtual/input/input3271 [ 2316.389171][ T755] binder: 670:755 unknown command -16785412 [ 2316.401773][ T757] input: syz0 as /devices/virtual/input/input3272 [ 2316.410976][ T755] binder: 670:755 ioctl c0306201 200002c0 returned -22 [ 2316.424217][T22689] binder: release 670:755 transaction 3451 out, still active 11:28:46 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0063404000000000007fffffff00"/68], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x0, 0x0, 0x0}) 11:28:46 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x14\x00'}, 0x45c) [ 2316.443688][T22689] binder: undelivered TRANSACTION_COMPLETE [ 2316.456671][ T755] binder: BINDER_SET_CONTEXT_MGR already set [ 2316.478162][ T759] binder_alloc: 670: binder_alloc_buf, no vma [ 2316.506777][T22689] binder: undelivered TRANSACTION_ERROR: 29189 [ 2316.512565][ T755] binder: 670:755 ioctl 40046207 0 returned -16 [ 2316.513169][T22689] binder: send failed reply for transaction 3451, target dead [ 2316.545923][ T759] binder: 670:759 transaction failed 29189/-3, size 0-0 line 3148 [ 2316.574671][ T1470] binder: undelivered TRANSACTION_ERROR: 29189 [ 2316.582441][ T766] binder: 761:766 transaction failed 29189/-22, size 0-0 line 2995 [ 2316.597784][ T766] binder: 761:766 transaction failed 29189/-22, size 0-0 line 2995 [ 2316.605921][T22689] binder: undelivered TRANSACTION_ERROR: 29189 [ 2316.617675][ T767] input: syz0 as /devices/virtual/input/input3273 [ 2316.665531][ T771] input: syz0 as /devices/virtual/input/input3274 11:28:49 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r1, 0xc0505350, &(0x7f0000000500)) r2 = gettid() timer_create(0x0, 0x0, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) 11:28:49 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00?\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) 11:28:49 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdffffffffffffe372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) 11:28:49 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x15\x00'}, 0x45c) 11:28:49 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r1, 0xc02c5341, &(0x7f0000000280)={0x0, 0x0, 0x0, 'queue1\x00', 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe]}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) 11:28:49 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x0, 0x0, 0x0}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x800) [ 2318.923059][ T888] input: syz0 as /devices/virtual/input/input3275 [ 2318.933120][ T889] binder: 886:889 unknown command -8196 [ 2318.944694][ T891] input: syz0 as /devices/virtual/input/input3276 [ 2318.951930][ T885] binder: 882:885 got reply transaction with bad transaction stack, transaction 3457 has target 886:0 [ 2318.969950][ T889] binder: 886:889 ioctl c0306201 200002c0 returned -22 [ 2318.986581][ T885] binder: 882:885 transaction failed 29201/-71, size 0-0 line 2915 [ 2318.997103][T22689] binder: release 886:889 transaction 3456 out, still active [ 2319.004672][T22689] binder: undelivered TRANSACTION_COMPLETE [ 2319.010334][ T897] binder_alloc: 886: binder_alloc_buf, no vma [ 2319.033003][T22689] binder: send failed reply for transaction 3456, target dead [ 2319.042469][ T897] binder: 886:897 transaction failed 29189/-3, size 0-0 line 3148 [ 2319.062439][ T910] input: syz0 as /devices/virtual/input/input3278 [ 2319.068932][ T895] input: syz0 as /devices/virtual/input/input3277 [ 2319.076083][T22689] binder: send failed reply for transaction 3457 to 882:885 [ 2319.110423][T22689] binder_release_work: 1 callbacks suppressed [ 2319.110431][T22689] binder: undelivered TRANSACTION_ERROR: 29189 11:28:49 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x0, 0x0, 0x0}) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000000)="a0531b593a05f53047aa8107a1a2c4935f3e75394967afdf8297a6c5e8fe26246ff9ec71bd78ade2a7b0ad0afb59ff97f6452b02ab86f9454a1f05c469aab053d60cd36017f39810edbda8dbe15e5b2d5befd2d9bef641423d47d543f2b0ac177658307c9cae8e72eff3", 0x6a, r0}, 0x68) mmap$binder(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x300000c, 0x13, r0, 0x3) 11:28:49 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x16\x00'}, 0x45c) 11:28:49 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdffffffeffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) [ 2319.153708][T22689] binder: undelivered TRANSACTION_COMPLETE [ 2319.178621][T22689] binder: undelivered TRANSACTION_ERROR: 29201 11:28:49 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\xff\xff\xff\xfe\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) [ 2319.198970][T22689] binder: undelivered TRANSACTION_ERROR: 29189 [ 2319.239504][ T1013] binder: 1010:1013 transaction failed 29189/-22, size 0-0 line 2995 [ 2319.262444][T22689] binder: undelivered TRANSACTION_ERROR: 29189 [ 2319.287264][ T1013] binder: 1010:1013 transaction failed 29189/-22, size 0-0 line 2995 [ 2319.309053][ T1018] input: syz0 as /devices/virtual/input/input3279 [ 2319.349476][ T1107] input: syz0 as /devices/virtual/input/input3280 [ 2319.360187][ T1077] binder: 1015:1077 unknown command -8196 [ 2319.367392][ T1077] binder: 1015:1077 ioctl c0306201 200002c0 returned -22 11:28:49 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0163e188", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) [ 2319.402367][ T1133] input: syz0 as /devices/virtual/input/input3281 [ 2319.423613][T22689] binder: release 1015:1077 transaction 3464 out, still active [ 2319.437512][ T1077] binder: BINDER_SET_CONTEXT_MGR already set [ 2319.441429][T22689] binder: undelivered TRANSACTION_COMPLETE [ 2319.471832][ T1107] input: syz0 as /devices/virtual/input/input3282 [ 2319.479819][ T1077] binder: 1015:1077 ioctl 40046207 0 returned -16 [ 2319.504250][ T1142] binder_alloc: 1015: binder_alloc_buf, no vma 11:28:49 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00/\x00'}, 0x45c) [ 2319.528998][T22689] binder: send failed reply for transaction 3464, target dead [ 2319.539972][T22689] binder: undelivered TRANSACTION_ERROR: 29189 [ 2319.552139][ T1136] binder_alloc: 1015: binder_alloc_buf, no vma [ 2319.577718][ T1142] binder: 1139:1142 transaction failed 29189/-3, size 0-0 line 3148 [ 2319.597153][ T1136] binder: 1015:1136 transaction failed 29189/-3, size 0-0 line 3148 [ 2319.635618][ T1470] binder: undelivered TRANSACTION_ERROR: 29189 [ 2319.643117][ T1206] input: syz0 as /devices/virtual/input/input3283 [ 2319.702423][ T1257] input: syz0 as /devices/virtual/input/input3284 [ 2319.723242][ T1470] binder: undelivered TRANSACTION_ERROR: 29189 11:28:52 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff0a2e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) 11:28:52 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\xfe\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) 11:28:52 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r1, 0xc0505350, &(0x7f0000000500)) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x0, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) 11:28:52 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x0, 0x0, 0x0}) 11:28:52 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x00\x03\x00'}, 0x45c) 11:28:52 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r1, 0xc02c5341, &(0x7f0000000280)={0x0, 0x0, 0x0, 'queue1\x00', 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe00000000000000]}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) [ 2322.024536][ T1273] input: syz0 as /devices/virtual/input/input3285 [ 2322.039487][ T1274] binder: 1267:1274 transaction failed 29189/-22, size 0-0 line 2995 [ 2322.062918][ T1276] input: syz0 as /devices/virtual/input/input3286 [ 2322.076831][ T1278] binder: 1266:1278 unknown command -8196 [ 2322.082894][ T1278] binder: 1266:1278 ioctl c0306201 200002c0 returned -22 [ 2322.102791][ T1470] binder: release 1266:1278 transaction 3469 out, still active [ 2322.117515][ T1311] input: syz0 as /devices/virtual/input/input3287 [ 2322.134554][ T1278] binder: BINDER_SET_CONTEXT_MGR already set [ 2322.141877][ T1470] binder: undelivered TRANSACTION_COMPLETE [ 2322.154786][ T1278] binder: 1266:1278 ioctl 40046207 0 returned -16 [ 2322.171021][ T1470] binder: send failed reply for transaction 3469, target dead [ 2322.183583][ T1376] input: syz0 as /devices/virtual/input/input3288 [ 2322.193876][ T1313] binder: 1266:1313 transaction failed 29189/-22, size 0-0 line 2995 [ 2322.223390][ T1470] binder: undelivered TRANSACTION_ERROR: 29189 11:28:52 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="01634040", @ANYRES64=0x0, @ANYBLOB="00000000000000008c9fc408931ba808d419adee81fd36ee830b901c52168f25ae1db9d08f5dfd69328b92f629368f13e0abcd795e9f68342bb16ad91a49d8fdd1cf0154e0b4c7dc40584ae76034b1fcce8036fa627e5b601e146c3655a358c007dfd06c8b86af594cdf22376e10fb757b180eba8ce78e98b4bf1c458b7a0930dc610d8d72da7b1a989a56ce8b3d3ec6e950a54aaf6134bd5aa161a09042541011b851268837cbb3086931240d2df04faccf63d365c64ba2976f8f2f6caf56b52ad0d64bce876fbab1f8e297f32f998801a971412aaf10cb79"], 0x0, 0x0, 0x0}) r1 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000100)='/dev/qat_adf_ctl\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_TLV_COMMAND(r1, 0xc008551c, &(0x7f0000000140)={0x5, 0x10, [0x1, 0x1, 0x9, 0x3]}) 11:28:52 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) [ 2322.250639][T22689] binder: undelivered TRANSACTION_ERROR: 29189 11:28:52 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff412e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) 11:28:52 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x00\x05\x00'}, 0x45c) [ 2322.312260][ T1401] binder: 1398:1401 transaction failed 29189/-22, size 0-0 line 2995 [ 2322.415794][ T1428] binder: 1413:1428 unknown command -8196 [ 2322.423747][ T1428] binder: 1413:1428 ioctl c0306201 200002c0 returned -22 [ 2322.431804][ T1436] input: syz0 as /devices/virtual/input/input3289 [ 2322.439383][ T1442] input: syz0 as /devices/virtual/input/input3290 [ 2322.467909][T22689] binder: release 1413:1428 transaction 3473 out, still active [ 2322.478224][ T1512] input: syz0 as /devices/virtual/input/input3291 [ 2322.502813][ T1428] binder: BINDER_SET_CONTEXT_MGR already set 11:28:52 executing program 0: r0 = syz_open_procfs$namespace(0x0, &(0x7f0000000080)='ns/user\x00') setns(r0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x0, 0x0, 0x0}) r2 = syz_open_dev$radio(&(0x7f0000000000)='/dev/radio#\x00', 0x0, 0x2) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xd, &(0x7f00000000c0)='/dev/binder#\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x6, &(0x7f0000000140)='-ppp1\x00', 0xffffffffffffffff}, 0x30) sendmsg$nl_netfilter(r2, &(0x7f0000000200)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x54100}, 0xc, &(0x7f00000001c0)={&(0x7f0000000480)={0x4dc, 0x3, 0x1, 0x1, 0x70bd2c, 0x25dfdbff, {0x7, 0x0, 0x2}, [@typed={0x8, 0x53, @binary="52aa4888"}, @typed={0x8, 0x68, @ipv4=@multicast1}, @generic, @nested={0x120, 0x48, [@typed={0xfc, 0x54, @binary="18d791c82cb54fb4a453bfe007832a900fb9e908292167fd240eae4a6ba261b520001024c7fb19e7ea85990d03720e64d6cc7b1531f0c2539aa72b536e0fc24b102120ac47b79062f9b305436f68b8501f8d6b10e3389cf18235260a25d7d025e499ad854d8f88b00226705a972f47c920917b0b1b14c6693d44c3c0111437e1bf78436aa6ca92623a7c8fd2439c8cf59a961faf1d728a03c23464f497489ab0d248fe66ba80d1cfd904b72bdc3ea873581ecce5d66540538409de518848686a0c41f30d043417ead14308db757e381732a019b2b296155b9c52fb50ac4a982fd2d61420342a8139d5ebfad41be2d0f7a623210542"}, @typed={0x8, 0x40, @pid=r3}, @generic="6dc85e27a7bcac089117df26758ed97bb4dd47461d5a"]}, @nested={0x180, 0x12, [@typed={0x8, 0x1e, @ipv4=@local}, @generic="182125e46a1a58606795c0825569a258f2038af65a5381200a76a7c437c4eca2ce169063165ad1a633f84960f928e5fe17df6fd5c610c1001e14ee19eac5cc0da90031745d4912bea922ea27533620c51f430ff20b1ad6436b7e03c9ab42149bc093d5140fc111a639180d76882901d947eb5d8f13118d6ca2dd757c38d05f4429e9e92b20afab109f6c", @generic="5d74bee7622d2e75ebcd6b40c4f3cb1e73396400ee4fa3a01e2729da515f3ee1dadcce4793ec0af5adac1e803753eceaf9342e9eab5e30f136ef2b1ac533bffd9f189b5395db76b7336b276e0e93fcea161585a36086efc937176431b7b517190845a3d5915f4c98c7a3f025c1e5926337c7a56f6948a8431f12d1bb212f8969edc3682ffa89d9a82af74e783e2688af0ab956fd45c36bfedd7d1130c460afee592ceac7dcc4dacfb9bc87c734096e27f542cce89d797dd9391e25d7ea8f044bda8720a8502c84e26c0c5dceca43966f0bc783bfd349526173d22762f9ea14ace4de051ef6b9e03ae6"]}, @generic, @nested={0x218, 0x5a, [@typed={0xc, 0x19, @str='ns/user\x00'}, @typed={0x8, 0x5d, @pid=r4}, @generic="433be8b8d7fb2250c5f962ababa74c4a17e634561f779e0438c34f3987b2a78aafb9399f59385cb941c331b7036c969eb6eb366b835a0e2746ae802b7122f65cd79b14cf473707cbd64c44897e79c08c3368", @generic="9749e3ead4dd04fc808d767d255e98b892a37b4d7df3c1975e1ec351c21de6a4c4c8111ace3721261f5c6c6a27aae50f2910ead53ec7d4e0c70e22e13536742cf6741ca82ba3b178fa5e9d1dbab90d3a17219286341564a042ce35969e3acc73f28f4c99001164b9864ac9a3a6e294dd9e0abd21d89886ad1bae59d03b0b8dc52fd533bfbba916c9914b4322c8e744766b7b4d4246645a40cab3", @typed={0x8, 0xe, @ipv4=@multicast2}, @generic="1a0956fd194855e441099f8fe5fd2c", @generic="4a62054c8ff2f00898d9eefa3bf29705dc5e2974a0f9fded1b3c09239362709cd3ab5e644a3ec673fca29e37f09e659ac514a2b9a1ab484dd946b9e8e52c607299fcf5c33eaa999646adb02812d11265cb82e1149818d2ea36cde4090ba2a8debe68b41489b37ec56378ed968e142c39947a842d4454b257c4fb30e4bdc487a54b36a23f0f17c6de2704dd836aaa71265abba9d82699eddc067fe0f34820e14207e03ccd8ac95c47aafb74f87e939acba8ddc0968945b21918fba4b96861ff49b5c78124f4c4a1feb9ac7b04824d89e0892889f79354f938445bb5fe76ff660bc91c5ce70d1b61fb80981cce850391f637c47600adc259f350ae0ea3"]}]}, 0x4dc}, 0x1, 0x0, 0x0, 0x40000}, 0x0) [ 2322.516309][T22689] binder: undelivered TRANSACTION_COMPLETE [ 2322.530802][ T1517] input: syz0 as /devices/virtual/input/input3292 [ 2322.560543][ T1428] binder: 1413:1428 ioctl 40046207 0 returned -16 [ 2322.560584][T22689] binder: send failed reply for transaction 3473, target dead 11:28:52 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x00\x11\x00'}, 0x45c) [ 2322.616679][T22689] binder: undelivered TRANSACTION_ERROR: 29189 11:28:52 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff502e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) 11:28:52 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) [ 2322.667569][ T1526] binder: 1525:1526 transaction failed 29189/-22, size 0-0 line 2995 [ 2322.756608][ T1532] input: syz0 as /devices/virtual/input/input3293 [ 2322.798898][ T1535] binder: 1531:1535 unknown command -8196 [ 2322.840388][ T1537] input: syz0 as /devices/virtual/input/input3294 [ 2322.860344][ T1535] binder: 1531:1535 ioctl c0306201 200002c0 returned -22 [ 2322.871913][ T1470] binder: release 1531:1535 transaction 3476 out, still active [ 2322.892982][ T1541] input: syz0 as /devices/virtual/input/input3295 [ 2322.902385][ T1470] binder: undelivered TRANSACTION_COMPLETE [ 2322.929295][ T1470] binder: release 1531:1545 transaction 3477 out, still active [ 2322.950716][ T1470] binder: undelivered TRANSACTION_COMPLETE [ 2322.984338][ T1470] binder: send failed reply for transaction 3476, target dead [ 2323.005357][ T1470] binder: send failed reply for transaction 3477, target dead [ 2323.019436][ T1546] input: syz0 as /devices/virtual/input/input3296 11:28:55 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r1, 0xc0505350, &(0x7f0000000500)) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x0, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) 11:28:55 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) getrlimit(0x7, &(0x7f0000000040)) sched_yield() ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x0, 0x0, 0x0}) r1 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$IP_VS_SO_SET_ZERO(r1, 0x0, 0x48f, &(0x7f0000000000)={0xff, @initdev={0xac, 0x1e, 0x1, 0x0}, 0x4e24, 0x2, 'lc\x00', 0x11, 0x1, 0x38}, 0x2c) ioctl$FS_IOC_SETFSLABEL(r0, 0x41009432, &(0x7f0000000100)="8add844997821bc5b69c5cf1a0ac1760f3bd02a181cb2c2d556eb28aa1ec15cf1d4711e044f01b56751943568d0eea02579a37261a7ca7822cf1c2d7b7250c61b2b6d4e4ae9a39cde95b3f0f5bd4ba1e5c7cb2b6383410b6d623f91d1d90be49328d77a1546ec20f380626aaa499fbabcbf080b1f0b19f63da9e737c5b56dfbbe37ce74b7286461e92b474486702e36bfe59c2354173bde2d0c7db5ce4f0c8ae58c02d3ed5861c6dd89428ef358fdcb25d1c6afba73a4d0dc333e633c5e087bd6cb4dd7267331dd48bd4f77350e4495cacc2bf5ffe2389c815e170fe6676705d042883d56922253cf381b5ae816ec7d1c68cd6ff4374a051a68c51bf735d7083") 11:28:55 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r1, 0xc02c5341, &(0x7f0000000280)={0x0, 0x0, 0x0, 'queue1\x00', 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f00000000000000]}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) 11:28:55 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x00\x12\x00'}, 0x45c) 11:28:55 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff370a1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) 11:28:55 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) [ 2325.118402][ T1556] binder: 1552:1556 transaction failed 29189/-22, size 0-0 line 2995 [ 2325.137040][ T1573] binder: 1560:1573 unknown command -8196 [ 2325.143323][ T1573] binder: 1560:1573 ioctl c0306201 200002c0 returned -22 [ 2325.163704][ T1574] input: syz0 as /devices/virtual/input/input3298 [ 2325.171313][ T1575] input: syz0 as /devices/virtual/input/input3297 [ 2325.182324][T22689] binder: release 1560:1573 transaction 3480 out, still active [ 2325.194364][ T1556] IPVS: set_ctl: invalid protocol: 255 172.30.1.1:20004 [ 2325.205039][ T1573] binder: BINDER_SET_CONTEXT_MGR already set [ 2325.206086][T22689] binder: undelivered TRANSACTION_COMPLETE [ 2325.222569][ T1581] binder_alloc: 1560: binder_alloc_buf, no vma [ 2325.226740][ T1556] binder: 1552:1556 ioctl 41009432 20000100 returned -22 [ 2325.238820][T22689] binder: send failed reply for transaction 3480, target dead [ 2325.260791][ T1556] binder: 1552:1556 transaction failed 29189/-22, size 0-0 line 2995 11:28:55 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x00\x14\x00'}, 0x45c) [ 2325.270501][T22689] binder_release_work: 1 callbacks suppressed [ 2325.270509][T22689] binder: undelivered TRANSACTION_ERROR: 29189 [ 2325.297738][ T1573] binder: 1560:1573 ioctl 40046207 0 returned -16 [ 2325.298538][ T1581] binder: 1560:1581 transaction failed 29189/-3, size 0-0 line 3148 11:28:55 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x04\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) [ 2325.342898][T22689] binder: undelivered TRANSACTION_ERROR: 29189 11:28:55 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff37251c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) 11:28:55 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x801) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@\x00'/68], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x0, 0x0, 0x0}) r1 = syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x9, 0x200) getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(0xffffffffffffff9c, 0x84, 0x6d, &(0x7f0000000080)={0x0, 0xb2, "7bdefa5670b6676b9786971066ce95c163468757b265e4645160337f6ce7eff5ad2c15099379a44d6c888927b969a2300b28d45cba397389268fca6b0d7c47c8fb6748fafe8437e40f232a56ea34542b567c07d0482cc0726df80159322813b5839ce873ad00759e3d0e962d932643889993097f8c4f11c5a0ef34dce8d06d309ac2502a80e7305e53a38f6741dec2b4eae662ad5e7dfc5c27f2835e866b849dce09c74f1ea22ebe31cc07e9ab4f4f30326c"}, &(0x7f0000000140)=0xba) setsockopt$inet_sctp6_SCTP_MAXSEG(r1, 0x84, 0xd, &(0x7f0000000180)=@assoc_value={r2, 0xfff}, 0x8) [ 2325.424087][ T1698] input: syz0 as /devices/virtual/input/input3301 [ 2325.464041][ T1470] binder: undelivered TRANSACTION_ERROR: 29189 [ 2325.500664][ T1705] input: syz0 as /devices/virtual/input/input3303 [ 2325.539423][ T1701] input: syz0 as /devices/virtual/input/input3302 [ 2325.567850][ T1711] binder: 1702:1711 unknown command -8196 [ 2325.574620][ T1712] binder: 1708:1712 got reply transaction with bad transaction stack, transaction 3485 has target 1702:0 [ 2325.585983][ T1711] binder: 1702:1711 ioctl c0306201 200002c0 returned -22 [ 2325.598335][ T1712] binder: 1708:1712 transaction failed 29201/-71, size 0-0 line 2915 11:28:55 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x00\x15\x00'}, 0x45c) 11:28:55 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) openat$selinux_load(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/load\x00', 0x2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x0, 0x0, 0x0}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x802) [ 2325.651309][T22689] binder: release 1702:1711 transaction 3484 out, still active [ 2325.670410][T22689] binder: undelivered TRANSACTION_COMPLETE [ 2325.679030][ T1711] binder: BINDER_SET_CONTEXT_MGR already set [ 2325.707851][ T1711] binder: 1702:1711 ioctl 40046207 0 returned -16 [ 2325.745025][T22689] binder: send failed reply for transaction 3484, target dead [ 2325.764981][ T1713] binder_alloc: 1702: binder_alloc_buf, no vma [ 2325.769237][ T1721] binder: 1718:1721 transaction failed 29189/-22, size 0-0 line 2995 [ 2325.783969][T22689] binder: send failed reply for transaction 3485 to 1708:1712 [ 2325.789616][ T1713] binder: 1702:1713 transaction failed 29189/-3, size 0-0 line 3148 [ 2325.799976][ T1719] input: syz0 as /devices/virtual/input/input3305 [ 2325.811006][T22689] binder: undelivered TRANSACTION_ERROR: 29189 [ 2325.835785][T22689] binder: undelivered TRANSACTION_ERROR: 29189 [ 2325.851048][ T1727] input: syz0 as /devices/virtual/input/input3306 [ 2325.874485][T22689] binder: undelivered TRANSACTION_COMPLETE [ 2325.899324][T22689] binder: undelivered TRANSACTION_ERROR: 29201 [ 2325.929820][T22689] binder: undelivered TRANSACTION_ERROR: 29189 11:28:58 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r1, 0xc0505350, &(0x7f0000000500)) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x0, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) 11:28:58 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x05\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) 11:28:58 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff37411c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) 11:28:58 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) prctl$PR_SET_KEEPCAPS(0x8, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x0, 0x0, 0x0}) r1 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm_plock\x00', 0x42002, 0x0) setsockopt$inet_int(r1, 0x0, 0x17, &(0x7f0000000040)=0xa838, 0x4) 11:28:58 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x00\x16\x00'}, 0x45c) 11:28:58 