0b826b4020013bde99fb82e75988790c0c7cd23154b625e0b603924d92fdc3d6d438384cd00bf2bc360c3dd0c2baf5a2d97ef42317049084b9f9217e185beeefa94e0dd67ea894a8c4033f6b84170b2a9a15949719535b6a675fea1e807e955e0ab25cd3a50e4705d14703a3b89f5b5126a5c74245c42067f901a2554e690a98321d7ddaac7eb6a8ef10a1678911199dfbaa98b54047cc8f263161e0897bf8a43cced81b893a7ceee05a44b32fc09ca0920b6bc372f7a92c0d93b8a2e3fc5574f023a5919cc258e8c603b168b8c47b06ac805e2fea859cf6843d4f9b2444914675ca5cf87289e7d53e98920c8d4b975dd679bf5aa80e5508cc1d446f44db05b6d498bdd3244cc2686bdee8fca5c10de2ce0a3b3aa98f3daf362898ed619b049dd3392e5fe3d3aa071b2c07b7705036b75fb3f19e4869a91581cc3e5f9a9f72bfbec1e7a5915012b73e1e437d69fdb6c5afae4f868cbb15012427ec1c2cbd031acb5ab5bf656e050de28e59c37ff24778a7ccd792b4230732342a5a78d6a25cd4badcd6b2e3043352641dda4d1b1789e8a9988d5eecb8de6b46f840f8d63e8f9f8951a94cb46603e493e4462f4f3b1e6a0fb4123e76a9dad7f565e320e2171b02fbea861b6a5a1a3d855e94595f5dd2954b8bfae552ce183ab739e3d79124d4fa7bcf1af62b51980293ebb644425e005a72a626f592f526032a9cc55eef633869a942d19626d880b300d4849ecedb97499d3109b39e7715f7524b5344cea0ee49c54a52e2b479ac0f76ea10be9075edb9203c3379b23690e02632b13b1fce592cf07e6cf32afc4c5c4a4beb4fd2ea3e762f118ab9b4062381075b26c972107dc2481aef6f88c89aaefca70e46a5a6c90f979d8b09758a4fbb1175dcebc042c81cb1e018a79ea6df3e3f72fb1d32cb443652af00eeb77388ed4c869cf3a90a063337b66e0c078061a26f8564c50fe26929b51ee8c29f0fd06a437e02c7aee499291d6c88b84dbeafab1ef8089bc03e6942a7c22dcbe08bc1133e27b3e3c369f504b2c866a6630977074b58a16de9aac2d0a513855b3ef7e1bf34f4cc3fbf3a033c284bc2af300ee4065e6e50f41f8c04cb751405448dd0048d46b876689a2350886c42c2a676f75fdcfb04b40c094aa79aca24793d68516f314cc686340321bb62847c34a603990cce78b83f3e87b62b2fa5afd815028005197a8fbb2f2ad8a0130eede4af06766e8e5ff058cb8a7ff24ccc845498fec577d0d7949470e1a9439d49c5fc6fdd20916ae8192c4c3cf6f928d0a27e611047bb600a7dd195bca58b03f73955913ec92ac70b900405f05fcfb5e2863dfbc71d8285ca5ca2908212fc34846add4e31a41db3f99d4182baf65d40f5f4fe3cdb54f0e3d67970df3d1c12241e7e7510d013dd26311975cffa4c529f9c4026525f4275bd008b5078ab784a4c214e6039c142db74a37b241c7adea513f13b8939590ae5d96c428f320c3a8f00b6fc30709ea70e8aebdb12d5c66db89b13672715758e311716dedc4530dd442269e51ba48f0153021d030ac993037c2e09aa72c79c299d376b3d172fa2c020d5717745ffed823305edff2d890bc1223d4418a083261c6ec1dab235266c78c9b8961e660911abd5eebbe75325e5ce6363d97d3eafa66e00b89d99554c1b9523eaa73d96a95d5ca406acf5cda480fb1bba1482f30a98624a3223325977166e2117d0d1f6c5c361cc7e2cd8a248364c2193d20f7453d881602f28d58902c482130e210e9b9ce2bb923055d296a3ab825265d41f6c2c8459012aadce0c1ed900808a550b4c2ed3c1e5e4436451605a14a2ff6b0a11ff4892ac1ff3a643d3001307c27f79f3d6f708b604d274de4f70767d37c2e3c710fb5fbb4db29fbed53fbc716b63790d8b1eec967c70b84cc5f0f3aeea36ee40599c70c088f7e942ca049740a47acb5aa2d58030fba5bb3237bba78b96ea77bcd3d0f21079bd6467c8ad5c4a8f8006be167a86f969c58fbf3e71131393dd0f5ccf5a81dc22b4421c5647a131e7e00e234248b23c7871dcd8dc0247c5c9998052982962751f956725f77c200e2aa8f831fa8006f1a9237bfee3f608baee9b256af48b3b32a313c14984f27ae96b59cf7f52736aec48485522c6f9beabe3b09f70abe49e1c9cae2667534836854a9f29b1abf5af210cbab1d3fd7da9b662109307134b5546af41e6f4d3735749266a495843a46645a5bd3528fdc95e54fdb67eb5cf2ae8eb8d7e43541c6b839a9cb537f49824d986ed66276eb922925b0dab8acc6dce94aa9608c030f73e3b3fd0389628029b78e463031c05bda9a9aa31df0304b3adbb5a9c3e34ee3e714aa742921ae75a7adf7cfc55cf3a2d3566f75df6a81b33a5ac9d0f48a2d4ef1cb6367d78f8b4ebd0ae84f925be0bb05ac3cf3b9253d5c06ce5e9a8b6890b7b9d231c3641df803f1b5c67631ec3f130b99f5e5242487c5716eec7cb5c58a26a5cc0c1500d022f7ba06029ed8a66e62e5355dec3e8987e25c0732389e29ea13d5c1da853204748cd0888a4c8927bcbe84e64f19acc9233490d40e1443f1328e96b9fc087340758cb7517d47388e32e2b1f94eb1b36de9c31c404956e7b4637ed7fdc6c750b521b988abd18415f15e6ff9ebee96ebb226479f22503", &(0x7f0000000000)=""/115}, 