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r1, 0xc02c5341, &(0x7f0000000280)={0x0, 0x0, 0x0, 'queue1\x00', 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfeffffff00000000]}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) [ 2328.234318][ T1841] binder: 1835:1841 unknown command -8196 [ 2328.251821][ T1843] input: syz0 as /devices/virtual/input/input3307 [ 2328.263388][ T1841] binder: 1835:1841 ioctl c0306201 200002c0 returned -22 [ 2328.281297][ T1845] binder: 1840:1845 got reply transaction with bad transaction stack, transaction 3491 has target 1835:0 [ 2328.298211][ T1846] input: syz0 as /devices/virtual/input/input3308 [ 2328.303830][ T1470] binder: release 1835:1841 transaction 3490 out, still active [ 2328.321852][ T1470] binder: undelivered TRANSACTION_COMPLETE [ 2328.324117][ T1845] binder: 1840:1845 transaction failed 29201/-71, size 0-0 line 2915 [ 2328.341525][ T1864] input: syz0 as /devices/virtual/input/input3309 [ 2328.362165][ T1470] binder: release 1835:1872 transaction 3493 out, still active [ 2328.393062][ T1470] binder: undelivered TRANSACTION_COMPLETE [ 2328.420580][ T1846] input: syz0 as /devices/virtual/input/input3310 11:28:58 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff37501c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) [ 2328.465362][T22689] binder: send failed reply for transaction 3490, target dead [ 2328.476862][T22689] binder: send failed reply for transaction 3491 to 1840:1845 11:28:58 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x0, 0x0, 0x0}) r1 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/hash_stats\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_GET_ASSOC_STATS(0xffffffffffffffff, 0x84, 0x70, &(0x7f0000000040)={0x0, @in6={{0xa, 0x4e23, 0x8, @mcast2, 0x400}}, [0xfffffffffffffffd, 0x32, 0x6, 0x100000001, 0xff, 0x7, 0x3, 0xd521, 0x800, 0x6d, 0x0, 0x7fffffff, 0x2, 0x0, 0xaf]}, &(0x7f0000000140)=0x100) setsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(r1, 0x84, 0x22, &(0x7f0000000180)={0x4, 0x8200, 0x0, 0x1c1f, r2}, 0x10) 11:28:58 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x00\x1f\x00'}, 0x45c) [ 2328.515094][T22689] binder: send failed reply for transaction 3493, target dead [ 2328.555187][T22689] binder: undelivered TRANSACTION_COMPLETE [ 2328.577891][T22689] binder: undelivered TRANSACTION_ERROR: 29201 [ 2328.601211][ T1967] binder: 1964:1967 unknown command -8196 [ 2328.603278][T22689] binder: undelivered TRANSACTION_ERROR: 29189 11:28:58 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) [ 2328.629946][ T1967] binder: 1964:1967 ioctl c0306201 200002c0 returned -22 [ 2328.639180][ T1970] input: syz0 as /devices/virtual/input/input3311 [ 2328.651705][T22689] binder: release 1964:1967 transaction 3495 out, still active [ 2328.669620][T22689] binder: undelivered TRANSACTION_COMPLETE [ 2328.674793][ T1974] binder: 1969:1974 got reply transaction with bad transaction stack, transaction 3496 has target 1964:0 [ 2328.675917][ T1967] binder: BINDER_SET_CONTEXT_MGR already set [ 2328.689468][ T1971] binder_alloc: 1964: binder_alloc_buf, no vma [ 2328.725048][ T1975] input: syz0 as /devices/virtual/input/input3312 [ 2328.732376][ T1974] binder: 1969:1974 transaction failed 29201/-71, size 0-0 line 2915 [ 2328.740998][T22689] binder: send failed reply for transaction 3495, target dead [ 2328.759742][ T1967] binder: 1964:1967 ioctl 40046207 0 returned -16 [ 2328.775531][ T1971] binder: 1964:1971 transaction failed 29189/-3, size 0-0 line 3148 [ 2328.782658][T22689] binder: send failed reply for transaction 3496 to 1969:1974 [ 2328.793232][ T1990] input: syz0 as /devices/virtual/input/input3313 11:28:59 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x00/\x00'}, 0x45c) [ 2328.834900][ T1470] binder: undelivered TRANSACTION_ERROR: 29189 11:28:59 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="01634040", @ANYRES64=0x0, @ANYBLOB="000000f200000000d91f1f9c82b1c0900045df8f93056ddd7e2445f901cf947a9eaae42781ac73ac40e2b4befc847878947ec34b38"], 0x0, 0x0, 0x0}) [ 2328.886021][ T2083] input: syz0 as /devices/virtual/input/input3314 [ 2328.899545][ T1470] binder: undelivered TRANSACTION_COMPLETE [ 2328.974003][ T2088] input: syz0 as /devices/virtual/input/input3315 [ 2328.992072][ T2090] binder: 2089:2090 transaction failed 29189/-22, size 0-0 line 2995 [ 2329.021796][ T2093] input: syz0 as /devices/virtual/input/input3316 11:29:01 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r1, 0xc0505350, &(0x7f0000000500)) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) 11:29:01 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e411c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) 11:29:01 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) 11:29:01 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x00?\x00'}, 0x45c) 11:29:01 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r1, 0xc02c5341, &(0x7f0000000280)={0x0, 0x0, 0x0, 'queue1\x00', 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff00000000]}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) 11:29:01 executing program 0: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000000000000000000000000a00000066679a42dc2e43cb0000000000000000000000000000000000000000000000000000000000000000009a2a1d9b78e6c2a402cb160d3352920b9bd503506c0550ec9280d88e5a2becb7a270e7d4ecc3dc5f70a8"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000002c0)={0x10, 0x0, &(0x7f0000000280)=[@request_death={0x400c630e, 0x2}], 0x0, 0x0, 0x0}) [ 2331.298513][ T2204] input: syz0 as /devices/virtual/input/input3317 [ 2331.333286][ T2214] input: syz0 as /devices/virtual/input/input3318 [ 2331.348403][ T2215] binder: 2209:2215 unknown command -8196 11:29:01 executing program 0: r0 = socket(0x9, 0x1, 0x2c7) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300)='/dev/sequencer\x00', 0x4000, 0x0) ioctl$LOOP_SET_CAPACITY(r1, 0x4c07) r2 = geteuid() bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xf, &(0x7f0000000040)='user[/vboxnet0\x00'}, 0x30) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f00000000c0)={0x0, 0x0}) r5 = getpgrp(r4) r6 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000480)='/selinux/enforce\x00', 0x111984, 0x0) openat(r6, &(0x7f0000000380)='./file0\x00', 0x80, 0x100) sendmsg$nl_generic(r0, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000010}, 0xc, &(0x7f0000000200)={&(0x7f0000000100)={0xd8, 0x19, 0x9feb7e24880066c4, 0x70bd2b, 0x25dfdbfc, {0x16}, [@typed={0x8, 0x7a, @uid=r2}, @typed={0x8, 0x5a, @pid=r3}, @typed={0x8, 0x78, @pid=r4}, @typed={0x8, 0x29, @pid=r5}, @typed={0xc, 0x0, @u64=0x4}, @typed={0x98, 0x63, @binary="011202c34666ccc739349794231b68538d56469110f448c1c01daead3f0e6c48b8d74c69a99adfaa250d304229c3ee3ee13bcfcbdba71ad67f48a903d1840c765c4a156bb7a43da00380fbb7ec87d2b185775c194967a4aa26d66c7f26d7c7e3c5be4f5bbeb0e7113e96c49e878c5b8fd52e0ce05c0c5faf6d5c798aead5acd9e560f326416cf3325ca94ed4115cdd10d973af"}]}, 0xd8}, 0x1, 0x0, 0x0, 0x840}, 0x10) r7 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r7, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="080000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005534cab32a3edbe366024e78fac497d903abfb58fa33c4b555ed499155984c572336eef52b848c4c5e59dc2e9d86c5c0ed0f2701b1401f985d86b3e45c1cfa303c939a1a9926f79ab0d4aae87901e8610e48210e6b390130d7bb3b137de5d3e6c1d9a411088aeb435953855916b75e02ff671560ee2618df354c85a719fa4d5d4860f144f930cad3b5d3200f0f04794abf17249ff8935c6c7f4d6c6fa7be12c5c1b8fd89f40fec7d2694d15583d9142ad68d75bdcded221c87a515759863a18c7ed0f2b3b3a59dd21187a705b7bd9c589095583c2faae731a7b6637c72fef1"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r7, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="01634040", @ANYRES64=0x0, @ANYBLOB="080004da00000000"], 0x0, 0x0, 0x0}) [ 2331.391542][ T2215] binder: 2209:2215 ioctl c0306201 200002c0 returned -22 [ 2331.427217][ T2223] input: syz0 as /devices/virtual/input/input3320 11:29:01 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x00\x00\x00\x01\x00'}, 0x45c) [ 2331.438223][T22689] binder: release 2209:2215 transaction 3502 out, still active [ 2331.447306][ T2215] binder: BINDER_SET_CONTEXT_MGR already set [ 2331.456647][T22689] binder: undelivered TRANSACTION_COMPLETE [ 2331.462884][ T2225] binder_alloc: 2209: binder_alloc_buf, no vma [ 2331.474246][T22689] binder: send failed reply for transaction 3502, target dead [ 2331.501216][ T2215] binder: 2209:2215 ioctl 40046207 0 returned -16 [ 2331.517259][ T2225] binder_transaction: 1 callbacks suppressed [ 2331.517277][ T2225] binder: 2209:2225 transaction failed 29189/-3, size 0-0 line 3148 11:29:01 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x14\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) 11:29:01 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = syz_open_dev$midi(&(0x7f00000000c0)='/dev/midi#\x00', 0x81, 0x8c400) capset(&(0x7f0000000000)={0x400019980330}, &(0x7f0000000200)) bpf$MAP_CREATE(0x0, &(0x7f0000000140)={0xb, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x3c) ioctl$SNDRV_CTL_IOCTL_PVERSION(r1, 0x80045500, &(0x7f0000000100)) ioctl$KVM_X86_GET_MCE_CAP_SUPPORTED(r0, 0x8008ae9d, &(0x7f0000000000)=""/167) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x0, 0x0, 0x0}) [ 2331.549730][ T1470] binder_release_work: 4 callbacks suppressed [ 2331.549737][ T1470] binder: undelivered TRANSACTION_ERROR: 29189 11:29:01 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e501c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) [ 2331.632978][ T2239] input: syz0 as /devices/virtual/input/input3321 [ 2331.656052][ T2241] input: syz0 as /devices/virtual/input/input3322 [ 2331.728392][ T2247] binder: 2242:2247 transaction failed 29189/-22, size 0-0 line 2995 [ 2331.739635][ T2245] input: syz0 as /devices/virtual/input/input3323 [ 2331.774574][ T2241] input: syz0 as /devices/virtual/input/input3324 11:29:02 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x00\x00\x00\x02\x00'}, 0x45c) [ 2331.856116][ T2302] binder: 2250:2302 unknown command -8196 [ 2331.874218][ T2302] binder: 2250:2302 ioctl c0306201 200002c0 returned -22 [ 2331.916774][T22689] binder: release 2250:2302 transaction 3506 out, still active [ 2331.932969][ T2302] binder: BINDER_SET_CONTEXT_MGR already set [ 2331.939591][T22689] binder: undelivered TRANSACTION_COMPLETE [ 2331.956068][ T2362] input: syz0 as /devices/virtual/input/input3325 [ 2331.961737][T22689] binder: undelivered TRANSACTION_ERROR: 29189 [ 2331.970379][ T2361] binder_alloc: 2250: binder_alloc_buf, no vma [ 2331.982463][T22689] binder: send failed reply for transaction 3506, target dead [ 2331.992995][ T2302] binder: 2250:2302 ioctl 40046207 0 returned -16 [ 2332.002204][ T2361] binder: 2250:2361 transaction failed 29189/-3, size 0-0 line 3148 [ 2332.012253][T22689] binder: undelivered TRANSACTION_ERROR: 29189 [ 2332.041030][ T2366] input: syz0 as /devices/virtual/input/input3326 11:29:04 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r1, 0xc0505350, &(0x7f0000000500)) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) 11:29:04 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x15\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) 11:29:04 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x44, 0x0, &(0x7f0000000140)=[@reply={0x40406301, {0x3, 0x0, 0x2, 0x0, 0x11, 0x0, 0x0, 0x48, 0x8, &(0x7f0000000040)=[@ptr={0x70742a85, 0x0, &(0x7f0000000000), 0x1, 0x1, 0x3e}, @fda={0x66646185, 0x8, 0x2, 0xe}], &(0x7f00000000c0)=[0x28]}}], 0xef, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x0, 0x0, 0x0}) 11:29:04 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c41896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) 11:29:04 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x00\x00\x00\x03\x00'}, 0x45c) 11:29:04 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r1, 0xc02c5341, &(0x7f0000000280)={0x0, 0x0, 0x0, 'queue1\x00', 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe]}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) [ 2334.362380][ T2379] input: syz0 as /devices/virtual/input/input3327 [ 2334.371672][ T2382] binder: 2380:2382 got reply transaction with no transaction stack [ 2334.409627][ T2388] input: syz0 as /devices/virtual/input/input3328 [ 2334.419223][ T2387] binder: 2376:2387 unknown command -8196 [ 2334.440698][ T2391] input: syz0 as /devices/virtual/input/input3329 [ 2334.448278][ T2387] binder: 2376:2387 ioctl c0306201 200002c0 returned -22 [ 2334.462089][ T2382] binder: 2380:2382 transaction failed 29201/-71, size 72-8 line 2900 [ 2334.471802][T22689] binder: release 2376:2387 transaction 3510 out, still active [ 2334.492108][ T2387] binder: BINDER_SET_CONTEXT_MGR already set [ 2334.496287][ T2382] binder: 2380:2382 ioctl c0306201 20000100 returned -14 [ 2334.508355][T22689] binder: undelivered TRANSACTION_COMPLETE [ 2334.518078][ T2399] binder_alloc: 2376: binder_alloc_buf, no vma [ 2334.531176][T22689] binder: send failed reply for transaction 3510, target dead [ 2334.542665][ T2387] binder: 2376:2387 ioctl 40046207 0 returned -16 11:29:04 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x00\x00\x00\x04\x00'}, 0x45c) [ 2334.557316][ T2399] binder: 2376:2399 transaction failed 29189/-3, size 0-0 line 3148 [ 2334.570631][T22689] binder: undelivered TRANSACTION_ERROR: 29189 [ 2334.601677][ T2388] input: syz0 as /devices/virtual/input/input3330 11:29:04 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c50896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) 11:29:04 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/status\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TIMER(r1, 0xc0605345, &(0x7f00000000c0)={0xfffffffffffffffd, 0x0, {0x2, 0x2, 0x81, 0x2, 0x8001}}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x0, 0x0, 0x0}) r2 = open(&(0x7f0000000000)='./file0\x00', 0x2001, 0x20) ioctl$DRM_IOCTL_AGP_ALLOC(r2, 0xc0206434, &(0x7f0000000040)={0x3e92, 0x0, 0x10000, 0x7}) [ 2334.674719][ T2511] input: syz0 as /devices/virtual/input/input3331 [ 2334.686580][ T1470] binder: undelivered TRANSACTION_ERROR: 29201 11:29:05 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x16\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) [ 2334.722333][ T2516] binder: 2513:2516 unknown command -8196 [ 2334.772145][ T2516] binder: 2513:2516 ioctl c0306201 200002c0 returned -22 [ 2334.784140][ T2522] binder: 2519:2522 got reply transaction with bad transaction stack, transaction 3514 has target 2513:0 [ 2334.811689][ T2521] input: syz0 as /devices/virtual/input/input3332 [ 2334.822428][T22689] binder: release 2513:2516 transaction 3513 out, still active [ 2334.831056][ T2522] binder: 2519:2522 transaction failed 29201/-71, size 0-0 line 2915 [ 2334.836483][T22689] binder: undelivered TRANSACTION_COMPLETE [ 2334.845490][ T2516] binder: BINDER_SET_CONTEXT_MGR already set [ 2334.859412][ T2526] input: syz0 as /devices/virtual/input/input3333 [ 2334.870309][ T2516] binder: 2513:2516 ioctl 40046207 0 returned -16 [ 2334.881074][T22689] binder: send failed reply for transaction 3513, target dead [ 2334.895499][ T2528] binder_alloc: 2513: binder_alloc_buf, no vma [ 2334.909359][T22689] binder: send failed reply for transaction 3514 to 2519:2522 11:29:05 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x00\x00\x00\x05\x00'}, 0x45c) [ 2334.923069][ T2528] binder: 2513:2528 transaction failed 29189/-3, size 0-0 line 3148 11:29:05 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f00000016c0)='/dev/qat_adf_ctl\x00', 0x20000, 0x0) setsockopt$TIPC_MCAST_REPLICAST(r1, 0x10f, 0x86) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40406301}], 0x0, 0x0, 0x0}) ioctl$int_in(r0, 0x5473, &(0x7f0000000380)=0x1) r2 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/checkreqprot\x00', 0x40, 0x0) r3 = gettid() openat$pidfd(0xffffffffffffff9c, &(0x7f00000003c0)='/proc/self\x00', 0x1c0, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffff9c, 0x29, 0x23, &(0x7f0000000080)={{{@in=@empty, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@initdev}, 0x0, @in=@loopback}}, &(0x7f0000000180)=0xe8) ioctl$TUNSETQUEUE(r2, 0x400454d9, &(0x7f0000000240)={'bcsf0\x00', 0x600}) sendmsg$nl_generic(r2, &(0x7f0000000200)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10100000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000480)={0x1214, 0x3d, 0x801, 0x70bd2a, 0x25dfdbfc, {0x18}, [@generic="0c080cec5b2c7f57049863537e19453a9f083cbfc56a4411b0cb4238b58c3e0e56893470ac49c37d8383bfebf940d460b5f009a418e728b0c5b9d0ab19b29fe4c12ad1f10d82471842ffbd00ea", @nested={0x10bc, 0x31, [@typed={0x8, 0x40, @pid=r3}, @generic="1b8aec3bb5ff8ea377cf42615bc138b8217b32fff443efcca8358a26ffd60bed61a4a71f646fdc12135fe828e4b1baf97dee9ab263f7463447d8b9c16670828508cf9554007cb72908aacb97da7e5b9733e3a38823e19cd644ab9092350315161406a0dbb4c4da7e2f85d8ce724c8c5e8d15d9ea93e64ed27db243ceb065805238a2dab829bbe9ab80221a91e6fc632dda9936fa4c82131b306f37374066dfb5954e9a0d8fb13e85305d4b75ff14eed75f85763da94af4546a7f251dfdb37b229ac737f537e62f566e8924cae18a9290b1457ec1f7de9c6f8e71f926a548faeb44cce2a016d35f160a4754084af065e87d4502251e3fba280facffdab8d22fcf0f7e759715d68929cd8d65efec45c0b49d79f84aa22d0d6e2385f5462bbc97b00d1ec428788dbf498ed35a6c7a0968874ad4d82d4267e8709c6c410be0c7baca3ee09c5178ad8f21e04b10522eccf3e57aa9d4c038ba7a858208f744ae85349dc702002b3bdc0cec8d83ea8dfa115c2fd2f012bd326ec083088fc461b4f631a8e89406b79ec62dbf76de2a8e3757370361e6895b22f47b3485d3046922a97a74af53ac131cd806a88823aca8f0ebfc99e9025ba0d6471e0b6074dc8715e07c70e0f495827751f01a227b629d7b336578e7dc588f3d56e8817f4cbc7c903c53a31fa6da4337bb7e754e8982b51e29369222d5ea95ed22db6c026674d3604f88c83bfc5e475fbd48f7e7d51643eb689e7208c50bb4a56b60be9a7ad7296c6fc97f9f96b9ccaa571e16123b6c1df7f176685b26d1640d3ab8903a9b55a285bd09268835926a0d4299fe89ec860f3dbfab751ca4dca990f2db8418877e867e354c0f7067e589c0c75df155c46a5206e73d5618f901f46e2ba9b52118aae96305febed4790f762d0f80d4e2f1b8a8126eefae96824669aee5fa759830a091febadd3fd2f73a89d8d91d83de506bdee77e41ae5853dbcff4b9af4a5418b5e1ac050211a08ade1064b1c64d9138434fd4a23e0a86bade2969c6236dcc66491302fb859e1bc195814b270168a399dea378f4692e3c55a026c54bd6afe586c0c21cfddecce1bde379462ca70bca4edb74e84e27e84db23a08915412b3760df214f7678a383a3fbb429ad4c1ce48bf44b8b4feff7ac51d57b1ab46c6ac880b611265f2dcbb353ec6e7376c50c2d88fa4a092eaa5876b8a5ab0aac76ba9aa88c63ee26c8ebbf4913bf17f191ca8127e766bcb3fe9ea8868b187b7cd3580774a0b960f9d974a75dd2279822e7437887b8524f2cb8d4992aca652de157f1d4024fc986fcd392e8f32d4bf163e07dbc0a982cf5ef29f57e9a6b87244525fa08cd69519631c1b08b0587e16ac01a53cce3ea6b0f20935d401b247117e2534cedd559af745054a279e8c717def96869a4cf7f4816b3affe784a41db776c75b873ca803004cf2681981e968bdffccf35ed2912eb1ad1896c8ce3c5db9c165380880a6d5f15565bf07dce335b159826e342ed9ab6e475ddf711592cff8998256411a053bd5f508a21f209f608f6c2abc14360bc07f3b9c84ff901fd3b40913d952294d6304f01bb3e183cad1ba6ef2be537ec0ccb2a680df9780ff45e15cdfd8b623e9a8e3da94bf888141355bded6e447bce36802888606f27046412fb33abfafd2de1d0ae2fcf1157f2517b39577130909c73339581b4255d26bdb64b2f1c31f623f2f0104ab0110bece30783aa144b464f7289b01a1733302b24ded4255b6c655782709b6f1c8094e10287520fff917bf95feac6535b4e0a9e5f61f62ea0b1ecaed89f33b487ad1dfbf2ef590944b3ad8a786eb7f8ea0c16c5cb95d76ae1747778872dab7af293652ac4dc26b87b3c941c3f6aa93946f45c1ba0c9e787cef3b9a78ecad69cdfbfa33aa141a209bebfadbf8a8b3c95f36df75c1c626db43d9a19af7cedc7d1a6866bc73991ae0b11fa3a004c14b5318030193bdd2630e80a5356071d5c41931b91ad63b42e0b61ead207668a25ce1da0e84a6d8f2e0a2a4836d521ef5cef465413b30372e799b03fd973e777fb0f588835da0d9d6c27b0021bd92d00616a6e7d637e70e5d5b7ece9ad59dd9aafa40ee9589787055e7466f22bbff708e383898ebe811242bd01bb78d3e42da9d1ad5433a5ab6f563078aa01c3a3bbc2e6e799f6443137ea40d5d69c5cbc74cbce7e5dba0637897327248f035d8106dc1ea079a96511aeb73655e1cebe5851d3865e4ed842ae99abdcbe89f56901fdbba3cafddbb0ed23337fb34fe173c328ef957e869b4809f50618be17b2227a2def9f5a63278b7c9de7ec6f3cea2ac32c9a87bf514e236a31a2d5b7f18ba9f4a76f516b0121fdfe4c86f2ce57cb5d40e0bdf1c21f9a3cfada534db630d5fc825b13d976584fa2e2306685f0a5eb9b979139d316a7964d15b04eb388d745626e5a17c70cba8690627719445b539539f7e5f82ad97867e56362cf0ba3a5684bebf46bc858fff7716cbadcb34be2bb7de9f687217be3f8b5c2f5253df0ada66601d60e47f16c659b97fcea9f87f9eaa26026ff5868abcf436afefe257ff2089280bf74dc192e7eb5f32a8106c138ca599d03908c28b7bce980367d8b5bb15e2405ead27ee57acf7d23b120fdecbe2b616261d88207163bd65f4c8529ae5401de129bc8234a0623a933fcd46f2202db6face28c9788347f3e514823bf5740a161a35a5a3602b1e4b35e3f0dd98e332e2fb63402089aa2058e19af067e8a9d4b74f4cfbb949e91df4d679c1c054764e073bc1cd6506f69b636ff0ea2d43a2e40053b047f01b4bd2df2145f51ecce9ac18f62ba6edcf88cea9fdc4fad4a2c55b6fb31053239bde50a05492780ca6d9e877fb2661a39e5f9e831defbd8d6dd941990afc9536677cff7bbb945dcceee30872a4d79c10d9079924f993569124f8a05c3df608859c6d60f4db450c4a60259af62701b5f28eb0287163cf879057dc3548a50a5e71415a7764dfbc2f37f46c4954251afcc7fc329107aec79e199a7fe81cf2d2558c02bfd5a7d0e399d5b004ab0ce52ee5a4681040c6b32b71408ee35505c6679013d11319980dd087e89a115ff09b386e0b884db04934d0a0bcc53839c301d61d7cd066662e2a14d2eb9ce6c011eade4652a1b29e9e9327db4da2d09976a919bbc30b386f532c4d6eb020124591331d59c3e5302e09823c73509ee5a34b626d21bd9ee2a8ae8dc63426ba1f7b2f7dbfef704595811f4dfac65470b438b19cac63f808225acda724571d98cc92fa121d9ac6a1e1e1d1d6c080955963392e5746530ddb8271a04c6b279b465e4c3fda9c79b51d22ecb72a0835c785b7aa58b56dbd3a818d273e3c119abc4e829314e70d7c763080e5d494320f0e42cfd3a97185ff7cdec38c4b877c71979838290e1e61c8db16bfb40c56c0c6f0d5d18ed317dc7ca7374ffb9ff85c3cde531b88efd50070529e4ce1b29b74a93da4b0f49f4f495f5d623444828546e07f87a7ee50ea1f5f3eee3324cb23f2676dd1dc03a13aa7617bf204ec32dd616ece6dcf869445d2e23346522b5467af8964252b285fc6d9c0b9ee047b64ec73190c34d1c79fafa38eaa67be3a89497e2d1ccf8fd7cb7c7879385a638958990fba1acbbebb73726a126aefa486c9bd91529bc07dcde6ab590eb61273c00316ccde4c7f057c305afe342395aa2c6e644640ca61a1cd00502ec014936ec24049a315dca06d2ea57e17105c9a2011452dfa9f08958f1c9d107c43e4f22ffca168f2fefef14a4278810e95d98478e785dfdd0e958f3894660527e7644977b39051630a27156fc8b5d5cdce0a575fc05f6e80ed93ba89632df93472b1ad16b1c16ecaac9da9ed0419ba4b115b90f43bf24a245f7afe70c4e1223fab61fdc4dbf5afbcc817717ce8e9cf204bc98b33caa05e4fa1fcb1c2d44dfcd5e5b34760eb3925ee972476841cc49834e449069e4eb0348c2fdf446d94c876cc1f5e10ceed649e1b69c9028fa0c1aac2cb1aeaf9011c7f755c5ceb6535648d2d2d1ea25ef7b3172c4273ad050e0003041cf4e6417d433f8a1c7c312351de9d7bbbd2053d59b935996dfaeadcd14bbf3f9f05a9158e103a10f88590d91ecb52e210197ef4edb86a851737d5278a2ebbaa43e4c5d400d261e88857622b7999bed51b715bf51833f1077854f4db786f037edc0486352edd98872a8fdfbfc77d23930850987f9dfc70093c3b164d9d4b3a76aaa23292ea45f37ed9ef6d7c97769fb9c7ef1f1c40c26fbbbbf8b3287fe342ea1bc120b2d131b575ac9de9ff5000c54bc7821886d2c3fc9a2ef5183ab1aa4d6c288400291286aecf2b3cd46b246b0df792477d4b21d3f7140cb78733be7fe7d50b0e923599105605883ba60631da690b3dbe1fd72bdf7eed43ca2b71f97a376f617471ceb35f62a090679ed665d4d9c4bd0bf961a569b65896504df9c200812c25239140c6a23862b53d89c1a74ec43878fa68336d271ff52bc3444b4d9136644cffbd05beaa4abd21d7b5a20e3588ca60555886d7179e4035085dde5bd398f3f9b11b87647d7a31d2d9f6c1dcc89ec3936f7249767881ae63cbfd0d64469434efa270a9c5cbf60f12d1cb32ebadc87e5a9dd12e345338f27dcb39aff4188434924b6706a21f9f7d514b30488f840a2a4f6438d3422295c09dc10cb1b525cd94561fe2d9e54043ea2ee87e7b67abdebf1ed59bb2ea81515a6dd529d885deb71e53223cb83d6cf8578f0a274b14e0be933608d36d2a49cc1f1dfab88fef01fbb4d4c9f1ea78892f1feaf58c00bef5501d23a8d45c07d94efac507ecbb9afd09be0dc4aa4712daf6e638dabee2c139cda18a36f17ea465bda22cb8cd298351108f5363f36a4fed9d7c51162879b0dabf6483ef5eb4b8d5d68d30cfddc3a2123aa4be4796d5ca16a1bbbd672baebdf94e53c5feee74419916e82bbcb5c80d9b083ec83d85015ab1897933f3a41cd9b728a44d6d975e6230510e47e7f95661a7580b622071d201963cc04ae0f6b349b3eea0a5ee41803a932717d24527a8b79203e62ed69a67b1daa9c0507c81d42fd8b9d5e5ee9e7fd5554a802644361bc6a2218862506886f8de002a4ada52c04e24987e0e723e7c7bad28b34f4232a62e56cbd95556baa49fe0be79bc07fa088fb54cc237ed4fc4ad74245d14022f3eaa0c6278a223d1e6e2b6a8793699731026a8f59c068b0fcb1b09ee029dbf0d7c61a90ed8b01c6b8b8ffb6a46ddd2befe04ec5d4e4e733a1f4acedbe1467d8721f4e84920d8f4be11141b7667f4cfa543987cd6f7b0b7a93c3f816f380c0b60eeaf3f257477563eb51679fccb25b47d5d16d1d480393170f2297aa6b43d783ff1ad0f1c75a40a725608aded72e6fc89088ce971b961bba748eaa0d672c8a7bf5286e1a6e751c176a5fdb5c5f9f1c807037156559756a12011e032890d8b4d89e61bc40ca8785697634bcc645c51f17722c98e207c26347f9cd930d07ef6848947d9d3592bca7679e19c1b2a79ff7f8ac12b39801a3e8e2afdc734a05c3ac9b8af2e5d49a3e119c63505f15f5246927e97e989cc804d3dd6bc673410154f6072f8efddc649be42444d3713607d0cc50b215d203d44e1838996d45c1a88409561aeffffa13217405db2a979edc5d6d37e461744056cc9ac50c6eb62163b6fe08a3f41a23be4bc5affbb163567a812caee22277ce1b0ab68d5e31ad41b2883f2de00af276128e32c9cc0dfc6f6f8ca65f2f0cb6c739f6402be2b2cde3a1d41c4bf2c1ac68e3000f891715f8c5b93d9f4557d4cd5356ce64035b73f139d", @generic="90159f79951ed4dba37ac269acbc012f69639d4369591610b4f9939ddbab444b48d8c9229a839c9707803216f01a5eed37d3fbc774fe190cf6b474c333fcbf272842542f1faff1d9f5dbd871f4f0d8bc9ee888e8322f9180999c8b4f7185977cae45390b122ed1b5c3ce9a675f5befa120c01c875cd5bcfdbebffa5fc7afc03f6c3a7829f9929b9c28287693d5d78f3a9ef0634cc2d81f67040a27cdd702c80612285379bca790", @typed={0x8, 0x92, @fd=r0}]}, @nested={0xc, 0x57, [@typed={0x8, 0x2b, @u32=0x3ff}]}, @generic="1af9fa42f1e2ec0c75af9b1e4ce68ebaa73d755287e6d8158d4b932214d346a2462fede70758a9f1bd3ee7a934d0f3cfc4689f39e205bc724aacc325f54c313bdfc3a53204a7e673f9ce5045ceccf4691de93540211772b9b80d648966bca6800fc1a8cd54d4c23adbfb3f44e0f1210988b9c11e3fbeb4a2aec5bf8fb2f46a39bd24c5c72a", @typed={0xc, 0x14, @u64=0x101}, @typed={0x8, 0x83, @uid=r4}, @typed={0x50, 0x87, @binary="36de5bda25d9c72f4a019773f9443820c699ef5d17ef10a148e9cd4eadefa3f2e69c0afb86201d94479efcb220fa0ae46658fa688da92bad47dae08fae80fd83b3195d2f258345ca7342a5"}]}, 0x1214}, 0x1, 0x0, 0x0, 0x80}, 0x8000) [ 2334.963517][T22689] binder: undelivered TRANSACTION_ERROR: 29189 [ 2334.995442][T22689] binder: undelivered TRANSACTION_COMPLETE [ 2335.008967][ T2641] input: syz0 as /devices/virtual/input/input3335 [ 2335.021533][T22689] binder: undelivered TRANSACTION_ERROR: 29201 [ 2335.036959][T22689] binder: undelivered TRANSACTION_ERROR: 29189 [ 2335.123643][ T2649] binder: 2648:2649 transaction failed 29189/-22, size 0-0 line 2995 [ 2335.145432][ T2649] binder: 2648:2649 ioctl 5473 20000380 returned -22 [ 2335.179315][ T1470] binder: undelivered TRANSACTION_ERROR: 29189 11:29:07 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r1, 0xc0505350, &(0x7f0000000500)) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) 11:29:07 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c890afec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) 11:29:07 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) 11:29:07 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x00\x00\x00\x11\x00'}, 0x45c) 11:29:07 executing program 0: r0 = syz_open_procfs(0x0, &(0x7f0000000100)='stat\x00') exit(0x0) read$eventfd(r0, 0x0, 0x0) 11:29:07 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r1, 0xc02c5341, &(0x7f0000000280)={0x0, 0x0, 0x0, 'queue1\x00', 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe00]}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) [ 2337.431275][ T2658] input: syz0 as /devices/virtual/input/input3337 [ 2337.447021][ T2663] input: syz0 as /devices/virtual/input/input3338 [ 2337.483935][ T2669] binder: 2659:2669 unknown command -8196 [ 2337.510689][ T2669] binder: 2659:2669 ioctl c0306201 200002c0 returned -22 [ 2337.529659][ T2674] input: syz0 as /devices/virtual/input/input3339 [ 2337.551077][T22689] binder: release 2659:2669 transaction 3519 out, still active [ 2337.565007][ T2669] binder: BINDER_SET_CONTEXT_MGR already set [ 2337.582566][T22689] binder: undelivered TRANSACTION_COMPLETE [ 2337.591068][ T2663] input: syz0 as /devices/virtual/input/input3340 [ 2337.603143][ T2669] binder: 2659:2669 ioctl 40046207 0 returned -16 [ 2337.603709][ T2678] binder_alloc: 2659: binder_alloc_buf, no vma [ 2337.613760][T22689] binder: send failed reply for transaction 3519, target dead 11:29:07 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x00\x00\x00\x12\x00'}, 0x45c) [ 2337.639905][ T2678] binder: 2659:2678 transaction failed 29189/-3, size 0-0 line 3148 [ 2337.655134][T22689] binder: undelivered TRANSACTION_ERROR: 29189 11:29:07 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c8925fec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) 11:29:07 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00/\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) [ 2337.745358][ T2694] input: syz0 as /devices/virtual/input/input3341 [ 2337.809820][ T2700] binder: 2696:2700 unknown command -8196 [ 2337.818156][ T2694] input: syz0 as /devices/virtual/input/input3342 [ 2337.825439][ T2700] binder: 2696:2700 ioctl c0306201 200002c0 returned -22 [ 2337.838877][ T2702] input: syz0 as /devices/virtual/input/input3343 [ 2337.851415][T22689] binder: release 2696:2700 transaction 3522 out, still active 11:29:08 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b650b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) [ 2337.872608][T22689] binder: undelivered TRANSACTION_COMPLETE [ 2337.900406][T22689] binder: release 2696:2706 transaction 3523 out, still active [ 2337.910499][ T2709] input: syz0 as /devices/virtual/input/input3344 11:29:08 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x00\x00\x00\x14\x00'}, 0x45c) [ 2337.944221][T22689] binder: undelivered TRANSACTION_COMPLETE [ 2337.976784][T22689] binder: send failed reply for transaction 3522, target dead 11:29:08 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00?\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) [ 2338.002780][T22689] binder: send failed reply for transaction 3523, target dead [ 2338.021438][ T2715] binder: 2713:2715 unknown command -8196 [ 2338.040217][ T2715] binder: 2713:2715 ioctl c0306201 200002c0 returned -22 [ 2338.069846][T22689] binder: release 2713:2715 transaction 3525 out, still active [ 2338.088897][T22689] binder: undelivered TRANSACTION_COMPLETE [ 2338.095439][ T2721] binder_alloc: 2713: binder_alloc_buf, no vma [ 2338.102656][ T2720] input: syz0 as /devices/virtual/input/input3346 [ 2338.109314][T22689] binder: send failed reply for transaction 3525, target dead [ 2338.110489][ T2721] binder: 2713:2721 transaction failed 29189/-3, size 0-0 line 3148 [ 2338.125543][ T2718] input: syz0 as /devices/virtual/input/input3345 [ 2338.132834][T22689] binder: undelivered TRANSACTION_ERROR: 29189 [ 2338.184405][ T2724] input: syz0 as /devices/virtual/input/input3347 [ 2338.217519][ T2726] input: syz0 as /devices/virtual/input/input3348 11:29:10 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r1, 0xc0505350, &(0x7f0000000500)) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, 0x0, 0x0) tkill(r2, 0x1000000000013) 11:29:10 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b20a6b28fa2e2b14fd"], 0x0, 0x0, 0x0}) 11:29:10 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x00\x00\x00\x15\x00'}, 0x45c) 11:29:10 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x82) sendfile(r1, r1, 0x0, 0x2000005) 11:29:10 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r1, 0xc02c5341, &(0x7f0000000280)={0x0, 0x0, 0x0, 'queue1\x00', 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f00]}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) 11:29:10 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\xff\xff\xff\xfe\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) [ 2340.575117][ T2746] input: syz0 as /devices/virtual/input/input3349 [ 2340.579812][ T2752] binder: 2742:2752 unknown command -8196 [ 2340.594472][ T2750] input: syz0 as /devices/virtual/input/input3350 [ 2340.636689][ T2752] binder: 2742:2752 ioctl c0306201 200002c0 returned -22 [ 2340.677831][T22689] binder: release 2742:2752 transaction 3529 out, still active [ 2340.694187][T22689] binder: undelivered TRANSACTION_COMPLETE [ 2340.701054][ T2752] binder: BINDER_SET_CONTEXT_MGR already set [ 2340.708499][ T2752] binder: 2742:2752 ioctl 40046207 0 returned -16 [ 2340.715331][T22689] binder: send failed reply for transaction 3529, target dead 11:29:11 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x00\x00\x00\x16\x00'}, 0x45c) 11:29:11 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") clone(0x4000003102041ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() futex(&(0x7f0000000140)=0x2, 0x0, 0x2, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x3f) write$P9_RREAD(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="a56cd99f4bb28637d8a320112b69e340862a9a01000080f3be2df33bf011eac7110008d6430a314f2af8090002f9000003000000000000004f"], 0x39) ptrace$cont(0x18, r1, 0x0, 0x0) ptrace$setregs(0xd, r1, 0x0, &(0x7f00000000c0)) ptrace$cont(0x7, r1, 0x0, 0x0) 11:29:11 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2416b28fa2e2b14fd"], 0x0, 0x0, 0x0}) [ 2340.724240][ T2831] binder: 2742:2831 transaction failed 29189/-22, size 0-0 line 2995 [ 2340.733649][T22689] binder: undelivered TRANSACTION_ERROR: 29189 11:29:11 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) [ 2340.854321][ T2872] input: syz0 as /devices/virtual/input/input3353 [ 2340.889959][ T2871] binder: 2870:2871 unknown command -8196 [ 2340.903788][ T2871] binder: 2870:2871 ioctl c0306201 200002c0 returned -22 [ 2340.912483][ T1470] binder: release 2870:2871 transaction 3532 out, still active [ 2340.932002][ T1470] binder: undelivered TRANSACTION_COMPLETE [ 2340.938041][ T2879] input: syz0 as /devices/virtual/input/input3354 11:29:11 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2506b28fa2e2b14fd"], 0x0, 0x0, 0x0}) 11:29:11 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x00\x00\x00\x1f\x00'}, 0x45c) [ 2340.966069][ T1470] binder: release 2870:2881 transaction 3533 out, still active [ 2340.992677][ T1470] binder: undelivered TRANSACTION_COMPLETE [ 2341.035869][ T1470] binder: send failed reply for transaction 3532, target dead [ 2341.068004][ T2962] input: syz0 as /devices/virtual/input/input3356 [ 2341.078294][ T1470] binder: send failed reply for transaction 3533, target dead [ 2341.135034][ T2993] binder: 2991:2993 unknown command -8196 [ 2341.153860][ T2993] binder: 2991:2993 ioctl c0306201 200002c0 returned -22 [ 2341.161627][ T2990] input: syz0 as /devices/virtual/input/input3357 [ 2341.173686][ T1470] binder: release 2991:2993 transaction 3535 out, still active [ 2341.198158][ T1470] binder: undelivered TRANSACTION_COMPLETE [ 2341.200073][ T2998] binder_alloc: 2991: binder_alloc_buf, no vma [ 2341.219437][ T1470] binder: send failed reply for transaction 3535, target dead [ 2341.241849][ T2996] input: syz0 as /devices/virtual/input/input3358 [ 2341.270705][ T2998] binder: 2991:2998 transaction failed 29189/-3, size 0-0 line 3148 [ 2341.292774][T22689] binder: undelivered TRANSACTION_ERROR: 29189 11:29:13 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r1, 0xc0505350, &(0x7f0000000500)) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, 0x0, 0x0) tkill(r2, 0x1000000000013) 11:29:13 executing program 0: r0 = socket$unix(0x1, 0x3, 0x0) bind$unix(r0, &(0x7f00000000c0)=@file={0x1, './file0\x00'}, 0x6e) sendmsg$unix(r0, &(0x7f0000000400)={&(0x7f0000000140)=@file={0x1, './file0\x00'}, 0x6e, 0x0, 0x0, &(0x7f00000003c0)=[@rights={0x18, 0x1, 0x1, [r0]}], 0x18}, 0x0) recvmmsg(r0, &(0x7f0000000040)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) 11:29:13 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) 11:29:13 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x00\x00\x00/\x00'}, 0x45c) 11:29:13 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2390a28fa2e2b14fd"], 0x0, 0x0, 0x0}) 11:29:13 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r1, 0xc02c5341, &(0x7f0000000280)={0x0, 0x0, 0x0, 'queue1\x00', 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe000000]}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) [ 2343.642822][ T3013] input: syz0 as /devices/virtual/input/input3360 [ 2343.657919][ T3017] binder: 3006:3017 unknown command -8196 [ 2343.678471][ T3015] input: syz0 as /devices/virtual/input/input3359 [ 2343.685743][ T3017] binder: 3006:3017 ioctl c0306201 200002c0 returned -22 11:29:14 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) [ 2343.713638][T22689] binder: release 3006:3017 transaction 3538 out, still active [ 2343.733606][ T3083] binder: BINDER_SET_CONTEXT_MGR already set [ 2343.734256][T22689] binder: undelivered TRANSACTION_COMPLETE [ 2343.773913][ T3083] binder: 3006:3083 ioctl 40046207 0 returned -16 [ 2343.778626][T22689] binder: release 3006:3091 transaction 3539 out, still active [ 2343.808162][T22689] binder: undelivered TRANSACTION_COMPLETE 11:29:14 executing program 0: [ 2343.831854][ T3015] input: syz0 as /devices/virtual/input/input3362 [ 2343.842860][ T3151] input: syz0 as /devices/virtual/input/input3363 11:29:14 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2392528fa2e2b14fd"], 0x0, 0x0, 0x0}) [ 2343.886421][ T3158] input: syz0 as /devices/virtual/input/input3364 [ 2343.919886][ T1470] binder: send failed reply for transaction 3538, target dead [ 2343.941077][ T1470] binder: send failed reply for transaction 3539, target dead 11:29:14 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x00\x00\x00?\x00'}, 0x45c) 11:29:14 executing program 0: 11:29:14 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x05\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) [ 2344.093214][ T3170] binder: 3165:3170 unknown command -8196 [ 2344.122280][ T3175] input: syz0 as /devices/virtual/input/input3365 [ 2344.139460][ T3170] binder: 3165:3170 ioctl c0306201 200002c0 returned -22 [ 2344.159617][ T3177] input: syz0 as /devices/virtual/input/input3366 [ 2344.185042][ T3180] input: syz0 as /devices/virtual/input/input3367 [ 2344.193966][T22689] binder: release 3165:3170 transaction 3541 out, still active [ 2344.224839][T22689] binder: undelivered TRANSACTION_COMPLETE [ 2344.241973][T22689] binder: release 3165:3187 transaction 3542 out, still active [ 2344.267033][T22689] binder: undelivered TRANSACTION_COMPLETE [ 2344.288757][ T3184] input: syz0 as /devices/virtual/input/input3368 [ 2344.294961][T22689] binder: send failed reply for transaction 3541, target dead [ 2344.309842][T22689] binder: send failed reply for transaction 3542, target dead 11:29:16 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r1, 0xc0505350, &(0x7f0000000500)) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, 0x0, 0x0) tkill(r2, 0x1000000000013) 11:29:16 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r1, 0xc0505350, &(0x7f0000000500)={{0x0, 0x80000000}, {0x3f, 0x8}, 0x2392, 0x5, 0x400}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) 11:29:16 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\xff\xff\xff\xfe\x00'}, 0x45c) 11:29:16 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b2ffa2e2b14fd"], 0x0, 0x0, 0x0}) 11:29:16 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x11\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) 11:29:16 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r1, 0xc02c5341, &(0x7f0000000280)={0x0, 0x0, 0x0, 'queue1\x00', 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f000000]}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) [ 2346.716496][ T3205] input: syz0 as /devices/virtual/input/input3369 [ 2346.761390][ T3206] binder: 3203:3206 unknown command -8196 [ 2346.767395][ T3213] input: syz0 as /devices/virtual/input/input3371 [ 2346.780017][ T3204] input: syz0 as /devices/virtual/input/input3370 11:29:17 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) [ 2346.814567][ T3206] binder: 3203:3206 ioctl c0306201 200002c0 returned -22 [ 2346.870561][ T1470] binder: release 3203:3206 transaction 3544 out, still active [ 2346.888596][ T3348] binder_alloc: 3203: binder_alloc_buf, no vma [ 2346.889647][ T1470] binder: undelivered TRANSACTION_COMPLETE [ 2346.901906][ T3348] binder: 3203:3348 transaction failed 29189/-3, size 0-0 line 3148 [ 2346.904519][ T3206] binder: BINDER_SET_CONTEXT_MGR already set 11:29:17 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r1, 0xc0505350, &(0x7f0000000500)={{0x0, 0x80000000}, {0x3f, 0x8}, 0x2392, 0x5, 0x400}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) 11:29:17 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\xfe\xff\xff\xff\x00'}, 0x45c) [ 2346.944917][ T3357] input: syz0 as /devices/virtual/input/input3373 [ 2346.955476][ T3206] binder: 3203:3206 ioctl 40046207 0 returned -16 [ 2346.955592][ T1470] binder: undelivered TRANSACTION_ERROR: 29189 11:29:17 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b41fa2e2b14fd"], 0x0, 0x0, 0x0}) [ 2346.997110][ T1470] binder: send failed reply for transaction 3544, target dead 11:29:17 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x14\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) [ 2347.107046][ T3368] input: syz0 as /devices/virtual/input/input3375 [ 2347.152806][ T3386] input: syz0 as /devices/virtual/input/input3376 [ 2347.163411][ T3369] binder: 3367:3369 unknown command -8196 [ 2347.196569][ T3369] binder: 3367:3369 ioctl c0306201 200002c0 returned -22 [ 2347.221998][T22689] binder: release 3367:3369 transaction 3547 out, still active [ 2347.238357][ T3369] binder: BINDER_SET_CONTEXT_MGR already set 11:29:17 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r1, 0xc0505350, &(0x7f0000000500)={{0x0, 0x80000000}, {0x3f, 0x8}, 0x2392, 0x5, 0x400}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) [ 2347.241990][T22689] binder: undelivered TRANSACTION_COMPLETE [ 2347.259768][ T3480] input: syz0 as /devices/virtual/input/input3377 [ 2347.272681][ T3479] binder_alloc: 3367: binder_alloc_buf, no vma [ 2347.287265][T22689] binder: send failed reply for transaction 3547, target dead [ 2347.309317][ T3369] binder: 3367:3369 ioctl 40046207 0 returned -16 [ 2347.349818][ T3479] binder: 3367:3479 transaction failed 29189/-3, size 0-0 line 3148 [ 2347.372051][ T1470] binder: undelivered TRANSACTION_ERROR: 29189 11:29:20 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r1, 0xc0505350, &(0x7f0000000500)) gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(0x0, 0x1000000000013) 11:29:20 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00'}, 0x45c) 11:29:20 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b50fa2e2b14fd"], 0x0, 0x0, 0x0}) 11:29:20 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x15\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) 11:29:20 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r1, 0xc0505350, &(0x7f0000000500)={{0x0, 0x80000000}, {0x3f, 0x8}, 0x2392, 0x5, 0x400}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) 11:29:20 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r1, 0xc02c5341, &(0x7f0000000280)={0x0, 0x0, 0x0, 'queue1\x00', 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfeffffff]}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) [ 2349.791013][ T3602] input: syz0 as /devices/virtual/input/input3379 [ 2349.798928][ T3609] input: syz0 as /devices/virtual/input/input3380 [ 2349.830501][ T3607] binder: 3606:3607 unknown command -8196 [ 2349.847273][ T3615] input: syz0 as /devices/virtual/input/input3381 [ 2349.861902][ T3618] input: syz0 as /devices/virtual/input/input3382 11:29:20 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x16\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) [ 2349.900103][ T3607] binder: 3606:3607 ioctl c0306201 200002c0 returned -22 [ 2349.961461][ T1470] binder: release 3606:3607 transaction 3550 out, still active [ 2349.971860][ T3607] binder: BINDER_SET_CONTEXT_MGR already set [ 2349.987603][ T1470] binder: undelivered TRANSACTION_COMPLETE [ 2350.006469][ T3714] binder_alloc: 3606: binder_alloc_buf, no vma [ 2350.014116][ T1470] binder: send failed reply for transaction 3550, target dead [ 2350.023868][ T3740] input: syz0 as /devices/virtual/input/input3383 [ 2350.036734][ T3607] binder: 3606:3607 ioctl 40046207 0 returned -16 [ 2350.043776][ T3714] binder: 3606:3714 transaction failed 29189/-3, size 0-0 line 3148 11:29:20 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r1, 0xc0505350, &(0x7f0000000500)={{0x0, 0x80000000}, {0x3f, 0x8}, 0x2392, 0x5, 0x400}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) 11:29:20 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00'}, 0x45c) [ 2350.075035][ T3743] input: syz0 as /devices/virtual/input/input3384 [ 2350.114214][ T1470] binder: undelivered TRANSACTION_ERROR: 29189 11:29:20 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa0a2b14fd"], 0x0, 0x0, 0x0}) 11:29:20 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00/\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) [ 2350.314111][ T3825] binder: 3750:3825 unknown command -8196 [ 2350.326840][ T3825] binder: 3750:3825 ioctl c0306201 200002c0 returned -22 [ 2350.341750][ T3834] input: syz0 as /devices/virtual/input/input3385 11:29:20 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r1, 0xc0505350, &(0x7f0000000500)={{0x0, 