0x18) fcntl$getownex(r1, 0x10, &(0x7f00000000c0)={0x0, 0x0}) syz_open_procfs(r2, &(0x7f0000000100)='fdinfo/3\x00') 14:35:39 executing program 4: r0 = syz_open_dev$sndseq(&(0x7f0000042000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = syz_open_dev$admmidi(&(0x7f0000000080)='/dev/admmidi#\x00', 0x30, 0x22c02) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000100)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000001c0)={&(0x7f00000000c0), 0xc, &(0x7f0000000180)={&(0x7f0000000200)={0x34, r2, 0x0, 0x70bd27, 0x25dfdbfc, {}, [@TIPC_NLA_SOCK={0x20, 0x2, [@TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0xffffffffffffff9d}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x9}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x3}]}]}, 0x34}}, 0x8000) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r0, 0xc058534b, &(0x7f0000000000)) [ 2746.433619] binder: 3345:3347 unknown command 0 [ 2746.438348] binder: 3343:3344 transaction failed 29201/-22, size 0-0 line 2887 [ 2746.446125] binder: 3343:3348 got transaction to context manager from process owning it [ 2746.465746] binder: 3345:3347 ioctl c0306201 20000600 returned -22 14:35:39 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x04\x00'}}}}, 0x68}}, 0x0) [ 2746.538172] binder: 3343:3348 transaction failed 29201/-22, size 0-0 line 2887 14:35:39 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='mounts\x00') sendfile(r0, r0, &(0x7f0000000180)=0x74000000, 0x5) 14:35:39 executing program 2: syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/net\x00') syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/net\x00') 14:35:39 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40046307, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 2746.615877] binder_alloc: binder_alloc_mmap_handler: 3343 20001000-20004000 already mapped failed -16 [ 2746.660943] binder: BINDER_SET_CONTEXT_MGR already set [ 2746.673546] binder: 3343:3344 ioctl 40046207 0 returned -16 [ 2746.688149] binder: 3367:3368 unknown command 0 [ 2746.692550] binder: 3343:3348 transaction failed 29189/-3, size 0-0 line 3035 [ 2746.693067] binder: 3367:3368 ioctl c0306201 20000600 returned -22 14:35:39 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\x9e\x00'}}}}, 0x68}}, 0x0) [ 2746.709115] binder_release_work: 19 callbacks suppressed [ 2746.709122] binder: undelivered TRANSACTION_ERROR: 29201 [ 2746.728891] binder: undelivered TRANSACTION_ERROR: 29201 14:35:39 executing program 3: r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x8041, 0x0) ioctl$DRM_IOCTL_RM_MAP(r0, 0x4028641b, &(0x7f0000000040)={&(0x7f0000ffb000/0x4000)=nil, 0x4000000000000007, 0x7, 0x26, &(0x7f0000ffd000/0x2000)=nil, 0xe0b}) r1 = getpid() syz_open_dev$mice(&(0x7f0000000140)='/dev/input/mice\x00', 0x0, 0x420200) r2 = syz_open_procfs(r1, &(0x7f0000000080)='fd\x00\x80\x06\xda\x84\x0f\x18\xaf\xc8.k\x02\xf0\r\xa5\xd71\x80\xf2)\xd6\xb0\x1d\xbc\x06$\xc1U)\x14[\xf5\xb4\x9f\x01\x02\x8cK\f\a\xa8u\xcb\xefV\xee\xb15s\xc40\xd4\x1c\xc3R\x18\xbc\x86\x9a\xfb\xb7TV\xb2(`\xbb\xf8\xa7\x7fYmv^D\xf8nW;\xee\x82\xa37\x15\x18\x01\x8e\xbc\xb7\x83g\xed\x90\xdf\xc0\xa9\xb0\xd4\xdc+#\xb5&0\xc5AT\x1c\x90I\xc5\xd9\xbe,\xec\x04\xf9f9\xb2t8\x95+\xab\xcc\xd7\xab\x98') sendfile(r2, r2, &(0x7f0000000180)=0x74000000, 0x5) [ 2746.754192] binder: undelivered TRANSACTION_ERROR: 29189 14:35:39 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="0063a36aad6f43393b4040"], 0x0, 0x0, 0x0}) ioctl$FIDEDUPERANGE(r1, 0xc0189436, &(0x7f0000000100)={0x200200, 0x0, 0x2, 0x0, 0x0, [{r1, 0x0, 0x9}, {r0, 0x0, 0xfffffffffffff801}]}) r2 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vfio/vfio\x00', 0x10000, 0x0) epoll_ctl$EPOLL_CTL_MOD(r2, 0x3, r1, &(0x7f0000000180)={0x50002000}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:35:39 executing program 2: syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/net\x00') syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/net\x00') [ 2746.812320] binder: 3367:3368 unknown command 0 14:35:39 executing program 3: gettid() r0 = openat(0xffffffffffffffff, &(0x7f00000001c0)='./file0\x00', 0x109040, 0x40) ioctl$TIOCGSID(r0, 0x5429, &(0x7f0000000240)) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={0x0, 0xffffffffffffff9c, 0x0, 0x2, &(0x7f0000000100)='}\x00', 0xffffffffffffffff}, 0x30) r2 = syz_open_procfs(r1, &(0x7f0000000200)='mounts\x00') fcntl$setstatus(r2, 0x4, 0x800) sendfile(r2, r2, &(0x7f0000000180)=0x74000000, 0x5) setsockopt$IP_VS_SO_SET_EDITDEST(r2, 0x0, 0x489, &(0x7f0000000000)={{0x7c, @loopback, 0x4e20, 0x0, 'wrr\x00', 0x36, 0x7, 0x79}, {@broadcast, 0x4e20, 0x0, 0xfffffffffffffff8, 0xfffffffffffffffc, 0x5}}, 0x44) [ 2746.835123] binder: 3367:3368 ioctl c0306201 20000600 returned -22 [ 2746.881677] binder: 3384:3385 unknown command 1789092608 14:35:39 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000000000000, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:35:39 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03@\x00'}}}}, 0x68}}, 0x0) 14:35:39 executing program 4: r0 = syz_open_dev$sndseq(&(0x7f0000042000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r0, 0xc058534b, &(0x7f0000000000)) r1 = getpgid(0xffffffffffffffff) ptrace$PTRACE_SECCOMP_GET_FILTER(0x420c, r1, 0x9, &(0x7f0000000080)=""/142) 14:35:39 executing program 2: syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/net\x00') syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/net\x00') [ 2746.947472] binder: 3384:3385 ioctl c0306201 20000000 returned -22 [ 2747.015448] binder: 3394:3395 unknown command 0 14:35:39 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='mounts\x00') syz_open_dev$sndctrl(&(0x7f0000000000)='/dev/snd/controlC#\x00', 0x1, 0x2040) sendfile(r0, r0, &(0x7f0000000180)=0x74000000, 0x5) syz_open_dev$dmmidi(&(0x7f0000000040)='/dev/dmmidi#\x00', 0x2, 0x10000) openat$cgroup(r0, &(0x7f0000000080)='syz1\x00', 0x200002, 0x0) [ 2747.037318] binder_alloc: binder_alloc_mmap_handler: 3384 20001000-20004000 already mapped failed -16 [ 2747.055055] binder: 3394:3395 ioctl c0306201 20000600 returned -22 14:35:40 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xf0\x00'}}}}, 0x68}}, 0x0) [ 2747.088324] binder: 3384:3389 unknown