0x80000000}, {0x3f, 0x8}, 0x2392, 0x5, 0x400}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) [ 2350.363382][ T3853] input: syz0 as /devices/virtual/input/input3386 [ 2350.377615][T22689] binder: release 3750:3825 transaction 3553 out, still active [ 2350.393563][ T3825] binder: BINDER_SET_CONTEXT_MGR already set [ 2350.397034][T22689] binder: undelivered TRANSACTION_COMPLETE [ 2350.423492][ T3825] binder: 3750:3825 ioctl 40046207 0 returned -16 [ 2350.447286][T22689] binder: send failed reply for transaction 3553, target dead [ 2350.460595][ T3864] binder: 3750:3864 transaction failed 29189/-22, size 0-0 line 2995 [ 2350.482690][ T1470] binder: undelivered TRANSACTION_ERROR: 29189 [ 2350.514811][ T3853] input: syz0 as /devices/virtual/input/input3388 11:29:20 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r1, 0xc0505350, &(0x7f0000000500)) gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(0x0, 0x1000000000013) 11:29:20 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa252b14fd"], 0x0, 0x0, 0x0}) 11:29:20 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) 11:29:20 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00'}, 0x45c) 11:29:20 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r1, 0xc02c5341, &(0x7f0000000280)={0x0, 0x0, 0x0, 'queue1\x00', 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe]}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) [ 2350.739438][ T3976] input: syz0 as /devices/virtual/input/input3389 11:29:21 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306241, &(0x7f00000002c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x0, 0x0, 0x0}) [ 2350.784093][ T3990] input: syz0 as /devices/virtual/input/input3390 [ 2350.799810][ T3988] input: syz0 as /devices/virtual/input/input3391 [ 2350.823933][ T3992] binder: 3971:3992 unknown command -8196 11:29:21 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x04\x00'}, 0x45c) 11:29:21 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x05\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) [ 2350.902659][ T3992] binder: 3971:3992 ioctl c0306201 200002c0 returned -22 [ 2350.951924][ T4006] binder: BINDER_SET_CONTEXT_MGR already set [ 2350.979608][ T4006] binder: 4001:4006 ioctl 40046207 0 returned -16 [ 2350.989120][ T3992] binder: BINDER_SET_CONTEXT_MGR already set [ 2351.006443][T22689] binder: send failed reply for transaction 3556 to 3971:3992 [ 2351.015384][ T4010] binder: 3971:4010 transaction failed 29189/-22, size 0-0 line 2995 [ 2351.034130][T22689] binder: undelivered TRANSACTION_COMPLETE [ 2351.050806][ T4006] binder: 4001:4006 transaction failed 29189/-22, size 0-0 line 2995 [ 2351.052894][ T3992] binder: 3971:3992 ioctl 40046207 0 returned -16 [ 2351.060393][ T4011] input: syz0 as /devices/virtual/input/input3393 [ 2351.070690][T22689] binder: undelivered TRANSACTION_ERROR: 29189 [ 2351.096324][ T4016] input: syz0 as /devices/virtual/input/input3394 [ 2351.102053][T22689] binder: undelivered TRANSACTION_ERROR: 29189 [ 2351.122621][ T4021] input: syz0 as /devices/virtual/input/input3395 11:29:21 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa412b14fd"], 0x0, 0x0, 0x0}) [ 2351.205766][ T4035] input: syz0 as /devices/virtual/input/input3396 11:29:21 executing program 0 (fault-call:5 fault-nth:0): syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r0, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") getitimer(0x0, 0x0) 11:29:21 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x11\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) 11:29:21 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x05\x00'}, 0x45c) [ 2351.288784][ T1470] binder: undelivered TRANSACTION_ERROR: 29189 [ 2351.302329][ T4129] binder: 4124:4129 unknown command -8196 [ 2351.325188][ T4129] binder: 4124:4129 ioctl c0306201 200002c0 returned -22 [ 2351.364263][ T1470] binder: release 4124:4129 transaction 3560 out, still active [ 2351.402317][ T4129] binder: BINDER_SET_CONTEXT_MGR already set [ 2351.407734][ T1470] binder: undelivered TRANSACTION_COMPLETE [ 2351.416017][ T4129] binder: 4124:4129 ioctl 40046207 0 returned -16 [ 2351.417675][ T4134] binder_alloc: 4124: binder_alloc_buf, no vma [ 2351.431042][ T1470] binder: send failed reply for transaction 3560, target dead [ 2351.481640][ T4139] input: syz0 as /devices/virtual/input/input3397 [ 2351.491017][ T4141] input: syz0 as /devices/virtual/input/input3398 [ 2351.498877][ T4134] binder: 4124:4134 transaction failed 29189/-3, size 0-0 line 3148 [ 2351.513835][T22689] binder: undelivered TRANSACTION_ERROR: 29189 11:29:21 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r1, 0xc0505350, &(0x7f0000000500)) gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(0x0, 0x1000000000013) 11:29:21 executing program 0: syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r0, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") getitimer(0x0, 0x0) 11:29:21 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa502b14fd"], 0x0, 0x0, 0x0}) [ 2351.544920][ T4146] input: syz0 as /devices/virtual/input/input3399 [ 2351.577370][ T4148] input: syz0 as /devices/virtual/input/input3400 11:29:21 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00'}, 0x45c) 11:29:22 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r1, 0xc02c5341, &(0x7f0000000280)={0x0, 0x0, 0x0, 'queue1\x00', 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe00000000000000]}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) 11:29:22 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) [ 2351.752758][ T4160] binder: 4156:4160 unknown command -8196 11:29:22 executing program 0: syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r0, 0x0) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sequencer\x00', 0x100, 0x0) ioctl$sock_inet_SIOCGIFPFLAGS(r1, 0x8935, &(0x7f0000000100)={'syzkaller1\x00', 0x6d}) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_CLIENT(r1, 0xc04c5349, &(0x7f0000000140)={0x5, 0x7, 0x6}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") getitimer(0x0, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_MRT6_DEL_MFC(r3, 0x29, 0xcd, &(0x7f0000000040)={{0xa, 0x4e24, 0x83c, @rand_addr="d0b6407e7c9d61ad179c8c93e90e9405", 0xe7}, {0xa, 0x4e23, 0x0, @initdev={0xfe, 0x88, [], 0x0, 0x0}, 0xfff}, 0x1, [0x0, 0x8, 0x1, 0x7, 0x9, 0x600, 0x3, 0x4]}, 0x5c) [ 2351.825888][ T4166] input: syz0 as /devices/virtual/input/input3401 [ 2351.833649][ T4160] binder: 4156:4160 ioctl c0306201 200002c0 returned -22 [ 2351.882903][T22689] binder: release 4156:4160 transaction 3563 out, still active [ 2351.885594][ T4160] binder: BINDER_SET_CONTEXT_MGR already set [ 2351.903628][T22689] binder: undelivered TRANSACTION_COMPLETE [ 2351.920980][ T4173] input: syz0 as /devices/virtual/input/input3402 [ 2351.949168][ T4166] input: syz0 as /devices/virtual/input/input3403 [ 2351.977737][ T4160] binder: 4156:4160 ioctl 40046207 0 returned -16 [ 2351.977829][T22689] binder: send failed reply for transaction 3563, target dead 11:29:22 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e4114fd"], 0x0, 0x0, 0x0}) [ 2352.025581][ T4196] input: syz0 as /devices/virtual/input/input3404 11:29:22 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x12\x00'}, 0x45c) 11:29:22 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x14\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) 11:29:22 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) r2 = dup2(r0, r0) setsockopt$SO_VM_SOCKETS_CONNECT_TIMEOUT(r2, 0x28, 0x6, &(0x7f0000000000), 0x10) r3 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r3, 0x1000008912, &(0x7f0000000040)="0adc3ca63c123f319bd070") getitimer(0x0, 0x0) [ 2352.220811][ T4298] binder: 4269:4298 unknown command -8196 [ 2352.236808][ T4298] binder: 4269:4298 ioctl c0306201 200002c0 returned -22 [ 2352.250084][ T4300] input: syz0 as /devices/virtual/input/input3405 [ 2352.288206][ T4301] input: syz0 as /devices/virtual/input/input3406 [ 2352.305285][T22689] binder: release 4269:4298 transaction 3565 out, still active [ 2352.317164][ T4298] binder: BINDER_SET_CONTEXT_MGR already set [ 2352.327035][T22689] binder: undelivered TRANSACTION_COMPLETE [ 2352.345573][ T4298] binder: 4269:4298 ioctl 40046207 0 returned -16 [ 2352.366102][ T4305] binder_alloc: 4269: binder_alloc_buf, no vma [ 2352.367587][T22689] binder: send failed reply for transaction 3565, target dead 11:29:22 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x15\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) [ 2352.407289][ T4305] binder: 4269:4305 transaction failed 29189/-3, size 0-0 line 3148 [ 2352.436150][ T1470] binder: undelivered TRANSACTION_ERROR: 29189 [ 2352.538937][ T4418] input: syz0 as /devices/virtual/input/input3409 11:29:22 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r1, 0xc0505350, &(0x7f0000000500)) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x0) 11:29:22 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x14\x00'}, 0x45c) 11:29:22 executing program 0: syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r0, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") getitimer(0x0, 0x0) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000040)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_ENUM_FREQ_BANDS(r2, 0xc0405665, &(0x7f0000000080)={0x1, 0x7, 0x66f, 0x0, 0x3c, 0xffffffff00000000, 0xa}) 11:29:22 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e5014fd"], 0x0, 0x0, 0x0}) [ 2352.612178][ T4422] input: syz0 as /devices/virtual/input/input3410 [ 2352.714274][ T4430] binder: 4425:4430 unknown command -8196 [ 2352.743302][ T4430] binder: 4425:4430 ioctl c0306201 200002c0 returned -22 [ 2352.750405][ T4432] input: syz0 as /devices/virtual/input/input3411 11:29:23 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r1, 0xc02c5341, &(0x7f0000000280)={0x0, 0x0, 0x0, 'queue1\x00', 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f00000000000000]}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) 11:29:23 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x16\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) [ 2352.784397][ T1470] binder: release 4425:4430 transaction 3568 out, still active [ 2352.838831][ T1470] binder: undelivered TRANSACTION_COMPLETE [ 2352.874217][ T1470] binder: release 4425:4452 transaction 3569 out, still active [ 2352.885677][ T4432] input: syz0 as /devices/virtual/input/input3412 [ 2352.914391][ T4548] input: syz0 as /devices/virtual/input/input3413 [ 2352.923620][ T1470] binder: undelivered TRANSACTION_COMPLETE 11:29:23 executing program 0: syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dmmidi(&(0x7f0000000080)='/dev/dmmidi#\x00', 0x38, 0x10000) syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x802) mmap$IORING_OFF_SQES(&(0x7f0000002000/0x3000)=nil, 0x3000, 0x2000000, 0x1010, r0, 0x10000000) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/mls\x00', 0x0, 0x0) ioctl(r2, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") getitimer(0x0, 0x0) 11:29:23 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b41fd"], 0x0, 0x0, 0x0}) 11:29:23 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x15\x00'}, 0x45c) [ 2352.965069][ T1470] binder: send failed reply for transaction 3568, target dead [ 2353.001375][ T1470] binder: send failed reply for transaction 3569, target dead 11:29:23 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) [ 2353.125062][ T4563] input: syz0 as /devices/virtual/input/input3415 [ 2353.147246][ T4568] binder: 4560:4568 unknown command -8196 [ 2353.170334][ T4568] binder: 4560:4568 ioctl c0306201 200002c0 returned -22 [ 2353.179844][ T4576] input: syz0 as /devices/virtual/input/input3416 [ 2353.209740][ T4600] input: syz0 as /devices/virtual/input/input3417 [ 2353.225332][T22689] binder: release 4560:4568 transaction 3571 out, still active [ 2353.249155][T22689] binder: undelivered TRANSACTION_COMPLETE [ 2353.276628][T22689] binder: release 4560:4627 transaction 3572 out, still active [ 2353.294648][ T4644] input: syz0 as /devices/virtual/input/input3418 11:29:23 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b50fd"], 0x0, 0x0, 0x0}) 11:29:23 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x16\x00'}, 0x45c) [ 2353.329088][T22689] binder: undelivered TRANSACTION_COMPLETE [ 2353.354991][T22689] binder: send failed reply for transaction 3571, target dead [ 2353.415868][T22689] binder: send failed reply for transaction 3572, target dead [ 2353.463335][ T4683] input: syz0 as /devices/virtual/input/input3419 [ 2353.488320][ T4686] binder: 4684:4686 unknown command -8196 [ 2353.496677][ T4686] binder: 4684:4686 ioctl c0306201 200002c0 returned -22 [ 2353.520343][ T4688] input: syz0 as /devices/virtual/input/input3420 [ 2353.533756][ T1470] binder: release 4684:4686 transaction 3574 out, still active 11:29:23 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r1, 0xc0505350, &(0x7f0000000500)) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x0) 11:29:23 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000180)='/dev/dlm_plock\x00', 0x400000, 0x0) r3 = gettid() write$FUSE_LK(r2, &(0x7f00000001c0)={0x28, 0xfffffffffffffffe, 0x8, {{0x8, 0x0, 0x0, r3}}}, 0x28) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) fcntl$getownex(r0, 0x10, &(0x7f0000000000)={0x0, 0x0}) wait4(r4, &(0x7f0000000080), 0x40000006, &(0x7f00000000c0)) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc35123c0400e5ffff6f") setsockopt$inet_tcp_TCP_CONGESTION(r2, 0x6, 0xd, &(0x7f0000000200)='reno\x00', 0x5) 11:29:23 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00/\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) [ 2353.562825][ T1470] binder: undelivered TRANSACTION_COMPLETE [ 2353.569716][ T4686] binder: BINDER_SET_CONTEXT_MGR already set [ 2353.569765][ T4690] binder_alloc: 4684: binder_alloc_buf, no vma [ 2353.590594][ T1470] binder: send failed reply for transaction 3574, target dead [ 2353.645972][ T4698] input: syz0 as /devices/virtual/input/input3421 [ 2353.668269][ T4690] binder: 4684:4690 transaction failed 29189/-3, size 0-0 line 3148 11:29:23 executing program 0: syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r0, 0x0) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sequencer2\x00', 0x501203, 0x0) ioctl$TIOCOUTQ(r1, 0x5411, &(0x7f0000000080)) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$DRM_IOCTL_ADD_CTX(r0, 0xc0086420, &(0x7f0000000040)={0x0}) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f00000017c0)={'team0\x00', 0x0}) stat(&(0x7f0000001800)='./file0\x00', &(0x7f0000001840)={0x0, 0x0, 0x0, 0x0, 0x0}) socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$inet6_IPV6_IPSEC_POLICY(r1, 0x29, 0x22, &(0x7f00000018c0)={{{@in6=@mcast2, @in6=@remote, 0x4e22, 0x3, 0x4e24, 0x400, 0x2, 0x80, 0x80, 0x6c, r4, r5}, {0x2, 0x2, 0x6, 0x2, 0x5, 0x8000, 0x2}, {0x1000, 0x5, 0x6, 0xfff}, 0x6, 0x6e6bba, 0x0, 0x1, 0x1, 0x3}, {{@in=@empty, 0x4d4, 0x33}, 0x0, @in=@broadcast, 0x3504, 0x7, 0x3, 0x7ff, 0x5, 0x280000000, 0x312}}, 0xe8) ioctl$DRM_IOCTL_DMA(r0, 0xc0406429, &(0x7f0000000200)={r3, 0x6, &(0x7f0000000100)=[0x5, 0x81, 0x8, 0x101, 0x1ff, 0x6a98], &(0x7f0000000140)=[0xb6a3, 0x6, 0x77ac, 0x9, 0xffffffff], 0x35, 0x2, 0x53f16bef, &(0x7f0000000180)=[0x4, 0x20], &(0x7f00000001c0)=[0x7, 0x1]}) ioctl(r2, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") ioctl$SG_GET_LOW_DMA(r1, 0x227a, &(0x7f0000000280)) getitimer(0x0, 0x0) fcntl$setstatus(r0, 0x4, 0x40000) ioctl$KVM_ASSIGN_SET_INTX_MASK(r1, 0x4040aea4, &(0x7f0000000240)={0x101, 0x7, 0x1f, 0x1, 0x6}) [ 2353.690025][ T4701] input: syz0 as /devices/virtual/input/input3422 [ 2353.717138][ T4686] binder: 4684:4686 ioctl 40046207 0 returned -16 [ 2353.726854][ T1470] binder: undelivered TRANSACTION_ERROR: 29189 11:29:24 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00'}, 0x45c) 11:29:24 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00?\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) 11:29:24 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r1, 0xc02c5341, &(0x7f0000000280)={0x0, 0x0, 0x0, 'queue1\x00', 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfeffffff00000000]}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) 11:29:24 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x2, 0x0, 0x0}) [ 2353.897211][ T4711] binder: 4707:4711 ioctl c0086420 20000040 returned -22 11:29:24 executing program 0: syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r0, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") getitimer(0x0, 0x0) r2 = accept4(r1, &(0x7f0000000040)=@rc, &(0x7f00000000c0)=0x80, 0x80000) setsockopt$inet_sctp_SCTP_RECVRCVINFO(r2, 0x84, 0x20, &(0x7f0000000100)=0x3ff, 0x4) [ 2353.961303][ T4717] input: syz0 as /devices/virtual/input/input3423 [ 2354.025429][ T4726] input: syz0 as /devices/virtual/input/input3424 [ 2354.053954][ T4725] input: syz0 as /devices/virtual/input/input3425 [ 2354.068323][ T4727] binder: 4722:4727 unknown command -8196 11:29:24 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00/\x00'}, 0x45c) [ 2354.117649][ T4733] input: syz0 as /devices/virtual/input/input3426 [ 2354.134587][ T4727] binder: 4722:4727 ioctl c0306201 200002c0 returned -22 11:29:24 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) [ 2354.176584][ T1470] binder: release 4722:4727 transaction 3577 out, still active [ 2354.184505][ T4727] binder: BINDER_SET_CONTEXT_MGR already set [ 2354.208903][ T1470] binder: undelivered TRANSACTION_COMPLETE [ 2354.219634][ T4738] binder_alloc: 4722: binder_alloc_buf, no vma [ 2354.237075][ T1470] binder: send failed reply for transaction 3577, target dead [ 2354.281839][ T4727] binder: 4722:4727 ioctl 40046207 0 returned -16 [ 2354.319889][ T4766] input: syz0 as /devices/virtual/input/input3427 [ 2354.330035][ T4738] binder: 4722:4738 transaction failed 29189/-3, size 0-0 line 3148 [ 2354.352723][ T4824] input: syz0 as /devices/virtual/input/input3428 [ 2354.372817][T22689] binder: undelivered TRANSACTION_ERROR: 29189 11:29:24 executing program 0: syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r0, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") inotify_init() getitimer(0x0, 0x0) [ 2354.389104][ T4851] input: syz0 as /devices/virtual/input/input3429 11:29:24 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r1, 0xc0505350, &(0x7f0000000500)) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x0) 11:29:24 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x3, 0x0, 0x0}) 11:29:24 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) 11:29:24 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00?\x00'}, 0x45c) [ 2354.679220][ T4968] binder: 4937:4968 unknown command -8196 [ 2354.697861][ T4969] input: syz0 as /devices/virtual/input/input3431 [ 2354.710322][ T4971] input: syz0 as /devices/virtual/input/input3432 11:29:25 executing program 0: syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r0, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") getitimer(0x0, 0x0) [ 2354.729101][ T4968] binder: 4937:4968 ioctl c0306201 200002c0 returned -22 [ 2354.775869][ T4975] input: syz0 as /devices/virtual/input/input3433 [ 2354.809631][T22689] binder: release 4937:4968 transaction 3580 out, still active [ 2354.819690][ T4980] input: syz0 as /devices/virtual/input/input3434 [ 2354.836534][ T4968] binder: BINDER_SET_CONTEXT_MGR already set [ 2354.838231][T22689] binder: undelivered TRANSACTION_COMPLETE [ 2354.876045][ T4968] binder: 4937:4968 ioctl 40046207 0 returned -16 11:29:25 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r1, 0xc02c5341, &(0x7f0000000280)={0x0, 0x0, 0x0, 'queue1\x00', 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff00000000]}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) 11:29:25 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xfe\x00'}, 0x45c) [ 2354.876534][ T4982] binder_alloc: 4937: binder_alloc_buf, no vma [ 2354.890133][T22689] binder: send failed reply for transaction 3580, target dead 11:29:25 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) [ 2355.016698][ T4982] binder: 4937:4982 transaction failed 29189/-3, size 0-0 line 3148 11:29:25 executing program 0: syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x4000000020014, r0, 0x1) r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/cachefiles\x00', 0x2, 0x0) bind$alg(r1, &(0x7f0000000300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ctr(cast6)\x00'}, 0x58) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000140)={{{@in=@broadcast, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in=@initdev}}, &(0x7f0000000240)=0xe8) quotactl(0x7, &(0x7f0000000100)='./file0\x00', r2, &(0x7f0000000280)="ee45fb7e4bc102bf24400e68c3a36d7304") r3 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r3, 0x1000008912, &(0x7f0000000440)="0adc1f123c123f319bd070") lstat(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)) ioctl$RTC_ALM_READ(r1, 0x80247008, &(0x7f0000000000)) getitimer(0x0, 0x0) [ 2355.061659][T22689] binder: undelivered TRANSACTION_ERROR: 29189 [ 2355.071001][ T5097] input: syz0 as /devices/virtual/input/input3435 11:29:25 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x4, 0x0, 0x0}) [ 2355.174064][ T5109] input: syz0 as /devices/virtual/input/input3437 11:29:25 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x00\x02\x00'}, 0x45c) 11:29:25 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008915, &(0x7f0000000000)="0adc1f123c123f319bd070") getitimer(0x0, 0x0) [ 2355.272037][ T5116] binder: 5111:5116 unknown command -8196 [ 2355.295201][ T5118] input: syz0 as /devices/virtual/input/input3438 [ 2355.324146][ T5116] binder: 5111:5116 ioctl c0306201 200002c0 returned -22 [ 2355.356408][ T1470] binder: release 5111:5116 transaction 3583 out, still active [ 2355.372906][ T5123] input: syz0 as /devices/virtual/input/input3439 [ 2355.383569][ T1470] binder: undelivered TRANSACTION_COMPLETE [ 2355.406645][ T5127] binder: 5122:5127 ioctl 8915 20000000 returned -22 [ 2355.466763][ T5128] input: syz0 as /devices/virtual/input/input3440 [ 2355.477489][ T1470] binder: send failed reply for transaction 3583, target dead 11:29:25 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) 11:29:25 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x5, 0x0, 0x0}) 11:29:25 executing program 4 (fault-call:5 fault-nth:0): r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r1, 0xc0505350, &(0x7f0000000500)) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) [ 2355.538217][ T1470] binder: send failed reply for transaction 3584, target dead 11:29:25 executing program 0: syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x7fc) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r0, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/mixer\x00', 0x200000, 0x0) write$UHID_INPUT2(r2, &(0x7f00000000c0)={0xc, 0xe6, "22ae5aca837dc2094f8b6d985b41e2edda968caf72f2ba46a2ab1a6763f01977b2813d855ee9b06c94efbd9ea9c877747b751b50852e0114d2e14bda1930f5c935d43bc339fd53ea4a1990e57298d6dabf1b31ee4cffd74e5d8f773ff9dd3b287d6df2855dcf96c794170d0bdc86bc69819253894dcf470bd043963a91a52ee2a998fb3185de0ecaa68ae0b0f71da7016c70a3b70c0a054aff64cb1eb815ad0809ad38fbdf59bdcdc862e4825298fbb41d70a8e6ead723533d4cfe3b033b6eb96bcf1b7b0a7d266c0834856886d5a2c77e84d1aaafa634aa7e6bb4cf962e6ec6f3e1a44e3058"}, 0xec) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") getitimer(0x1, 0x0) ioctl$sock_SIOCGSKNS(r1, 0x894c, &(0x7f0000000040)=0x3ff) 11:29:25 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x00\x03\x00'}, 0x45c) [ 2355.631134][ T5239] input: syz0 as /devices/virtual/input/input3441 [ 2355.703069][ T5245] binder: 5238:5245 unknown command -8196 [ 2355.730035][ T5244] input: syz0 as /devices/virtual/input/input3442 [ 2355.769702][ T5245] binder: 5238:5245 ioctl c0306201 200002c0 returned -22 [ 2355.830509][ T5275] input: syz0 as /devices/virtual/input/input3443 [ 2355.864458][ T5344] input: syz0 as /devices/virtual/input/input3444 11:29:26 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r1, 0xc02c5341, &(0x7f0000000280)={0x0, 0x0, 0x0, 'queue1\x00', 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe]}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) 11:29:26 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x05\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) 11:29:26 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x6, 0x0, 0x0}) 11:29:26 executing program 0: syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r0, 0x0) r1 = syz_open_dev$vcsn(&(0x7f0000000040)='/dev/vcs#\x00', 0x7fff, 0x141081) getsockopt$inet_sctp_SCTP_AUTO_ASCONF(r1, 0x84, 0x1e, &(0x7f0000000080), &(0x7f00000000c0)=0x4) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") getitimer(0x0, 0x0) 11:29:26 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x00\x04\x00'}, 0x45c) [ 2356.005489][ T5367] input: syz0 as /devices/virtual/input/input3445 [ 2356.078278][ T5417] input: syz0 as /devices/virtual/input/input3446 11:29:26 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x11\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) 11:29:26 executing program 0: syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r0, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = syz_open_dev$mouse(&(0x7f0000000080)='/dev/input/mouse#\x00', 0xded8, 0x200) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000000c0)={'vcan0\x00', 0x0}) ioctl$sock_inet6_SIOCADDRT(r2, 0x890b, &(0x7f0000000100)={@mcast1, @initdev={0xfe, 0x88, [], 0x0, 0x0}, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}, 0xadc, 0xd91, 0x6, 0x0, 0xfffffffffffffff7, 0x2000000, r3}) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") getitimer(0x0, 0x0) fcntl$F_GET_FILE_RW_HINT(r1, 0x40d, &(0x7f0000000040)) [ 2356.152283][ T5478] binder: 5376:5478 unknown command -8196 [ 2356.171136][ T5478] binder: 5376:5478 ioctl c0306201 200002c0 returned -22 [ 2356.180758][ T5480] input: syz0 as /devices/virtual/input/input3447 11:29:26 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x7, 0x0, 0x0}) 11:29:26 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x00\x05\x00'}, 0x45c) [ 2356.316862][ T5492] input: syz0 as /devices/virtual/input/input3449 [ 2356.384359][ T5496] binder: 5493:5496 unknown command -8196 [ 2356.403657][ T5496] binder: 5493:5496 ioctl c0306201 200002c0 returned -22 [ 2356.446754][ T5500] input: syz0 as /devices/virtual/input/input3450 [ 2356.486474][ T5503] input: syz0 as /devices/virtual/input/input3451 11:29:26 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r1, 0xc0505350, &(0x7f0000000500)) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) 11:29:26 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x802) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") getitimer(0x0, 0x0) dup2(r0, r1) openat$apparmor_task_exec(0xffffffffffffff9c, &(0x7f0000000080)='/proc/self/attr/exec\x00', 0x2, 0x0) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x20000, 0x0) setsockopt$inet_udp_encap(r3, 0x11, 0x64, &(0x7f0000000040), 0x4) ioctl$UI_DEV_CREATE(r3, 0x5501) 11:29:26 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x48, 0x0, 0x0}) [ 2356.567300][ T5509] input: syz0 as /devices/virtual/input/input3452 [ 2356.685998][ T5547] binder: 5512:5547 unknown command -8196 [ 2356.692693][ T5547] binder: 5512:5547 ioctl c0306201 200002c0 returned -22 11:29:27 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r1, 0xc02c5341, &(0x7f0000000280)={0x0, 0x0, 0x0, 'queue1\x00', 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe00]}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) 11:29:27 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) 11:29:27 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x00\x11\x00'}, 0x45c) 11:29:27 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x4c, 0x0, 0x0}) 11:29:27 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/capi/capi20ncci\x00', 0x101000, 0x0) r3 = accept4$inet(r2, &(0x7f0000000080)={0x2, 0x0, @multicast1}, &(0x7f0000000200)=0xffffffffffffff6d, 0x80000) getsockopt$IPT_SO_GET_REVISION_TARGET(r3, 0x0, 0x43, &(0x7f00000000c0)={'ah\x00'}, &(0x7f0000000100)=0x1e) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl(r0, 0x6, &(0x7f0000000240)="0f3f156aeab3fdef13f740ddde89f0b8f63ae6a29d0f1f47c583aa14db4b89dee1b6f24455ff0bf7b605aca78d0ba5f5d11245e351c4843c9f273ed873dacd07f7b562e25476b75b75d5ae0a15e6f148ffc0e04d23882d75a2c2c5017c3c10f05f51a5b5e5e937ef19423e97589a566adcd4aaec1a4e3ff4562a2096d7f8ffe2f50fc08beaae116d78d42b606eeae02479b06d743fdce6ce37b222aa6493c7e08c7bed06b95530735cef2ae8a42af5abbdbc2e4298b4a109493828c2ae65ba8564fe39eb96b5c1531f0fbd8a3ca31062aa8a8ecbc88b7969874babf0396d9a67602b82492b6e13bf9471") r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r4, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") getitimer(0x0, 0x0) [ 2357.029612][ T5632] binder: 5629:5632 ioctl 6 20000240 returned -22 [ 2357.040715][ T5633] input: syz0 as /devices/virtual/input/input3453 [ 2357.049812][ T5631] input: syz0 as /devices/virtual/input/input3454 [ 2357.105884][ T5651] binder: 5627:5651 unknown command -8196 [ 2357.112234][ T5645] input: syz0 as /devices/virtual/input/input3456 [ 2357.122710][ T5646] input: syz0 as /devices/virtual/input/input3455 [ 2357.137920][ T5651] binder: 5627:5651 ioctl c0306201 200002c0 returned -22 11:29:27 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x00\x12\x00'}, 0x45c) [ 2357.201380][ T1470] binder_thread_release: 9 callbacks suppressed [ 2357.201391][ T1470] binder: release 5627:5651 transaction 3602 out, still active [ 2357.223959][ T5746] binder: BINDER_SET_CONTEXT_MGR already set [ 2357.243741][ T1470] binder_release_work: 9 callbacks suppressed 11:29:27 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x14\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) 11:29:27 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = gettid() fcntl$setownex(r0, 0xf, &(0x7f00000000c0)={0x2, r1}) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r2, 0x0) r3 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r3, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") getitimer(0x0, 0x0) r4 = syz_open_procfs(0x0, &(0x7f0000000040)='net/icmp\x00') ioctl$GIO_CMAP(r4, 0x4b70, &(0x7f0000000080)) [ 2357.243748][ T1470] binder: undelivered TRANSACTION_COMPLETE [ 2357.251858][ T5746] binder: 5627:5746 ioctl 40046207 0 returned -16 [ 2357.272270][ T1470] binder: release 5627:5747 transaction 3603 out, still active [ 2357.308019][ T1470] binder: undelivered TRANSACTION_COMPLETE [ 2357.329733][ T5754] input: syz0 as /devices/virtual/input/input3457 11:29:27 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x60, 0x0, 0x0}) [ 2357.378004][ T5758] input: syz0 as /devices/virtual/input/input3458 [ 2357.388290][ T1470] binder_send_failed_reply: 8 callbacks suppressed [ 2357.388299][ T1470] binder: send failed reply for transaction 3602, target dead [ 2357.438963][ T1470] binder: send failed reply for transaction 3603, target dead [ 2357.463379][ T5780] input: syz0 as /devices/virtual/input/input3459 [ 2357.481845][ T5781] binder: 5772:5781 unknown command -8196 11:29:27 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r1, 0x2, &(0x7f0000000500)) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) [ 2357.498114][ T5781] binder: 5772:5781 ioctl c0306201 200002c0 returned -22 [ 2357.522636][ T1470] binder: release 5772:5781 transaction 3605 out, still active [ 2357.535854][ T5781] binder: BINDER_SET_CONTEXT_MGR already set [ 2357.542549][ T1470] binder: undelivered TRANSACTION_COMPLETE [ 2357.565485][ T5781] binder: 5772:5781 ioctl 40046207 0 returned -16 [ 2357.573009][ T1470] binder: send failed reply for transaction 3605, target dead [ 2357.588351][ T5817] binder: 5772:5817 transaction failed 29189/-22, size 0-0 line 2995 11:29:27 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x68, 0x0, 0x0}) 11:29:27 executing program 0: syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r0, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) clock_getres(0x3, &(0x7f0000000040)) ioctl$NBD_SET_FLAGS(r1, 0xab0a, 0x40) openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/loop-control\x00', 0x200, 0x0) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r2 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000200)='/proc/capi/capi20ncci\x00', 0x28000, 0x0) ioctl$CAPI_GET_PROFILE(r2, 0xc0404309, &(0x7f0000000240)=0x2) ioctl$SIOCX25SSUBSCRIP(0xffffffffffffffff, 0x89e1, &(0x7f0000000100)={'teql0\x00', 0x8, 0x8}) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x0) getitimer(0x1, 0x0) [ 2357.615209][ T1470] binder: undelivered TRANSACTION_ERROR: 29189 [ 2357.632396][ T5758] input: syz0 as /devices/virtual/input/input3460 [ 2357.773301][ T5882] binder: 5879:5882 unknown command -8196 [ 2357.790156][ T5883] binder: 5881:5883 ioctl 40046205 0 returned -22 [ 2357.804129][ T5882] binder: 5879:5882 ioctl c0306201 200002c0 returned -22 [ 2357.838961][ T1470] binder: release 5879:5882 transaction 3608 out, still active [ 2357.848064][ T5882] binder: BINDER_SET_CONTEXT_MGR already set [ 2357.854536][ T5882] binder: 5879:5882 ioctl 40046207 0 returned -16 [ 2357.861098][ T1470] binder: undelivered TRANSACTION_COMPLETE [ 2357.868743][ T1470] binder: send failed reply for transaction 3608, target dead [ 2357.876891][ T5885] binder: 5879:5885 transaction failed 29189/-22, size 0-0 line 2995 [ 2357.885498][ T1470] binder: undelivered TRANSACTION_ERROR: 29189 11:29:28 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r1, 0xc02c5341, &(0x7f0000000280)={0x0, 0x0, 0x0, 'queue1\x00', 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f00]}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) 11:29:28 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x15\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) 11:29:28 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x00\x14\x00'}, 0x45c) 11:29:28 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x6c, 0x0, 0x0}) 11:29:28 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0xfffffffffffffffe) r1 = syz_open_dev$binder(0x0, 0x0, 0x3) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x20, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0f630c400200000002000000000800000f00"], 0x68, 0x0, &(0x7f0000000100)="3fab9608fc1205ef098c3cfeae37783ede2abada4b0e7be329c95e5aa295b54d35fa948106a5d61ccdf92af1f320a6b75a475a104da9e6a603901aa767c47162c3f2d3e88f50b10455f28dfa5e8ddaa84942c30271df5fb842bc43ba5284f68b545ca352925c8882"}) ioctl(r2, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") getitimer(0x0, 0x0) syz_open_dev$usb(&(0x7f00000001c0)='/dev/bus/usb/00#/00#\x00', 0x7, 0x240000) r3 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/checkreqprot\x00', 0x301, 0x0) ioctl$sock_inet6_udp_SIOCINQ(r3, 0x541b, &(0x7f0000000080)) [ 2358.102571][ T5995] input: syz0 as /devices/virtual/input/input3461 [ 2358.113858][ T5996] input: syz0 as /devices/virtual/input/input3462 [ 2358.163586][ T6003] input: syz0 as /devices/virtual/input/input3463 [ 2358.170243][ T6002] binder: 5991:6002 unknown command -8196 [ 2358.180016][ T6015] input: syz0 as /devices/virtual/input/input3464 [ 2358.232499][ T6002] binder: 5991:6002 ioctl c0306201 200002c0 returned -22 11:29:28 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x16\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) 11:29:28 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x00\x15\x00'}, 0x45c) [ 2358.288994][T22689] binder: release 5991:6002 transaction 3611 out, still active [ 2358.308851][T22689] binder: undelivered TRANSACTION_COMPLETE [ 2358.319769][ T6110] binder_alloc: 5991: binder_alloc_buf, no vma 11:29:28 executing program 0: syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r0, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = accept4$ax25(0xffffffffffffffff, &(0x7f0000000040)={{0x3, @default}, [@rose, @rose, @default, @netrom, @bcast]}, &(0x7f00000000c0)=0x48, 0x80800) recvfrom$ax25(r2, &(0x7f0000000100)=""/139, 0x8b, 0x10000, &(0x7f00000001c0)={{0x3, @default, 0x6}, [@rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @default, @null, @null, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}, 0x48) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") getitimer(0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) [ 2358.342768][T22689] binder: send failed reply for transaction 3611, target dead [ 2358.359082][ T6110] binder: 5991:6110 transaction failed 29189/-3, size 0-0 line 3148 [ 2358.384804][ T6115] input: syz0 as /devices/virtual/input/input3465 [ 2358.420624][ T1470] binder: undelivered TRANSACTION_ERROR: 29189 11:29:28 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x74, 0x0, 0x0}) [ 2358.450856][ T6122] input: syz0 as /devices/virtual/input/input3466 [ 2358.459524][ T6121] input: syz0 as /devices/virtual/input/input3467 11:29:28 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r1, 0x4b47, &(0x7f0000000500)) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) 11:29:28 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) [ 2358.569897][ T6157] input: syz0 as /devices/virtual/input/input3468 11:29:28 executing program 0: syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r0, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x100000001, &(0x7f0000000040)="0adc1fca3c123f399bd070") getitimer(0x0, 0x0) [ 2358.672135][ T6237] binder: 6200:6237 unknown command -8196 [ 2358.695693][ T6237] binder: 6200:6237 ioctl c0306201 200002c0 returned -22 [ 2358.761419][ T6237] binder: BINDER_SET_CONTEXT_MGR already set [ 2358.767800][ T6242] input: syz0 as /devices/virtual/input/input3469 [ 2358.768191][T22689] binder: send failed reply for transaction 3615 to 6200:6237 [ 2358.782988][ T6243] binder: 6200:6243 transaction failed 29189/-22, size 0-0 line 2995 [ 2358.793306][ T6237] binder: 6200:6237 ioctl 40046207 0 returned -16 [ 2358.800160][T22689] binder: undelivered TRANSACTION_COMPLETE [ 2358.813364][T22689] binder: undelivered TRANSACTION_ERROR: 29189 [ 2358.830853][T22689] binder: undelivered TRANSACTION_ERROR: 29189 [ 2358.868000][ T6256] input: syz0 as /devices/virtual/input/input3470 11:29:29 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r1, 0xc02c5341, &(0x7f0000000280)={0x0, 0x0, 0x0, 'queue1\x00', 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe000000]}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) 11:29:29 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x00\x16\x00'}, 0x45c) 11:29:29 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x7a, 0x0, 0x0}) 11:29:29 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00/\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) 11:29:29 executing program 0: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000280)='/dev/hwrng\x00', 0x385000, 0x0) fcntl$setsig(r0, 0xa, 0x39) syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") add_key$keyring(&(0x7f0000000040)='keyring\x00', &(0x7f0000000080)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffff8) ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f0000000240)={'erspan0\x00', 0x1}) r3 = add_key(&(0x7f0000000100)='cifs.idmap\x00', &(0x7f0000000140)={'syz', 0x2}, &(0x7f0000000180)="57ec514b1027afb345aa7b0646465a0a32e5c5cf9dd8ab1cc42921cf79d95c30b08b8337406b8df5962a926e512b4a107e39aa5c4219b38fde596c9124664b1e3a6c411c0952800c977cf8133a867bcfbc80984a3396a3ec7345a4617792af664255ed3023d874567c520f959db95654c68e35b7c200cc9fb1115493e2acb18b056976e30cdc1298ac15f56650f0549b3f56", 0x92, 0xfffffffffffffffb) prctl$PR_GET_SPECULATION_CTRL(0x34, 0x0, 0x6) keyctl$instantiate(0xc, r3, &(0x7f0000000500)=ANY=[], 0x0, r3) getsockopt$IP_VS_SO_GET_SERVICE(r2, 0x0, 0x483, &(0x7f0000000380), &(0x7f00000000c0)=0x68) ioctl$SIOCX25SCALLUSERDATA(r0, 0x89e5, &(0x7f00000002c0)={0x25, "b65266d7fddcfb9df5ed281a996ca2facc2f39f00d0de83f30547c40ef8b398b9bec6bd1d60eb749c787d320b641fe346add44fba79dfdef03d0151d1df80e895b61970b408a3de646396da80f20ac4ba0d54c0fc4c7e901ef9f8ee21e224fdc20cd6f3d2a642d43d8fa9f3a366173a37c4a5b171a8cf2cafb0ab4bc388efc5a"}) [ 2359.147389][ T6364] input: syz0 as /devices/virtual/input/input3471 [ 2359.163274][ T6367] binder: 6362:6367 unknown command -8196 [ 2359.171858][ T6365] input: syz0 as /devices/virtual/input/input3472 [ 2359.184649][ T6367] binder: 6362:6367 ioctl c0306201 200002c0 returned -22 [ 2359.216136][ T6364] input: syz0 as /devices/virtual/input/input3473 [ 2359.254351][ T6401] input: syz0 as /devices/virtual/input/input3474 11:29:29 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) r2 = syz_open_dev$media(&(0x7f0000000140)='/dev/media#\x00', 0xb60, 0x101000) r3 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000180)='/dev/dlm-control\x00', 0x0, 0x0) socketpair$tipc(0x1e, 0x7, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_bt_hidp_HIDPCONNADD(r2, 0x400448c8, &(0x7f0000000300)={r3, r4, 0xffff, 0xf8, &(0x7f0000000200)="d84edeb10c64135898ea7ca6e4361f6f91282935c544416ad84b6335e62c9f6261a12815d3f912db6dc1a55b7ef84e54e7e00f675b4f687590b1c7b6445281f6b33298941b4b2807ce195b213c0716263da90d3e6f9dac0e3868bf7f36a3a70b8b5fa2c7432fa16c2a3aeebc9c3c0ad9e0deaa89edecb9085fbf83b6eb224cc9698134e0d65286307f8f20f69c5299aa0df9a7c53f1294ee2f9f653e764d68b426c9fbc5ef5b01cd7ad5712357f6619a233ad99d3110821bff3c20d6a85ee5285133494f8b0fe774800deefab644f960e2c084720ba1b2d945cf63e27b0f2fa0a6d98ff2402e6b8c7624c784ddb966ad1275bc74ce8dcb38", 0x7, 0x0, 0x1, 0x9, 0x200, 0x2, 0x0, 'syz0\x00'}) r5 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r5, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r6 = dup2(r1, r0) ioctl$KVM_XEN_HVM_CONFIG(r6, 0x4038ae7a, &(0x7f0000000100)={0x80000001, 0x2c3, &(0x7f0000000040)="e3e7d750ad441e601b2755c53b7139599cff809f562a84ccaeee8664752f589a14ab2a499b3e878c8ba5c6948cfdf1fa102626b5d526b8ebb8ddd853862852eb7ba45a5057482d074007f1c53efad650635dab6d478e143b83e93e4cdf7c8db5309fdca4549a21c3819e705977103cdf48f30f9838b47e2bdf0812ac66f44865ca2622e772057a7d4d3e359b7f5fc54badde9f0ae31329ddd2d44a2698227987f8700736016c53f6c5a4", &(0x7f0000000440)="f54ae288a46ccf1ab9931ce5907d2f32dd23469dd9de108d2a62d4a8f5008ccbabb1c126b87e4eee598d3c05e4bc8b4c939c60c44c7e1f525343fcd95951b26ba2f63f2795b8920c3caf7244c475e9244e8f820ae5ca4f9ab89d4d8490d10d11e9f7508827e37fedaa342131314472bd49fb94ba340ac1299311cb061b979585217bf96f60bbef10853f762c1a88e4b6dbda12c77f63501a026991e557170eb4f9cbce35d6bc74dc4a132912f5c329543a55bc1d73d47c8683189c77c92401635d87e65f6da39d32cdeb400e466eeeb227eccc621155efacc2f6ca55cc4ce411214c144bc5021806e3a8c818bdb5a13d1800222b7b741cca8bb4656a92ad5d3d6a463c5104188c625e9c011283dc15ce1bde666cc3fd80b0c853088cc92b791f4ed46c02eade1c6a9e7d3035d5864a64f0f81f3c712d92e00be1b8fd6eca14357b14a30d402a7dc08e299ab331cfaac64602536cafbf90e16b5fd8b8881fdf9b8395c51f712e10fb5adeba62e3078f8502a7e8c6a062c9364d77feac13dd9ec667bbe23bdcaa6267308042011f1b9891f81ad7c1f45f0f5e537587ab27b39de99dfa550b400c65a39fff26423c2702d19aa3afb60c266ab9fbaa2e5067baff9b8d94f2bb9e122aa70a50c68bfd2e9a31bcf89c928ab73edcb95a76e6d4dafbeca421fcf288c72a1565adaea72d1fd20c640cc7b8a6165a6034ebe8cf0983f39c14686480d6e9bcabdec7374fa9df8cdaca2076db2ea86d2683211e9f83dc54260bfb27597c5b36342ff433109f76916d67b39e9325d25022e51cca6e6b7105a9293ba5fddc7b11a60ae8b38c47956336ae020d1314772bea1484ef3f1058cd9f10288af7d87eda497588446936b851bcbeca329efd82bb3a5e2e87af6370d33a36c3cea144ee5122c4897ce3689f2a3263c77f2fbafbfcb6ab2c599b52d2863b8737416d7a866c4c0dc5b94c2111d7ec7920043bd58fa61d40ec83b6134938ebc8ea2bd7998c1415ee1cdb5f95d9774896224e26c65f3bbeb8d557e22393b4bcacb568fc4d79c8c31b2f87906fb990d7c6b7e97c56d9e12c7ff69306bf3cd4cbd832419e751bf3a4735dfdde9332d72ef1d186d754536f3fc37a3e0173aa42ea62b080e47fccdb3a12c32f640e718f7c12d75d38af6b07f82af949ff5c8388b3b97bff64953dd834cbae3488240dae1ea94c662172f9459c5a6f524639a5d2cd7dea54112ba0d989871596731c2626e97d77954ef5592fa39d7d150e94afd79f912bcc1d7d1aec5ab78e645c36aed4c33355003fcfd7cf5c037c87ebad7cd5a64606d4c05937bc8be046e08b6bfc99cc3ddba3f12d0a68d7ace67e426c00ac5b813e407669e58b01fcfb4f66bea3ce3a93b0b0cc3a63c3618cecc8ef3d34a0df03785d2bd029c66b3efbd776fdbb24acd684765c5b5cd71b39a3dbae440da22ed21cc22a88bc7d812ba538cf2dc10d6f6f88e84ec5dfd4ee4ea2ae649892cd64c2e38d24ea7ffa7a8f8a053b300edbfee2fe420a9bbda8959589aa033e095d339e0ecae600d9816ca6d9a1771f2e8fecbf8034a57aef9e0c1fb47e3d0b17a9c3870ecc3d0a2ea4236392bffb25c67f9ceef3c682ba98c75caba5b41a4f714c31e4a5d111a92c8e5e97d08eb485261c3f532fbef2efcd3dd27681fccfcd3c57feffd852dcbbe07dd944b708cf8110b383a85419e9378521d110d085f0e3399ca9f5c8d27c700854de5ff04fb4fabdbd6a25b4dd3df82520e92f83abb3d791de05fe6252f5ba8b8587eb09d0318f686603a683a71727cddf729898972a4984f6ace417f2f1e3c8a9e5e1f2f0fcbf1cf91b4fd65798ba2fd9bd6daf5b4c1966add5599b6082dad9f4c20a2a02433e10db6486110a5383253eb350e66c29cfe4ca88b44afa8f846381c4c51c1a19bccfe124ea888a21bfe106006339df60b4f4fa681f001eaac06d94126a1d92116fe2469b940de521907a6d689ea29433a668b0e14d6fd7464f95d3da20da09c28bdfed5e0941dd807db125b958e1d0ea370ddad5bb5294542fc8010981aa0a20dd7c5a014a66f9c5d5017cd84997fd417453de306efd654489100ea8e7a743a21609221a218b16c8d59fabf15c74ffe463d25d4e96f2d15a58e57fd77894dfe161ac55115afea121cc8ae7880372f57dae640eac097b43014