command 1789092608 14:35:40 executing program 2: syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/net\x00') syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/net\xff') 14:35:40 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60000000, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 2747.132469] binder: BINDER_SET_CONTEXT_MGR already set [ 2747.150182] binder: 3384:3389 ioctl c0306201 20000000 returned -22 [ 2747.158203] binder: 3384:3402 ioctl 40046207 0 returned -16 14:35:40 executing program 3: r0 = syz_open_dev$dmmidi(&(0x7f0000000040)='/dev/dmmidi#\x00', 0xa894, 0x10000) ioctl$TIOCLINUX4(r0, 0x541c, &(0x7f0000000080)) r1 = syz_open_procfs(0x0, &(0x7f00000001c0)='mounts\x00') sendfile(r1, r1, &(0x7f0000000000)=0x74000000, 0x5) [ 2747.197947] binder: 3384:3408 transaction failed 29189/-3, size 0-0 line 3035 [ 2747.209089] binder: 3411:3412 unknown command 0 [ 2747.226024] binder: 3411:3412 ioctl c0306201 20000600 returned -22 [ 2747.241103] binder: release 3384:3389 transaction 8901 out, still active [ 2747.253795] binder_release_work: 2 callbacks suppressed [ 2747.253801] binder: undelivered TRANSACTION_COMPLETE 14:35:40 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) fcntl$addseals(r0, 0x409, 0x1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB='\x00c@@'], 0x20f, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x1fcf4d8c2268de0d, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xfffffffffffffd7b, 0x0, 0x0}) 14:35:40 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0e\x00'}}}}, 0x68}}, 0x0) 14:35:40 executing program 2: syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/net\x00') syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/net\x00') 14:35:40 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3630840, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:35:40 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='mounts\x00') sendfile(r0, r0, &(0x7f0000000180)=0xfffffffffffffffd, 0x5) [ 2747.317223] binder: undelivered TRANSACTION_ERROR: 29189 [ 2747.334224] binder: send failed reply for transaction 8901, target dead 14:35:40 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r0, 0x29, 0x2a, &(0x7f0000000300)={0x3, {{0xa, 0x4e20, 0x1, @local, 0x100000001}}}, 0x88) r1 = syz_open_dev$sndseq(&(0x7f0000000200)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r1, 0xc058534b, &(0x7f0000000000)) r2 = syz_open_dev$swradio(&(0x7f0000000100)='/dev/swradio#\x00', 0x0, 0x2) ioctl$UI_GET_VERSION(r2, 0x8004552d, &(0x7f00000002c0)) ioctl$BLKSECDISCARD(r2, 0x127d, &(0x7f00000001c0)=0x3) getsockopt$inet_sctp6_SCTP_EVENTS(r2, 0x84, 0xb, &(0x7f0000000140), &(0x7f0000000180)=0xb) r3 = fcntl$dupfd(0xffffffffffffffff, 0x0, r1) getsockopt$inet_int(r3, 0x0, 0x21, &(0x7f0000000080), &(0x7f00000000c0)=0x4) getsockopt$inet_sctp_SCTP_RECVNXTINFO(r3, 0x84, 0x21, &(0x7f0000000240), &(0x7f0000000280)=0x4) 14:35:40 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000480)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000000)={0x0, 0x6, 0xfa00, {0x0, 0x0, 0x106}}, 0x20) r2 = syz_open_procfs(0x0, &(0x7f00000001c0)='mounts\x00') sendfile(r2, r2, &(0x7f0000000180)=0x74000000, 0x5) setsockopt$IP6T_SO_SET_ADD_COUNTERS(r2, 0x29, 0x41, &(0x7f0000000040)={'mangle\x00', 0x2, [{}, {}]}, 0x48) ioctl$KVM_GET_IRQCHIP(r2, 