fe458c0b878230227e251338787091ffb4c9f55cb5f345cfd6b777a598f4dc07e4530d6b9bc161aefe7a140860a679ae59e3a81afd3194077dfefdfdde43dda7d4a917cae275d6ae4f390a00d2ba756ec5c7fba67a0cb5e265ffeb340adb213dd3c6232a59b090c22c2636af0074fe389955be2b518822ba43d47087f2232cfa18af4fdf2a4dec441826793df907a7303f72a6863cade48cce9128c6dd328de59fe1ecb92fa58ef19c7fa9956eff80e44ced521bdffe81538873fe20f17a303f37a25e06a08932308f3f0cd2435801fdd516cba4d9bc19213623b06bff29cbff463fe42c1ea29840b7f11b07e55e5c12796b8f5587464ad1eb9aa54e9adda5d0249632c400b41768e61e8b70022647a8670b569903e68073bc38c46fb5a0479274f2aff461b132f1abad69d2f37cd46e59e2f60596470edacceed9fa3d9ff22256a25258b7f05a9a8dde2966285fb64a75dbc2a154552a7eeda9f75b8ff1c8a1f964260ad589d8a7a207b4d8a97456c42b7fad0e101e82273cf97bd0550892abd7e58660cb75cc13c7fa1cd1a8975b6f5df3e44e45fcdada80b0b1bdeda20fed785bbef857de49b17ad0dfd14f7f5e7bf5fff8105725a0de41430199a7599b97cd8e0403e501058f87e22d4eff539337e60e2c383fe3b398bb9d53e3cfc7bcfb5b02b8d94575e4c7201c045489d721a71191c572492d56092e555cc0312a9158a299f39a06395412978bbf5bbe372b05e7f21acc43d4db5c96d9257b46667ee8b95199c10d3e07e115eddadd21222d919d341867445ff770177096c900091252c6475a8f43946d19901df489d44facbac0df3299880fdb30eb68aec11a5864a49001d75a2384879893f0e27fcc11f18d7bfec0dbfe2b49af6f29bd5dcd757c4b2738db48df71cd80a14101ec86deb6fc8f7ff083926f8d3a02c5e7eb25763f301875bec6b42c9b2a039ab184685310c5b5640238f50db0bfa15604eabc60bd2242291a51d0e7f7dcf487e2021e958234fd7bb9558c07bb4954087a2f622c5dabe725ed56861c37cbcf24cb5ceb66f7fc6df198e58739f2b36858d2d18707bcb188fe5af517d82ee288c7eabbcfc21eee35f4a5c388878cec8695bca0d5ee7652a84608cb5576156a9ba3bb68c3486443ff84f6738d166f4e14c649c9f6ed1173d171603719dc90bf6132787c175c2b9bbe45ace1c59e6648a4456c8f578a2fd15103a3335d9f68c15f66d8b0e76200dbbff69aeb40b3f843c15860a81003b476701be3229d311cf55cd8fca0caa1e3d62e2d3e718fde5c8a6f7b3b3f7c89011daee1d8a873ed0a0b183c2c003adbc0b50beb17032bee9b88d40ae6417631050a39db6ed7c2dda552b7663ebe5f0324d8a1ff373a70531f24d67068471ab1316a1a73ec84db582b733370da12b6cd9bbb9fcb64234360e6b88c70e2a8feeb5470582ce9e0b3c0eb7d84382a1250e583a2b1810ea21ac8a660258a6192056b59dc6c4a089ac49e1714ceb3d4ac0469265c60d47e38af191ec0f7ef878b208033bf56b85e4be971ed8f5a191ad39118942305a6e3a9546fe5bf04ce02b9a6b8a4ce25b1efa31b29a10dd453a11ab6828017c36bdfe71828fc0faa74d22f17564aba2d49c7981948a51e21ac2581ca3da541aa9883378284a13465f3a20cb9ecf4aa2d88ac8205ecf7fca853f51f8f2943d1ecd17b50b85f2de573c6fd4658af8050c6e3354a97a3772f79b67ab26377be70f8fab76d031c8d147c64b40c23db5e4c117d3806bc3dd3b065e85cef25c1adc0da1af77ee458922e392b6c0f88f5fda4215e92284fee8afa534df54b0c0fb109d45a65eeee74709cd39922d6730e07d5dbdbd2ef9a02959af8179c70279790575825af84a28fd76b1d38d346d862051d724e2b0444d6d4ddf5c33c72f2287ca1a0ff9dd575dc2545d83cfaa1eb5dda1d2160abfb7173526e86ff79c27bb5a6dac2db75783aa8063793810477092ce5385dcc37255d2d8387a355eda5678baa3a3f23cd54be8896b9d47b762c7eebb186b30acfad1413341276ee7fb958d578b2ffca7a72107c35ac4214e35c99befa94e59014c8f011207d4c5c77d4a8697b405761de75fe9fe74887da5e8ac617fe3e8cdc1d449e2001e9ed79058eae17b18c794feec7e508b8433b9127d97836ef4ca2b2c37b6bfe63aa5a652ba6db49bb098f4861be06eb675ef5498f7b7c0109eae5433228cc93c73803024781e9a7e6a9c503164332a9376c1b506ea72168f1bacb34aa7adccdf31aebf75b9a04641da4e8e6617e653b9f614ed87c3b5e4698c4ce9ae051a66159b98e024f5b876f009b9e3002b6c427d387f8e8818f2dd5921324cb764a0641bcd4fb783d18d03f89460ccbf4d63e6bfe8b773ae11e25ab3b00e28d6fa6c69c17e0d2ff5f1735031eb73da6b4140cf9d248d079981671fda3ae64ef7d959bc17a0a0fe33fa9df29c6be00b5772cf1ec10caf22e7b9f3ae313989a1f09e7ce93ae18f4bd6c28c87b6998c71013afc94f5467dd8f75bf6ba2b1df0515d1f4b4dd05609720a0b702bc08cc2e2e137bda99d3e76157ab84466baa81fcb48309618e0ae1057ffbe2e33a71f2d59ca0353549b8439cb70e7b5d47f3f8270d19c27116599d54784f8478cf29dbd5c2b39ed37efc3c3647f6d49002184ef38b0eb16ce025f2af3423783b0f507d1f3489cec6170e2d52a0e8c2699f44dc77711f9cc959c2cb9f8568b916ce2cea38c45018c9edbcda1ddebf057ae55cfb9437d049bd1339e44ea3add346924cebf08062e582fbd1e02ddda13a651f203017d9a225876f6869385a3c03dc28d87679ea57a84da1f91d8b045a38c6b452148a37eac45a8563c420efd3d31ae52d42cc5773b870555d82946ad9eb048a022ca386bd27b30d61cb464d48ce94d455b1998f87e260ea7947757a8d4a65fd40ee5c32f7039cfb171033e93c53edb1bc01f3cb3a719958c692cb640ac20ad1690edef2d14e553723a5cca235bc831ec46d4815d4fedb3959852e7c41b7bb581bdc8ea94e2f8d471956a161eed22e5b1b97876539159cd43f2b3c2ebfaf7944fa35b0515d46629d5f012faa22d26a404919ef8db44245f0c5de2c0e3c8a220888f82ee34f3ce6cd0898c16968c379888a35d205b635755c7488ccbadefc19ef671b86d0d20956dca56ff26d2938a965bace602a90664d6ae75151c9d969e96e3bfd41e0246dea0a86e485c82d3a78400a6ee07f1e29304900daff020df98e55f60fd02bfe3a5488462081e3821eee13413fc3579aca2195564234ee53cacc3872ca91072523b3eae4792aa5145c642cbb51a3d36fe8efadc6194eaf787737015a4610fdb309154761bb40278cd33d747a201ef292aa8db9aef1353261a15f44edd9732a0a89cbd099f0b5df234463c42439fa922518b9512e8aae4ce6353dd8dd185c0a6e9a93a7b544ab381192d9fb37cfd2608692902ad0fbc83e15801a6e487026f95035689f9e1a466b82a5594be46ebad27212abd2f94ee0b84e08d581c78db0e0b71325ab4f13bce0331a0b7a5c864000af982064fa0800db2f82c7ee42223f7fc769c0003686e6ba72e028065864c19208ee5ba6d494b344cd9", 0xaa, 0x1000}) getitimer(0x3, 0x0) [ 2359.277217][T22689] binder: release 6362:6367 transaction 3618 out, still active [ 2359.279551][ T6367] binder: BINDER_SET_CONTEXT_MGR already set [ 2359.285075][T22689] binder: undelivered TRANSACTION_COMPLETE 11:29:29 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x00/\x00'}, 0x45c) 11:29:29 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00?\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) [ 2359.346626][ T6367] binder: 6362:6367 ioctl 40046207 0 returned -16 [ 2359.352971][T22689] binder: send failed reply for transaction 3618, target dead 11:29:29 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x300, 0x0, 0x0}) [ 2359.455902][ T6486] input: syz0 as /devices/virtual/input/input3475 [ 2359.510129][ T6491] input: syz0 as /devices/virtual/input/input3476 11:29:29 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r1, 0x4b49, &(0x7f0000000500)) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) 11:29:29 executing program 0: syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0x0, 0x0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x41) ioctl$SCSI_IOCTL_GET_PCI(r1, 0x5387, &(0x7f0000000140)) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) r3 = getpid() move_pages(r3, 0x2000011a, &(0x7f0000000040)=[&(0x7f0000001000/0x3000)=nil], &(0x7f0000000080)=[0x3cb], &(0x7f00000000c0)=[0x0, 0x0, 0x0, 0x0], 0x40000006) ioctl(r2, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") getitimer(0x0, 0x0) [ 2359.557044][ T6492] input: syz0 as /devices/virtual/input/input3477 [ 2359.581663][ T6498] input: syz0 as /devices/virtual/input/input3478 [ 2359.642271][ T6502] binder: 6494:6502 unknown command -8196 11:29:30 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\xff\xff\xff\xfe\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) [ 2359.706806][ T6502] binder: 6494:6502 ioctl c0306201 200002c0 returned -22 [ 2359.767837][T22689] binder: release 6494:6502 transaction 3620 out, still active [ 2359.780490][ T6502] binder: BINDER_SET_CONTEXT_MGR already set [ 2359.798902][T22689] binder: undelivered TRANSACTION_COMPLETE [ 2359.809847][ T6510] binder_alloc: 6494: binder_alloc_buf, no vma [ 2359.827489][T22689] binder: send failed reply for transaction 3620, target dead [ 2359.835389][ T6553] input: syz0 as /devices/virtual/input/input3479 [ 2359.838212][ T6502] binder: 6494:6502 ioctl 40046207 0 returned -16 [ 2359.857039][ T6510] binder: 6494:6510 transaction failed 29189/-3, size 0-0 line 3148 [ 2359.865579][T22689] binder: undelivered TRANSACTION_ERROR: 29189 [ 2359.940213][ T6620] input: syz0 as /devices/virtual/input/input3480 11:29:30 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r1, 0xc02c5341, &(0x7f0000000280)={0x0, 0x0, 0x0, 'queue1\x00', 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f000000]}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) 11:29:30 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x00\x00\x03\x00'}, 0x45c) 11:29:30 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x500, 0x0, 0x0}) 11:29:30 executing program 0: syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r0, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") getitimer(0x0, 0x0) r2 = openat$dlm_control(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/dlm-control\x00', 0x2, 0x0) ioctl$SIOCAX25NOUID(r2, 0x89e3, &(0x7f00000003c0)) ioctl$VT_RELDISP(r2, 0x5605) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x4, &(0x7f0000000300)={0xffffffffffffffff}, 0x13f, 0x8}}, 0x20) write$RDMA_USER_CM_CMD_QUERY(r2, &(0x7f0000000380)={0x13, 0x10, 0xfa00, {&(0x7f0000000100), r3, 0x1}}, 0x18) arch_prctl$ARCH_MAP_VDSO_X32(0x2001, 0xffff) r4 = syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x45aa, 0x101800) ioctl$SG_NEXT_CMD_LEN(r4, 0x2283, &(0x7f0000000080)=0x90) 11:29:30 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\xfe\xff\xff\xff\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) [ 2360.104702][ T6628] input: syz0 as /devices/virtual/input/input3481 [ 2360.123628][ T6634] binder: 6626:6634 unknown command -8196 [ 2360.134975][ T6635] input: syz0 as /devices/virtual/input/input3482 [ 2360.159688][ T6634] binder: 6626:6634 ioctl c0306201 200002c0 returned -22 [ 2360.185126][ T1470] binder: release 6626:6634 transaction 3623 out, still active 11:29:30 executing program 0: syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r0, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") syz_open_dev$evdev(&(0x7f0000000080)='/dev/input/event#\x00', 0xd73, 0x0) getitimer(0x0, 0x0) fcntl$F_GET_FILE_RW_HINT(r1, 0x40d, &(0x7f0000000040)) 11:29:30 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x600, 0x0, 0x0}) [ 2360.207782][ T1470] binder: undelivered TRANSACTION_COMPLETE [ 2360.216082][ T6628] input: syz0 as /devices/virtual/input/input3483 [ 2360.239857][ T1470] binder: release 6626:6640 transaction 3624 out, still active [ 2360.282282][ T1470] binder: undelivered TRANSACTION_COMPLETE [ 2360.302786][ T1470] binder: send failed reply for transaction 3623, target dead [ 2360.320596][ T1470] binder: send failed reply for transaction 3624, target dead 11:29:30 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x00\x00\x05\x00'}, 0x45c) [ 2360.346943][ T6638] input: syz0 as /devices/virtual/input/input3484 [ 2360.369652][ T6653] binder: 6651:6653 unknown command -8196 [ 2360.377841][ T6653] binder: 6651:6653 ioctl c0306201 200002c0 returned -22 [ 2360.421661][T22689] binder: release 6651:6653 transaction 3626 out, still active [ 2360.431703][ T6653] binder: BINDER_SET_CONTEXT_MGR already set [ 2360.448228][ T6725] binder_alloc: 6651: binder_alloc_buf, no vma [ 2360.454846][T22689] binder: send failed reply for transaction 3626, target dead 11:29:30 executing program 0: syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = openat(0xffffffffffffffff, &(0x7f0000000040)='./file0\x00', 0x4200, 0x60) ioctl$TIOCSWINSZ(r0, 0x5414, &(0x7f0000000080)={0x3, 0x3ff, 0x2}) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, 0xffffffffffffffff, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") getitimer(0x0, 0x0) [ 2360.472621][ T6653] binder: 6651:6653 ioctl 40046207 0 returned -16 [ 2360.486444][ T6758] input: syz0 as /devices/virtual/input/input3485 [ 2360.509055][ T6725] binder: 6651:6725 transaction failed 29189/-3, size 0-0 line 3148 [ 2360.552894][ T6761] input: syz0 as /devices/virtual/input/input3486 [ 2360.565809][T22689] binder: undelivered TRANSACTION_ERROR: 29189 11:29:30 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r1, 0x541b, &(0x7f0000000500)) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) 11:29:30 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) 11:29:30 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x700, 0x0, 0x0}) [ 2360.722508][ T6783] input: syz0 as /devices/virtual/input/input3487 [ 2360.792336][ T6835] binder: 6792:6835 unknown command -8196 [ 2360.802494][ T6835] binder: 6792:6835 ioctl c0306201 200002c0 returned -22 11:29:31 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r1, 0xc02c5341, &(0x7f0000000280)={0x0, 0x0, 0x0, 'queue1\x00', 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfeffffff]}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) 11:29:31 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x00\x00\x11\x00'}, 0x45c) 11:29:31 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) 11:29:31 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x2000, 0x0, 0x0}) 11:29:31 executing program 0: syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r0, 0x0) openat$apparmor_task_current(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/attr/current\x00', 0x2, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$RTC_IRQP_SET(r0, 0x4008700c, 0x1ce4) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") getitimer(0x0, 0x0) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r0, 0x84, 0x1d, &(0x7f0000000080)={0x2, [0x0, 0x0]}, &(0x7f00000000c0)=0xc) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(r1, 0x84, 0x71, &(0x7f0000000100)={r2, 0x80000000}, &(0x7f0000000140)=0x8) [ 2361.093320][ T6894] binder: 6890:6894 ioctl 4008700c 1ce4 returned -22 [ 2361.109188][ T6896] input: syz0 as /devices/virtual/input/input3489 [ 2361.117133][ T6897] input: syz0 as /devices/virtual/input/input3490 [ 2361.128438][ T6898] binder: 6892:6898 unknown command -8196 [ 2361.141431][ T6898] binder: 6892:6898 ioctl c0306201 200002c0 returned -22 11:29:31 executing program 0: syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r0, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r2 = socket(0x5, 0x80000, 0xd4) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000040)={0x0, 0x93, "c426052a6b3cc171b234b97ecd1b536ccd155c5f3194027a24bc98d4ffc4f53fff8b878def2372ac5f4bf5770b002272c79e9c68a399d50d420993fec435185dae39a8d34adb0cb0ff5586e21c9061ce54f605eb3d07dec6461d563168fd7ef70cb5c639936a46e18d8abaaa5454ab90a86dd6faab2e40066a3dc6ad0d78ee9c8cabedc4febab8b22b5dd00c0c159d53415917"}, &(0x7f0000000100)=0x9b) setsockopt$inet_sctp_SCTP_SET_PEER_PRIMARY_ADDR(r2, 0x84, 0x5, &(0x7f0000000140)={r3, @in6={{0xa, 0x4e20, 0x8, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x6}}}, 0x84) ioctl$sock_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000200)) getitimer(0x0, 0x0) 11:29:31 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x3f00, 0x0, 0x0}) [ 2361.211825][ T6904] input: syz0 as /devices/virtual/input/input3492 [ 2361.219507][ T6902] input: syz0 as /devices/virtual/input/input3491 11:29:31 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) 11:29:31 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x00\x00\x12\x00'}, 0x45c) [ 2361.388239][ T6919] binder: 6911:6919 unknown command -8196 [ 2361.406758][ T6919] binder: 6911:6919 ioctl c0306201 200002c0 returned -22 [ 2361.452676][ T6925] input: syz0 as /devices/virtual/input/input3493 [ 2361.461506][ T6919] binder: BINDER_SET_CONTEXT_MGR already set [ 2361.476919][ T6919] binder: 6911:6919 ioctl 40046207 0 returned -16 [ 2361.483594][ T6924] input: syz0 as /devices/virtual/input/input3494 [ 2361.501203][ T6926] binder_alloc: 6911: binder_alloc_buf, no vma [ 2361.525644][ T6931] input: syz0 as /devices/virtual/input/input3495 [ 2361.528321][ T6926] binder: 6911:6926 transaction failed 29189/-3, size 0-0 line 3148 [ 2361.553804][T22689] binder: undelivered TRANSACTION_ERROR: 29189 [ 2361.562684][ T6930] input: syz0 as /devices/virtual/input/input3496 11:29:31 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r1, 0x5421, &(0x7f0000000500)) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) 11:29:31 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) syz_mount_image$hfsplus(&(0x7f0000000080)='hfsplus\x00', &(0x7f00000000c0)='./file0\x00', 0xe3b4, 0x9, &(0x7f00000007c0)=[{&(0x7f0000000100)="21bc0938b7698ed19b0d597b0e511820fbaa6ed8458ef726ff39408db8c5def5f0286a780e757909fbc50f0a96867e7923c4554b3f72a159fc436fb04c10da9e877907c6a9ebb042a31c58b3bd3816d4fbc0abf0417d6465771b94d9ebb82a8c5dcebdb291ff566d1fdc424addd413bd389c7a687eca817b9a0363ba5a9254bd112a2b988e4852179f524e6822b56e023e9bd876110b9a2b46ec4ea62ee647b5af7ded63651b7b458a364a09a186376e08761c7c589377032639ff52996243c95450b54ba71160b569410a8058681a43", 0xd0, 0x3}, {&(0x7f0000000200)="9ab38d43c8324ca637c5", 0xa, 0x4}, {&(0x7f0000000240)="11c2ee777e9402302b2ebe0707d04c0eb037e6f287d97006df20001a027e900c02864b13fa29c6994ef9c456d797aa2486555806e975c43ae29afcaa88a7519c07367850ef08b41e3705c5dc36ae08bb8bdea1643d7a43c99be40e033e972fc105376cf65f0832d9bd57375c5f282e1218c69730bbf80230ad7e217090dc2d40a50bdfbbde1524674ece80f16c10cd71c18baa58a63d05a7bfb2c1370052c94671da02ef42e8827830bd8a778e06535239111aed058a5807d84bdde20a10cfd044a49b884f023123c15f7c42ea48370ca7598b400e8dc33e4ccebc3ad389fb75811e46b418d3f6ad1035dd40065166b460faea785653144984", 0xf9, 0x3}, {&(0x7f0000000340)="894f19efb6f64a61ef7822670e01c171976503478f8457401d4b0b2d7bece13addaea2567de59102955498cd56acfe03399f24366a8932cb74f68ebd4e30c12078d59234bda1c32da4f953b3a6e9ec2fdf2192453441e09bd960fd4e5358da812856ba7595d030657afb7200082e8d89e3d037b2fb62d85395c690eec5edfaca1f7242", 0x83, 0x8000}, {&(0x7f0000000440)="ff88032d79e6989781bd0b158fb9468f67e51ac936d19640de25b7296c14fe00a9a2acc689e08a4eff1c8609f2378433623e48f76f91c4d8251b5f54c7843c1f5f6f7547ebd87d86417a8f8ef17f120e4240b557e9e9a36915214afcdac6373a0454059678e5d8", 0x67, 0x100000000}, {&(0x7f00000004c0)="8858690507af620c2ec55653e45d16c7994b3ea170d8f648d5fdabfadedcdb88838a474ba7e26ea4cec6f25fb63ac764c0f3ef0773dc013cb8c1aee5524aa03fdfb761674544207d9f85cccb16c4e0f30a59cb75aebb9ec48064d88925ae37486701e3fef1cd9911da37710b", 0x6c, 0x9}, {&(0x7f0000000540)="8bb90e48414f05d70f857a16757f983a900f2ee331dbc1fc274d5a1c67867012802078792b1c460efb99d8c7e00e50240a64f23788a035db421a54957d3d6fa1a5a7d735d4ba22ef530d7b183c98d964b2fef6d7e95732f643612994e35c905161bd07c280d0", 0x66, 0x7}, {&(0x7f00000005c0)="fb8daf1a52cb935c9c65e1dd5d72717f1f0fb177e293414aa61bc909ae9bfe388dcd9b76707bd41a89c9e6c1c563b35c72dcaba317219c689787cc2f9ec23f21d7691c82450b60464b07206d5a5b1fc5d1bb97eea432227c3192053e2e72749aedbc697125b991190fae6ebf1a2f8aa691456bc2622fbd77d1b4ce506bcc53910665dd55c4c8aa54bacbc5c7014716454a28727a63f415299531778f56d5c5e3f100da43395b64c526e0076c631e476d217d9c742f34654eba0e8d701edc176a9847918a56b2ac36cddf74b2f4", 0xcd, 0x401}, {&(0x7f00000006c0)="376bc980d0b5a318a2e8d518f1c9fb614dcba4eb87694f807b206a2562478235a8d24c30868c09f1175ad0565b70d3ffad4455e92727292a50f455feba2901eb621519a87b7096a401d86539d9e84879d3206f5e44351ead9ca8da39942557fbc9d4370fd3d8f94996159bbbd31a35dcfac283f7db94b3dae19f904cb1085ac292a1c0da9612ed6c6a6105871280d8489c389e7b8edf0566ad78eff352e256fe5ad887a1b647fbe99b13fffa4a7371c53cec3c2707b2ad8193eddd44064d2dbb10805265c5a4a4dcd099d092741a5cd199e4ef87912dc91e3a86d7e1084d203b981d86d5c559b6045e262483e5e1b950b105d387daa3", 0xf6, 0x4}], 0x20a0, &(0x7f00000008c0)={[{@type={'type', 0x3d, "35f36fac"}}], [{@mask={'mask', 0x3d, '^MAY_READ'}}, {@subj_type={'subj_type'}}]}) ioctl$FICLONERANGE(r1, 0x4020940d, &(0x7f0000000040)={r0, 0x0, 0x4, 0x4, 0x7a1b}) ioctl(r2, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") getitimer(0x0, 0x0) 11:29:31 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x4800, 0x0, 0x0}) [ 2361.794868][ T6979] binder: 6943:6979 unknown command -8196 [ 2361.801717][ T6979] binder: 6943:6979 ioctl c0306201 200002c0 returned -22 11:29:32 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r1, 0xc02c5341, &(0x7f0000000280)={0x0, 0x0, 0x0, 'queue1\x00', 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe]}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) 11:29:32 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x00\x00\x14\x00'}, 0x45c) 11:29:32 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x04\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) 11:29:32 executing program 0: syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r1 = socket$netlink(0x10, 0x3, 0x4) r2 = syz_genetlink_get_family_id$nbd(&(0x7f0000000080)='nbd\x00') r3 = creat(&(0x7f00000000c0)='./file0\x00', 0x3) r4 = syz_open_dev$media(&(0x7f0000000100)='/dev/media#\x00', 0x5, 0x103000) r5 = openat$zero(0xffffffffffffff9c, &(0x7f0000000140)='/dev/zero\x00', 0x101400, 0x0) r6 = syz_open_dev$dspn(&(0x7f0000000240)='/dev/dsp#\x00', 0x8, 0x4000) sendmsg$NBD_CMD_RECONFIGURE(r1, &(0x7f0000000380)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10010004}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0xa0, r2, 0x106, 0x70bd29, 0x25dfdbfb, {}, [@NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x8}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x7f}, @NBD_ATTR_SOCKETS={0x2c, 0x7, [{0x8, 0x1, r3}, {0x8, 0x1, r4}, {0x8, 0x1, r0}, {0x8, 0x1, r5}, {0x8, 0x1, r6}]}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x1}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x101}, @NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x5}, @NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x3}, @NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x2}]}, 0xa0}, 0x1, 0x0, 0x0, 0x10}, 0x20004090) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r0, 0x0) r7 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r7, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") getitimer(0x0, 0x0) 11:29:32 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x4c00, 0x0, 0x0}) [ 2362.112690][ T7065] input: syz0 as /devices/virtual/input/input3497 [ 2362.130881][ T7066] input: syz0 as /devices/virtual/input/input3498 [ 2362.131068][ T7067] binder: 7060:7067 unknown command -8196 [ 2362.140160][ T7063] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=0 sclass=netlink_tcpdiag_socket pig=7063 comm=syz-executor.0 [ 2362.164785][ T7067] binder: 7060:7067 ioctl c0306201 200002c0 returned -22 [ 2362.183769][ T7069] input: syz0 as /devices/virtual/input/input3499 [ 2362.211193][ T7066] input: syz0 as /devices/virtual/input/input3500 [ 2362.265572][ T1470] binder_thread_release: 7 callbacks suppressed [ 2362.265583][ T1470] binder: release 7060:7067 transaction 3643 out, still active [ 2362.289839][ T7067] binder: BINDER_SET_CONTEXT_MGR already set 11:29:32 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x00\x00\x15\x00'}, 0x45c) 11:29:32 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x05\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) [ 2362.312292][ T1470] binder_release_work: 8 callbacks suppressed [ 2362.312298][ T1470] binder: undelivered TRANSACTION_COMPLETE [ 2362.342361][ T7067] binder: 7060:7067 ioctl 40046207 0 returned -16 11:29:32 executing program 0: syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0x0, 0x386dfd545a09edf5) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r0, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$FS_IOC_SETVERSION(r1, 0x40087602, &(0x7f0000000040)=0x6) getrusage(0x0, &(0x7f0000000240)) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") openat$vimc2(0xffffffffffffff9c, &(0x7f0000000180)='/dev/video2\x00', 0x2, 0x0) r2 = openat$autofs(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/autofs\x00', 0x20800, 0x0) getpeername$packet(r2, &(0x7f00000001c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000000200)=0x14) ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000080)={0x3, 0x8, 0x1, r2}) getsockopt$inet_sctp_SCTP_MAXSEG(0xffffffffffffff9c, 0x84, 0xd, &(0x7f00000000c0)=@assoc_id=0x0, &(0x7f0000000100)=0x4) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r2, 0x84, 0x7c, &(0x7f0000000140)={r3, 0x5, 0x5}, &(0x7f0000000300)=0x4) getitimer(0x0, 0x0) [ 2362.418168][ T7186] input: syz0 as /devices/virtual/input/input3501 [ 2362.433389][ T7188] input: syz0 as /devices/virtual/input/input3502 11:29:32 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x6000, 0x0, 0x0}) [ 2362.526770][ T7191] input: syz0 as /devices/virtual/input/input3503 [ 2362.570886][ T7192] input: syz0 as /devices/virtual/input/input3504 11:29:32 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r1, 0x5450, &(0x7f0000000500)) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) 11:29:32 executing program 0: syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0x0, 0xfffffffffffffffd) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r0, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") getitimer(0x0, 0x0) 11:29:32 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x00\x00\x16\x00'}, 0x45c) [ 2362.643711][ T7204] binder: 7199:7204 unknown command -8196 [ 2362.664579][ T7204] binder: 7199:7204 ioctl c0306201 200002c0 returned -22 [ 2362.706826][T22689] binder: release 7199:7204 transaction 3645 out, still active [ 2362.720028][ T7204] binder: BINDER_SET_CONTEXT_MGR already set [ 2362.742511][T22689] binder: undelivered TRANSACTION_COMPLETE [ 2362.750696][ T7211] input: syz0 as /devices/virtual/input/input3505 [ 2362.760701][ T7209] binder_alloc: 7199: binder_alloc_buf, no vma [ 2362.767887][T22689] binder_send_failed_reply: 8 callbacks suppressed [ 2362.767894][T22689] binder: send failed reply for transaction 3645, target dead [ 2362.807218][ T7204] binder: 7199:7204 ioctl 40046207 0 returned -16 [ 2362.823911][ T7209] binder: 7199:7209 transaction failed 29189/-3, size 0-0 line 3148 [ 2362.833444][ T7297] input: syz0 as /devices/virtual/input/input3506 [ 2362.860724][ T1470] binder: undelivered TRANSACTION_ERROR: 29189 11:29:33 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r1, 0xc02c5341, &(0x7f0000000280)={0x0, 0x0, 0x0, 'queue1\x00', 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe00000000000000]}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) 11:29:33 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) 11:29:33 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x6800, 0x0, 0x0}) 11:29:33 executing program 0: syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r1 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r1, 0x4008af00, &(0x7f0000000080)=0x200000000) write$vnet(r1, &(0x7f00000018c0)={0x1, {&(0x7f0000000100)=""/211, 0xd3, 0x0, 0x0, 0x2}}, 0x68) ioctl$int_in(r1, 0x40000000af01, 0x0) ioctl$VHOST_SET_VRING_ADDR(r1, 0x4028af11, &(0x7f0000000240)={0x0, 0x0, 0x0, &(0x7f0000000540)=""/246, 0x0}) r2 = openat$audio(0xffffffffffffff9c, &(0x7f0000000200)='/dev/audio\x00', 0x0, 0x0) close(r2) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r1, 0x4008af03, &(0x7f00000007c0)=ANY=[]) write$vnet(r1, &(0x7f00000004c0)={0x1, {0x0, 0x0, 0x0, 0x3, 0x2}}, 0x68) ioctl$VHOST_NET_SET_BACKEND(r1, 0x4008af30, &(0x7f0000f1dff8)={0x0, r2}) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r0, 0x0) r3 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r3, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000280)='IPVS\x00') sendmsg$IPVS_CMD_GET_INFO(r2, &(0x7f0000000380)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x54, r4, 0xc177fa569c88a397, 0x70bd2b, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_DEST={0x24, 0x2, [@IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x3b00000000000}, @IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e23}, @IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e20}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x5}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x5}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x100000001}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x80}]}]}, 0x54}, 0x1, 0x0, 0x0, 0x4000000}, 0x880) getitimer(0x0, 0x0) 11:29:33 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x00\x00\x1f\x00'}, 0x45c) [ 2363.123210][ T7329] binder: 7328:7329 unknown command -8196 [ 2363.139715][ T7330] input: syz0 as /devices/virtual/input/input3507 [ 2363.148511][ T7335] input: syz0 as /devices/virtual/input/input3508 [ 2363.165923][ T7329] binder: 7328:7329 ioctl c0306201 200002c0 returned -22 [ 2363.203989][ T1470] binder: release 7328:7329 transaction 3648 out, still active [ 2363.230592][ T7329] binder: BINDER_SET_CONTEXT_MGR already set [ 2363.246346][ C1] protocol 88fb is buggy, dev hsr_slave_0 11:29:33 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x12\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) [ 2363.252309][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2363.258228][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2363.264015][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2363.275826][ T1470] binder: undelivered TRANSACTION_COMPLETE [ 2363.308575][ T7345] input: syz0 as /devices/virtual/input/input3510 [ 2363.320187][ T7329] binder: 7328:7329 ioctl 40046207 0 returned -16 [ 2363.321515][ T1470] binder: send failed reply for transaction 3648, target dead [ 2363.326272][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2363.328412][ T7343] binder_alloc: 7328: binder_alloc_buf, no vma [ 2363.335765][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2363.370920][ T7343] binder: 7328:7343 transaction failed 29189/-3, size 0-0 line 3148 [ 2363.379355][ T1470] binder: undelivered TRANSACTION_ERROR: 29189 [ 2363.394882][ T7354] input: syz0 as /devices/virtual/input/input3511 11:29:33 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x00\x00/\x00'}, 0x45c) 11:29:33 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x6c00, 0x0, 0x0}) [ 2363.453957][ T7356] input: syz0 as /devices/virtual/input/input3512 11:29:33 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x14\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) [ 2363.560808][ T7361] input: syz0 as /devices/virtual/input/input3513 [ 2363.614391][ T7363] input: syz0 as /devices/virtual/input/input3514 [ 2363.660787][ T7366] binder: 7364:7366 unknown command -8196 [ 2363.689505][ T7372] input: syz0 as /devices/virtual/input/input3515 [ 2363.704282][ T7366] binder: 7364:7366 ioctl c0306201 200002c0 returned -22 11:29:34 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r1, 0x5451, &(0x7f0000000500)) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) 11:29:34 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x00\x00?\x00'}, 0x45c) [ 2363.753502][ T1470] binder: release 7364:7366 transaction 3651 out, still active [ 2363.760046][ T7366] binder: BINDER_SET_CONTEXT_MGR already set [ 2363.772091][ T1470] binder: undelivered TRANSACTION_COMPLETE [ 2363.806308][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2363.812195][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2363.818091][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2363.823895][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2363.839499][ T7375] input: syz0 as /devices/virtual/input/input3516 [ 2363.843207][ T7366] binder: 7364:7366 ioctl 40046207 0 returned -16 [ 2363.847336][ T1470] binder: send failed reply for transaction 3651, target dead 11:29:34 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x15\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfd\xff\xff\xff\x00'}, 0x45c) [ 2363.913884][ T7386] input: syz0 as /devices/virtual/input/input3517 [ 2364.000416][ T7394] input: syz0 as /devices/virtual/input/input3519 11:29:34 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r1, 0xc02c5341, &(0x7f0000000280)={0x0, 0x0, 0x0, 'queue1\x00', 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f00000000000000]}) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) 11:29:34 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="fcdfffffffffffff372e1c1c896bfec8b644b2396b28fa2e2b14fd"], 0x7400, 0x0, 0x0}) 11:29:34 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x200000000802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00', {}, 0x0, [], [], [0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x01\x00'}, 0x45c) [ 2364.053266][ T7398] input: syz0 as /devices/virtual/input/input3520 [ 2364.134246][ T7404] input: syz0 as /devices/virtual/input/input3521 [ 2364.171343][ T7407] binder: 7405:7407 unknown command -8196 [ 2364.205319][ T7407] binder: 7405:7407 ioctl c0306201 200002c0 returned -22 [ 2364.252771][T22689] binder: release 7405:7407 transaction 3653 out, still active [ 2364.262856][ T7404] input: syz0 as /devices/virtual/input/input3522 [ 2364.269626][T22689] binder: undelivered TRANSACTION_COMPLETE [ 2364.275992][ T7407] binder: BINDER_SET_CONTEXT_MGR already set [ 2364.276012][ T7412] binder_alloc: 7405: binder_alloc_buf, no vma [ 2364.386779][ T7412] binder: 7405:7412 transaction failed 29189/-3, size 0-0 line 3148 [ 2364.416255][ T7407] binder: 7405:7407 ioctl 40046207 0 returned -16 [ 2364.416408][T22689] binder: send failed reply for transaction 3653, target dead [ 2364.438895][T22689] binder: undelivered TRANSACTION_ERROR: 29189 [ 2369.486316][ C1] net_ratelimit: 26 callbacks suppressed [ 2369.486326][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2369.498087][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2369.503922][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2369.509734][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2369.566321][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2369.572295][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2370.046320][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2370.052206][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2370.058078][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2370.063929][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2375.726293][ C1] net_ratelimit: 26 callbacks suppressed [ 2375.726303][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2375.738101][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2375.743939][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2375.749758][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2375.806340][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2375.812332][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2376.286297][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2376.292147][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2376.298028][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2376.303797][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2381.966281][ C1] net_ratelimit: 26 callbacks suppressed [ 2381.966290][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2381.977861][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2381.983707][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2381.989629][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2382.046298][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2382.052272][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2382.526303][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2382.532109][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2382.537959][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2382.543794][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2388.206300][ C1] net_ratelimit: 26 callbacks suppressed [ 2388.206309][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2388.218074][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2388.224677][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2388.230489][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2388.286303][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2388.298351][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2388.766280][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2388.772085][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2388.777970][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2388.783792][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2394.446304][ C1] net_ratelimit: 26 callbacks suppressed [ 2394.446313][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2394.457820][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2394.463678][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2394.469783][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2394.526316][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2394.532285][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2395.006306][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2395.012127][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2395.018088][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2395.023851][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2400.686285][ C1] net_ratelimit: 26 callbacks suppressed [ 2400.686295][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2400.697894][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2400.703733][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2400.709719][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2400.776311][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2400.782293][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2401.246279][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2401.252088][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2401.257933][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2401.263878][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2406.926295][ C1] net_ratelimit: 26 callbacks suppressed [ 2406.926305][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2406.937830][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2406.943771][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2406.949687][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2407.016339][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2407.022332][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2407.486303][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2407.492111][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2407.497974][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2407.503830][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2413.166316][ C1] net_ratelimit: 26 callbacks suppressed [ 2413.166326][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2413.177823][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2413.183642][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2413.189539][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2413.256370][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2413.262428][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2413.726282][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2413.732182][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2413.738132][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2413.743891][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2419.406281][ C1] net_ratelimit: 26 callbacks suppressed [ 2419.406290][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2419.417988][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2419.423927][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2419.429754][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2419.496329][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2419.502307][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2419.966302][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2419.972221][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2419.978350][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2419.984235][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2425.646291][ C1] net_ratelimit: 26 callbacks suppressed [ 2425.646299][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2425.657904][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2425.663750][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2425.669599][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2425.726316][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2425.732393][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2426.206325][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2426.212221][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2426.218098][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2426.223957][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2431.886290][ C1] net_ratelimit: 26 callbacks suppressed [ 2431.886300][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2431.897801][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2431.903683][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2431.909482][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2431.966300][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2431.972351][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2432.446360][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2432.452185][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2432.458137][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2432.465431][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2438.126296][ C1] net_ratelimit: 26 callbacks suppressed [ 2438.126305][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2438.137802][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2438.143630][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2438.149680][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2438.206328][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2438.212223][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2438.686285][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2438.692115][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2438.697990][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2438.703768][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2444.366297][ C1] net_ratelimit: 26 callbacks suppressed [ 2444.366307][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2444.377794][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2444.383618][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2444.389405][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2444.446303][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2444.453610][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2444.926335][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2444.932296][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2444.944066][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2444.949820][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2450.606307][ C1] net_ratelimit: 26 callbacks suppressed [ 2450.606317][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2450.617846][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2450.623783][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2450.629703][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2450.686313][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2450.692388][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2451.166326][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2451.172156][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2451.178059][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2451.183841][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2456.846300][ C1] net_ratelimit: 26 callbacks suppressed [ 2456.846309][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2456.857894][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2456.863824][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2456.869647][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2456.936335][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2456.942574][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2457.406317][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2457.412129][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2457.418037][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2457.423933][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2463.086302][ C1] net_ratelimit: 26 callbacks suppressed [ 2463.086312][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2463.098016][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2463.103862][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2463.109695][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2463.176309][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2463.182572][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2463.646280][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2463.652467][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2463.658385][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2463.664165][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2469.326304][ C1] net_ratelimit: 26 callbacks suppressed [ 2469.326314][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2469.337894][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2469.343733][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2469.349571][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2469.406333][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2469.412217][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2469.886321][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2469.897592][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2469.903414][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2469.909351][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2475.566279][ C1] net_ratelimit: 26 callbacks suppressed [ 