0xc208ae62, &(0x7f0000000300)) [ 2747.424901] binder: 3430:3431 got transaction to context manager from process owning it [ 2747.436874] binder: 3429:3433 unknown command 0 [ 2747.441756] binder: 3429:3433 ioctl c0306201 20000600 returned -22 [ 2747.451480] binder: 3430:3431 transaction failed 29201/-22, size 0-0 line 2887 14:35:40 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00`\x00'}}}}, 0x68}}, 0x0) 14:35:40 executing program 2: syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/net\x00') syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/net\xff') [ 2747.490968] binder: 3430:3431 ioctl c0306201 20000080 returned -14 [ 2747.515900] binder: 3430:3435 unknown command 0 [ 2747.552097] binder: 3430:3435 ioctl c0306201 20000600 returned -22 [ 2747.587885] binder_alloc: binder_alloc_mmap_handler: 3430 20001000-20004000 already mapped failed -16 14:35:40 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48000000, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 2747.614281] binder: BINDER_SET_CONTEXT_MGR already set [ 2747.626398] binder: 3430:3431 ioctl 40046207 0 returned -16 [ 2747.642147] binder: 3430:3435 transaction failed 29189/-3, size 0-0 line 3035 [ 2747.642295] binder: 3430:3451 transaction failed 29189/-3, size 0-0 line 3035 14:35:40 executing program 3: ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000000)=0x0) r1 = syz_open_procfs(r0, &(0x7f00000001c0)='\x00\x00\x00\x00\x00\x00\x00') ioctl$VHOST_RESET_OWNER(r1, 0xaf02, 0x0) getsockopt$packet_buf(r1, 0x107, 0x16, &(0x7f0000000040)=""/155, &(0x7f0000000100)=0x9b) sendfile(r1, r1, &(0x7f0000000180)=0x74000000, 0x5) 14:35:40 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xa1\x00'}}}}, 0x68}}, 0x0) [ 2747.663684] binder: 3430:3435 ioctl c0306201 20000080 returned -14 [ 2747.677053] binder: 3453:3454 unknown command 0 [ 2747.707701] binder: 3453:3454 ioctl c0306201 20000600 returned -22 [ 2747.726765] binder: undelivered TRANSACTION_ERROR: 29201 [ 2747.747886] binder: send failed reply for transaction 8905 to 3430:3435 [ 2747.764020] binder: 3430:3451 ioctl c0306201 20000600 returned -14 [ 2747.783894] binder: undelivered TRANSACTION_COMPLETE [ 2747.789242] binder: undelivered TRANSACTION_ERROR: 29189 [ 2747.819246] binder: undelivered TRANSACTION_ERROR: 29189 14:35:40 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r2 = semget$private(0x0, 0x3, 0x8) semctl$GETZCNT(r2, 0x4, 0xf, &(0x7f0000000040)=""/22) 14:35:40 executing program 2: syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/net\x00') syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/net\x00') 14:35:40 executing program 4: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r0, 0xc058534b, &(0x7f0000000000)) 14:35:40 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4630440, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:35:40 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='mounts\x00') sendfile(r0, r0, &(0x7f0000000180)=0x74000000, 0x5) lseek(r0, 0x0, 0x3) 14:35:40 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00'}}}}, 0x68}}, 0x0) [ 2747.842170] binder: undelivered TRANSACTION_ERROR: 29189 [ 2747.917468] binder: 3474:3475 unknown command 0 [ 2747.922320] binder: 3474:3475 ioctl c0306201 20000600 returned -22 14:35:40 executing program 2: syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/net\x00') r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/sco\x00') getsockopt$IP6T_SO_GET_REVISION_TARGET(r0, 0x29, 0x45, &(0x7f0000000080)={'HL\x00'}, &(0x7f0000000100)=0x1e) syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/net\x00') 14:35:40 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0f\x00'}}}}, 0x68}}, 0x0) [ 2747.959323] binder: 3477:3479 got new transaction with bad transaction stack, transaction 8909 has target 3477:0 [ 2747.998023] binder: 3477:3479 transaction failed 29201/-71, size 0-0 line 2946 14:35:40 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='mounts\x00') fsetxattr$trusted_overlay_opaque(r0, &(0x7f0000000040)='trusted.overlay.opaque\x00', &(0x7f0000000080)='y\x00', 0x2, 0x2) sendfile(r0, r0, &(0x7f0000000180)=0x74000000, 0x5) setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r0, 0x10e, 0x8, &(0x7f0000000000)=0x2, 0x4) [ 2748.028508] binder: BINDER_SET_CONTEXT_MGR already set 14:35:41 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6000, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:35:41 executing program 2: openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dlm_plock\x00', 0x401, 0x0) syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/net\x00') syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/net\x00') [ 2748.089541] binder: 3477:3479 ioctl 40046207 0 returned -16 [ 2748.095523] binder: release 3477:3479 transaction 8909 out, still active [ 2748.102677] binder: undelivered TRANSACTION_COMPLETE [ 2748.129021] binder: undelivered TRANSACTION_ERROR: 29201 14:35:41 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$EXT4_IOC_RESIZE_FS(r1, 0x40086610, &(0x7f0000000040)=0x1ff) 14:35:41 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00`\x00'}}}}, 0x68}}, 0x0) 14:35:41 executing program 4: r0 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/mixer\x00', 0xa0000, 0x0) ioctl$sock_inet_SIOCGIFBRDADDR(r0, 0x8919, &(0x7f00000000c0)={'bridge_slave_0\x00', {0x2, 0x4e21, @loopback}}) r1 = syz_open_dev$sndseq(&(0x7f0000042000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r1, 0xc058534b, &(0x7f0000000000)) [ 2748.143007] binder: undelivered TRANSACTION_ERROR: 29189 [ 2748.146606] binder: 3494:3497 unknown command 0 [ 2748.163561] binder: send failed reply for transaction 8909, target dead [ 2748.169866] binder: 3494:3497 ioctl c0306201 20000600 returned -22 14:35:41 executing program 2: syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/net\x00') r0 = syz_open_dev$cec(&(0x7f0000000040)='/dev/cec#\x00', 0x2, 0x2) write$P9_RVERSION(r0, &(0x7f0000000140)=ANY=[@ANYBLOB="1500000065ff800700000008003950323030302e4c16d849240100008000000000901f9f2d61e144a59cf4d6379d04e908e3eae09e627559122c15f5dce9b688c01e0200923dc6c17a5fe6bff457e20fcadb821776774ecaceba4669b20f813ab6f0a2133929efd9c23f97"], 0x15) socket$inet(0x2, 0x803fe, 0x108) write$P9_RLINK(r0, &(0x7f0000000100)={0x7, 0x47, 0x2}, 0x7) syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/net\x00') 14:35:41 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='mounts\x00') sendfile(r0, r0, &(0x7f0000000180)=0x74000002, 0x100000001) ioctl$TIOCGSID(r0, 0x5429, &(0x7f0000000080)) ioctl$sock_bt_cmtp_CMTPCONNDEL(r0, 0x400443c9, &(0x7f0000000040)={{0x1, 0x400, 0x5, 0xa405, 0x80000000, 0x11}}) syz_open_pts(r0, 0x0) 14:35:41 