2475.566289][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2475.577866][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2475.583788][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2475.589832][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2475.646275][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2475.652518][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2476.126340][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2476.132171][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2476.137975][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2476.143838][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2481.806334][ C1] net_ratelimit: 26 callbacks suppressed [ 2481.806345][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2481.818697][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2481.825554][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2481.832117][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2481.886290][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2481.901877][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2482.366340][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2482.372634][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2482.380109][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2482.387011][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2488.046310][ C1] net_ratelimit: 26 callbacks suppressed [ 2488.046320][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2488.059110][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2488.066019][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2488.072826][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2488.126317][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2488.133952][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2488.606298][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2488.612687][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2488.619555][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2488.625865][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2494.286290][ C1] net_ratelimit: 26 callbacks suppressed [ 2494.286299][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2494.297827][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2494.303714][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2494.309570][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2494.366317][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2494.372225][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2494.846319][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2494.852122][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2494.857991][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2494.863828][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2500.526279][ C1] net_ratelimit: 26 callbacks suppressed [ 2500.526289][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2500.537780][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2500.543617][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2500.549421][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2500.606282][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2500.612192][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2501.086317][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2501.092125][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2501.098014][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2501.103779][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2506.766321][ C1] net_ratelimit: 26 callbacks suppressed [ 2506.766330][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2506.778111][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2506.783959][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2506.789824][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2506.846310][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2506.852370][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2507.326308][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2507.332134][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2507.338016][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2507.343780][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2513.006284][ C1] net_ratelimit: 26 callbacks suppressed [ 2513.006294][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2513.017790][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2513.023723][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2513.029557][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2513.086288][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2513.092166][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2513.566280][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2513.572172][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2513.578139][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2513.583899][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2519.246292][ C1] net_ratelimit: 26 callbacks suppressed [ 2519.246302][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2519.257858][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2519.263965][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2519.269884][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2519.326357][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2519.332226][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2519.806317][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2519.812344][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2519.818214][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2519.824005][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2525.486272][ C1] net_ratelimit: 26 callbacks suppressed [ 2525.486282][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2525.497792][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2525.503634][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2525.509466][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2525.566309][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2525.572307][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2526.046280][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2526.052257][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2526.058119][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2526.063915][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2531.726280][ C1] net_ratelimit: 26 callbacks suppressed [ 2531.726290][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2531.737793][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2531.743625][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2531.749427][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2531.816324][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2531.822297][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2532.286301][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2532.292115][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2532.297990][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2532.303779][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2537.966278][ C1] net_ratelimit: 26 callbacks suppressed [ 2537.966288][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2537.977808][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2537.983638][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2537.989497][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2538.056309][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2538.062309][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2538.526269][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2538.532078][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2538.538032][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2538.543786][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2544.206314][ C1] net_ratelimit: 26 callbacks suppressed [ 2544.206323][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2544.217841][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2544.223861][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2544.229784][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2544.296351][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2544.302317][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2544.766295][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2544.772099][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2544.777946][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2544.783713][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2550.446294][ C1] net_ratelimit: 26 callbacks suppressed [ 2550.446303][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2550.458024][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2550.464884][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2550.470803][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2550.526310][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2550.532304][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2551.006305][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2551.012129][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2551.018086][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2551.023856][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2556.686271][ C1] net_ratelimit: 26 callbacks suppressed [ 2556.686281][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2556.697854][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2556.703690][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2556.709524][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2556.776305][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2556.782194][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2557.246303][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2557.252124][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2557.258170][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2557.263931][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2562.926297][ C1] net_ratelimit: 26 callbacks suppressed [ 2562.926307][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2562.937920][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2562.943750][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2562.949748][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2563.006283][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2563.012175][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2563.486295][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2563.492104][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2563.497981][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2563.503750][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2569.166305][ C1] net_ratelimit: 26 callbacks suppressed [ 2569.166314][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2569.178017][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2569.183866][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2569.189670][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2569.246402][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2569.252310][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2569.726328][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2569.732138][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2569.738029][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2569.743812][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2575.406348][ C1] net_ratelimit: 26 callbacks suppressed [ 2575.406357][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2575.417869][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2575.423705][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2575.429540][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2575.486292][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2575.492188][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2575.966296][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2575.972121][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2575.978017][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2575.983975][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2581.646295][ C1] net_ratelimit: 26 callbacks suppressed [ 2581.646305][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2581.657800][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2581.663726][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2581.669569][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2581.726314][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2581.732213][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2582.206351][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2582.212485][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2582.218517][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2582.224338][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2585.646544][ T1042] INFO: task syz-executor.0:7332 blocked for more than 143 seconds. [ 2585.654569][ T1042] Not tainted 5.1.0-rc5+ #71 [ 2585.666884][ T1042] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 2585.675575][ T1042] syz-executor.0 D28384 7332 20135 0x00000004 [ 2585.688171][ T1042] Call Trace: [ 2585.691550][ T1042] __schedule+0x813/0x1cc0 [ 2585.696147][ T1042] ? __mutex_lock+0x721/0x1310 [ 2585.705606][ T1042] ? __sched_text_start+0x8/0x8 [ 2585.713147][ T1042] schedule+0x92/0x180 [ 2585.730615][ T1042] schedule_preempt_disabled+0x13/0x20 [ 2585.736101][ T1042] __mutex_lock+0x726/0x1310 [ 2585.744972][ T1042] ? vhost_net_stop_vq+0x2d/0x120 [ 2585.752274][ T1042] ? mutex_trylock+0x1e0/0x1e0 [ 2585.761189][ T1042] ? kasan_check_write+0x14/0x20 [ 2585.766161][ T1042] ? __mutex_unlock_slowpath+0xf8/0x6b0 [ 2585.774021][ T1042] ? __lock_acquire+0x548/0x3fb0 [ 2585.783165][ T1042] ? wait_for_completion+0x440/0x440 [ 2585.790761][ T1042] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 2585.801228][ T1042] mutex_lock_nested+0x16/0x20 [ 2585.806015][ T1042] ? mutex_lock_nested+0x16/0x20 [ 2585.813810][ T1042] vhost_net_stop_vq+0x2d/0x120 [ 2585.822947][ T1042] ? handle_rx_kick+0x50/0x50 [ 2585.830080][ T1042] vhost_net_release+0x5d/0x260 [ 2585.834957][ T1042] __fput+0x2e5/0x8d0 [ 2585.843168][ T1042] ____fput+0x16/0x20 [ 2585.849431][ T1042] task_work_run+0x14a/0x1c0 [ 2585.854071][ T1042] exit_to_usermode_loop+0x273/0x2c0 [ 2585.863568][ T1042] do_syscall_64+0x52d/0x610 [ 2585.870532][ T1042] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 2585.880610][ T1042] RIP: 0033:0x4129e1 [ 2585.884528][ T1042] Code: bb c8 00 00 00 ff 15 1e 6e 24 00 85 c0 89 c5 0f 85 7e fc ff ff e9 32 ff ff ff 66 66 66 66 66 66 2e 0f 1f 84 00 00 00 00 00 48 <89> 5c 24 d0 4c 89 6c 24 e8 48 89 d3 48 89 6c 24 d8 4c 89 64 24 e0 [ 2585.911698][ T1042] RSP: 002b:00007ffeaa41a240 EFLAGS: 00000293 ORIG_RAX: 0000000000000003 [ 2585.920606][ T1042] RAX: 0000000000000000 RBX: 0000000000000006 RCX: 00000000004129e1 [ 2585.934783][ T1042] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000005 [ 2585.943160][ T1042] RBP: 0000000000741640 R08: 00000000f1f43889 R09: 0000000000240ec8 [ 2585.957155][ T1042] R10: 00007ffeaa41a310 R11: 0000000000000293 R12: 0000000000000001 [ 2585.965143][ T1042] R13: 0000000000240ef5 R14: 0000000000240f22 R15: 000000000073bf0c [ 2585.981344][ T1042] [ 2585.981344][ T1042] Showing all locks held in the system: [ 2585.990455][ T1042] 1 lock held by khungtaskd/1042: [ 2585.995754][ T1042] #0: 000000009525aae3 (rcu_read_lock){....}, at: debug_show_all_locks+0x5f/0x27e [ 2586.011298][ T1042] 1 lock held by rsyslogd/8169: [ 2586.016566][ T1042] #0: 000000005706e2cc (&f->f_pos_lock){+.+.}, at: __fdget_pos+0xee/0x110 [ 2586.025216][ T1042] 2 locks held by getty/8313: [ 2586.036263][ T1042] #0: 000000000109270b (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 [ 2586.045440][ T1042] #1: 00000000d6213666 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1b70 [ 2586.061532][ T1042] 2 locks held by getty/8314: [ 2586.066590][ T1042] #0: 000000008160f5d4 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 [ 2586.075662][ T1042] #1: 0000000056ced412 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1b70 [ 2586.091523][ T1042] 2 locks held by getty/8315: [ 2586.096616][ T1042] #0: 00000000ca04bc72 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 [ 2586.105875][ T1042] #1: 0000000022c557d8 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1b70 [ 2586.121827][ T1042] 2 locks held by getty/8316: [ 2586.128747][ T1042] #0: 0000000033d2eda0 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 [ 2586.143817][ T1042] #1: 00000000149eb7ea (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1b70 [ 2586.153801][ T1042] 2 locks held by getty/8317: [ 2586.164397][ T1042] #0: 000000003184e9db (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 [ 2586.173905][ T1042] #1: 00000000768d1f44 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1b70 [ 2586.189489][ T1042] 2 locks held by getty/8318: [ 2586.194173][ T1042] #0: 00000000a3589043 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 [ 2586.205559][ T1042] #1: 000000003834bbf5 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1b70 [ 2586.222025][ T1042] 2 locks held by getty/8319: [ 2586.227086][ T1042] #0: 0000000018ab30a2 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 [ 2586.242628][ T1042] #1: 0000000034a738a9 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1b70 [ 2586.252804][ T1042] 1 lock held by syz-executor.0/7332: [ 2586.264223][ T1042] #0: 000000008f2478e1 (&vq->mutex){+.+.}, at: vhost_net_stop_vq+0x2d/0x120 [ 2586.273555][ T1042] 1 lock held by vhost-7336/7337: [ 2586.284699][ T1042] [ 2586.287409][ T1042] ============================================= [ 2586.287409][ T1042] [ 2586.295855][ T1042] NMI backtrace for cpu 1 [ 2586.300326][ T1042] CPU: 1 PID: 1042 Comm: khungtaskd Not tainted 5.1.0-rc5+ #71 [ 2586.307869][ T1042] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2586.318032][ T1042] Call Trace: [ 2586.321339][ T1042] dump_stack+0x172/0x1f0 [ 2586.325688][ T1042] nmi_cpu_backtrace.cold+0x63/0xa4 [ 2586.331956][ T1042] ? lapic_can_unplug_cpu.cold+0x38/0x38 [ 2586.337615][ T1042] nmi_trigger_cpumask_backtrace+0x1be/0x236 [ 2586.343620][ T1042] arch_trigger_cpumask_backtrace+0x14/0x20 [ 2586.349532][ T1042] watchdog+0x9b7/0xec0 [ 2586.353728][ T1042] kthread+0x357/0x430 [ 2586.357808][ T1042] ? reset_hung_task_detector+0x30/0x30 [ 2586.363454][ T1042] ? kthread_cancel_delayed_work_sync+0x20/0x20 [ 2586.369702][ T1042] ret_from_fork+0x3a/0x50 [ 2586.374613][ T1042] Sending NMI from CPU 1 to CPUs 0: [ 2586.380509][ C0] NMI backtrace for cpu 0 [ 2586.380516][ C0] CPU: 0 PID: 7337 Comm: vhost-7336 Not tainted 5.1.0-rc5+ #71 [ 2586.380523][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2586.380527][ C0] RIP: 0010:__sanitizer_cov_trace_pc+0x8/0x50 [ 2586.380539][ C0] Code: f4 ff ff ff e8 cd 5d ea ff 48 c7 05 9e 6e ec 08 00 00 00 00 e9 a4 e9 ff ff 90 90 90 90 90 90 90 90 90 55 48 89 e5 48 8b 75 08 <65> 48 8b 04 25 00 ee 01 00 65 8b 15 c8 60 91 7e 81 e2 00 01 1f 00 [ 2586.380543][ C0] RSP: 0018:ffff888052e7fa98 EFLAGS: 00000202 [ 2586.380551][ C0] RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff8544e841 [ 2586.380556][ C0] RDX: 0000000000000000 RSI: ffffffff8544e5ac RDI: 0000000000000006 [ 2586.380561][ C0] RBP: ffff888052e7fa98 R08: ffff888052b76440 R09: ffffed100a120267 [ 2586.380567][ C0] R10: ffff888052e7fb68 R11: ffff888050901337 R12: 0000000000000000 [ 2586.380572][ C0] R13: 0000000000000000 R14: 0000000000000010 R15: dffffc0000000000 [ 2586.380577][ C0] FS: 0000000000000000(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000 [ 2586.380582][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 2586.380587][ C0] CR2: ffffffffff600400 CR3: 00000000a61dc000 CR4: 00000000001426f0 [ 2586.380593][ C0] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 2586.380598][ C0] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 2586.380600][ C0] Call Trace: [ 2586.380604][ C0] iotlb_access_ok+0x18c/0x540 [ 2586.380608][ C0] vq_iotlb_prefetch+0x114/0x230 [ 2586.380611][ C0] handle_rx+0x149/0x1900 [ 2586.380615][ C0] ? finish_task_switch+0x146/0x780 [ 2586.380618][ C0] ? find_held_lock+0x35/0x130 [ 2586.380622][ C0] ? finish_task_switch+0x146/0x780 [ 2586.380626][ C0] ? _raw_spin_unlock_irq+0x28/0x90 [ 2586.380630][ C0] ? finish_task_switch+0x146/0x780 [ 2586.380634][ C0] ? _raw_spin_unlock_irq+0x28/0x90 [ 2586.380637][ C0] ? lockdep_hardirqs_on+0x418/0x5d0 [ 2586.380641][ C0] ? vhost_net_open+0x8e0/0x8e0 [ 2586.380645][ C0] ? trace_hardirqs_on+0x67/0x230 [ 2586.380648][ C0] ? enable_cpucache.cold+0x14/0x24 [ 2586.380652][ C0] ? _raw_spin_unlock_irq+0x5e/0x90 [ 2586.380656][ C0] ? smpboot_thread_fn+0x6c0/0xa40 [ 2586.380660][ C0] ? __switch_to_asm+0x34/0x70 [ 2586.380663][ C0] ? __switch_to_asm+0x40/0x70 [ 2586.380667][ C0] ? __schedule+0x81b/0x1cc0 [ 2586.380671][ C0] ? _raw_spin_unlock_irqrestore+0xa4/0xe0 [ 2586.380674][ C0] handle_rx_net+0x19/0x20 [ 2586.380677][ C0] vhost_worker+0x2a2/0x4a0 [ 2586.380681][ C0] ? vhost_flush_work+0x20/0x20 [ 2586.380685][ C0] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 2586.380689][ C0] ? __kthread_parkme+0xfb/0x1b0 [ 2586.380692][ C0] kthread+0x357/0x430 [ 2586.380696][ C0] ? vhost_flush_work+0x20/0x20 [ 2586.380700][ C0] ? kthread_cancel_delayed_work_sync+0x20/0x20 [ 2586.380703][ C0] ret_from_fork+0x3a/0x50 [ 2586.389789][ T1042] Kernel panic - not syncing: hung_task: blocked tasks [ 2586.671236][ T1042] CPU: 1 PID: 1042 Comm: khungtaskd Not tainted 5.1.0-rc5+ #71 [ 2586.678774][ T1042] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2586.688830][ T1042] Call Trace: [ 2586.693662][ T1042] dump_stack+0x172/0x1f0 [ 2586.698123][ T1042] panic+0x2cb/0x65c [ 2586.702032][ T1042] ? __warn_printk+0xf3/0xf3 [ 2586.706643][ T1042] ? lapic_can_unplug_cpu.cold+0x38/0x38 [ 2586.712297][ T1042] ? ___preempt_schedule+0x16/0x18 [ 2586.717415][ T1042] ? nmi_trigger_cpumask_backtrace+0x19e/0x236 [ 2586.723585][ T1042] ? nmi_trigger_cpumask_backtrace+0x1fa/0x236 [ 2586.729736][ T1042] ? nmi_trigger_cpumask_backtrace+0x204/0x236 [ 2586.735978][ T1042] ? nmi_trigger_cpumask_backtrace+0x19e/0x236 [ 2586.742159][ T1042] watchdog+0x9c8/0xec0 [ 2586.746329][ T1042] kthread+0x357/0x430 [ 2586.750404][ T1042] ? reset_hung_task_detector+0x30/0x30 [ 2586.755951][ T1042] ? kthread_cancel_delayed_work_sync+0x20/0x20 [ 2586.762377][ T1042] ret_from_fork+0x3a/0x50 [ 2586.768392][ T1042] Kernel Offset: disabled [ 2586.772784][ T1042] Rebooting in 86400 seconds..