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:35:41 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00'}}}}, 0x68}}, 0x0) [ 2748.285550] binder: 3502:3505 got new transaction with bad transaction stack, transaction 8914 has target 3502:0 14:35:41 executing program 2: truncate(&(0x7f0000000080)='./file0\x00', 0x1) syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/net\x00') syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/net\x00') r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x0, 0x0) ioctl$LOOP_GET_STATUS(r0, 0x4c03, &(0x7f0000000100)) [ 2748.357899] binder: 3513:3515 unknown command 0 [ 2748.362637] binder: 3513:3515 ioctl c0306201 20000600 returned -22 [ 2748.386890] binder: 3502:3519 ioctl 40086610 20000040 returned -22 14:35:41 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xff\x00'}}}}, 0x68}}, 0x0) 14:35:41 executing program 3: syz_open_procfs(0x0, &(0x7f00000001c0)='mounts\x00') [ 2748.431359] binder_alloc_mmap_handler: 1 callbacks suppressed [ 2748.431374] binder_alloc: binder_alloc_mmap_handler: 3502 20001000-20004000 already mapped failed -16 14:35:41 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6c00000000000000, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 2748.479774] binder: BINDER_SET_CONTEXT_MGR already set [ 2748.519882] binder: 3527:3528 unknown command 0 14:35:41 executing program 2: syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/net\x00') pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f00000001c0)=0x115, 0x4) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000240)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_GET(r0, &(0x7f0000000400)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000ec0)=ANY=[@ANYBLOB="5a7a2d589b7127ac19fcd9ae2c0092811857ae59490a3536874d559e3e01bc610c6835d16151ed69daafac7874546fa7ef5de820f1619bb7def0c7abb87208e7cd9eff964c79166348037b405227dd4ff81ee7ea53a9385a44968b8b6dc5b356ad92316c5b639e3de2f9208865a3c9d88e73a840", @ANYRES16=r2, @ANYBLOB="000025bd7000fbdbdf2504000000880001002c000200080001001a00000008000100130000000800020009000000080001000e0000000800020004200000380004001400010002004e24e00000020000000000000000200002000a004e21cd45000000000000000000000000000000000001030000001400020008000300040000000800030002000000260002000800020003000000240009000800020002000000080001000400000008000900040000000800020002010000480007000c000400faffffffffffe96f00d434904129117ebd9effff0c00030000000000000000b808000200660000000800010000d40e00080001001500000008000100070000000c0004000104000000000000"], 0x108}, 0x1, 0x0, 0x0, 0x80}, 0xc010) r3 = getpid() r4 = syz_open_procfs$namespace(r3, &(0x7f0000000100)='ns/uts\x00') getsockopt$inet6_IPV6_IPSEC_POLICY(r1, 0x29, 0x22, &(0x7f0000000440)={{{@in=@remote, @in=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast1}, 0x0, @in=@loopback}}, &(0x7f0000000540)=0xe8) r6 = open(&(0x7f0000000000)='./file0\x00', 0x8e059bff475785fc, 0x100) ioctl$sock_bt_cmtp_CMTPCONNDEL(r6, 0x400443c9, &(0x7f0000000140)={{0x69, 0x3, 0x6, 0x100000000000, 0x5, 0x9}, 0xfffffffffffffc01}) bpf$OBJ_GET_PROG(0x7, &(0x7f0000000080)={&(0x7f0000000040)='./file0\x00', 0x0, 0x8}, 0x10) accept4(r1, &(0x7f0000000280)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @dev}}}, &(0x7f0000000300)=0x80, 0x80800) sendmsg$nl_generic(r6, &(0x7f0000000cc0)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000c80)={&(0x7f00000005c0)={0x694, 0x1a, 0x308, 0x70bd28, 0x25dfdbfb, {0xb}, [@typed={0x8, 0x3c, @uid=r5}, @nested={0x1d4, 0x64, [@typed={0x8, 0x89, @fd=r4}, @generic="0cc9ec535f0834dca527b4d32873c922b4e4adf4bed2aee43313fb6be0909c8102cc1fb497d8e6206954c22b", @generic="8fc69173fe27da60b4b6da56ced7df61ff13de534139707fc3e33ac65f72f1d88380372e1e5e55cabbc6ccfbe046a83c1032c3dacca6910ea4daf3ec8869d7b646016ab49c81fdc0154b5bc193f1a3a318765cfea46a36aa75a177b924816c7b47717e50adc71e01612be1e1a3beb3e6dcb1ba80167e1a56ab36373dd626a698721adc3afe32fce4ffa8fade234ac64ff6ccd9", @typed={0x8, 0x21, @ipv4=@multicast2}, @generic="101ed49d6407e9e35c92865864f04fb59b119a59e732d3dbbe92c17d6ecf222ffce0a979770f6c064a027a14590b5fd4f78fdede6b28c511d4d9da4af2723d4e51e0cc3acae439701a4f3c", @generic="f66a174cabd5eb456ffb73c3d801ae534f2896ea9b95e62b82e7b92464c8f03c46a1700bd37bee8239b6b7e0083fc453837b2b0b4d51ab1faf549b4791f76ee34684dbe1ae5e80887e78ba23f3f215069f0ff2556ef3874d7f664e984458218766373917003e0cb2253f1a126ed630841bf9a87488445655d38e1097988d429a4ab5b16cb2a2ac5f0ed0d54c225538e6cc95bcbade398cea098bfb7bb8ac9521f7b2fe7f1b5f9f08b39de525d8", @typed={0x8, 0xc, @pid=r3}]}, @typed={0xc, 0x36bad291, @u64=0x6}, @nested={0x184, 0x26, [@typed={0xc, 0x0, @str='ns/uts\x00'}, @typed={0x8, 0xf, @uid=r5}, @generic="b2fd954cd7cf97371b2c56f868a51055054c0abae1e2fb9a8f1a8646ad712cf5c3813926db6f1b0b947908c9d5c72d9a317c3eff9cfdc35266b00b670110ebf3eba0a68c72be8b39f0a737d53aa50b28e330416e45ca97570fa690c55b533f5b2c5dee37ee5df6963b90f4218da81e266586b7ec07839c65fac7ffa8733d338c86f3d1ecc5a408647cf8bb53dc8690c65351f4d25eecb58c233932a3e0c00ab4d88b9b181d367e8e09a5ef7db906327c1830d66ea534fff8aef8ffe9d0fb210674b330809930f155a2cd54c5cc93ff7b6d8faba557b3ad5121b1fbccec87b7ac955aa300da4f8925f15b2bd743af3a37ab8a2690c7bd79d2e5468fe18b", @typed={0x8, 0x8d, @str='em1\x00'}, @generic="502b464385736194f1e2483900f45d6f8ff3b297d3621fd132b036a0b4e02ee04408b45542b695ab914b0875228140e43433e433f75359a75d974af68fead229d6fcc7c57af07fe4fcd98ad174729f1fde7c43336d0d43f2c1026e5b5266b1a1c23aceef35efe5"]}, @nested={0x228, 0x29, [@typed={0x8, 0x44, @fd=r4}, @typed={0x8, 0x5, @ipv4=@dev={0xac, 0x14, 0x14, 0xc}}, @generic="eb414233396804e79123693f826ffc7e8d2d23d58d815e14e305078699cbb0742e902d9b3631c5f93ef582216021872107b11e4bebfd1656981c22668d8c052739e8f1fe63038d639d794b968781e27cf938c11c1fe2ab3964632eb9c6332643d226e8b52cd06462ee81932375886f28597bd6d6ca7bd7cc156c062a6a3573e0149f46395b6c97d5dbe3eb04886bd0907f2d90dcb02a53634d9c4c3524f80ddf2a09c1f865c00dc59327e84984466579ab1d30c666f2496ecf02fc2689f95d1251c0171c1706e0c9dc18b075e3c84ded4ff03f8d501cf4a2ffd7de9686bb0716115e", @generic="9735f0015135535c831e8a887e9f9631eee06d9b8b82e9628aeaf36dce3c51182bc75e81b20a241915a40928b5d89942e0f8ca42e462c46be05d336deb24ba101e", @generic="8c242deb1f829c7cb22d9295fe316d6d7c290fa753f273e7acba83c8e4b96a331face8b9de80d786269d7d219c3531445e84ff6f131dfa9a2fb64f25c5d129f26b96aad1f60995e90725e16324d04e32eaa2999828b9efc2896d2b7897d09c98a96c8197f9e11837c84c975b0c6864c1639a989ae30ed06aceb6b6cd0b552ba6fdd683e0af1e9ea6e78393ddac50ee5002008b92d501e19e8233cd356518212f36", @typed={0x4, 0x12}, @generic="a7a3277b9bb00c2022f0c4f1d0d5d0df1ce64adbfebeacbdf04b55b7bab731e68669388f7b71e32fdb37e0277dca40c5617eb12704db7252ca16dce9a039fda19187674d83b24d1a76db079e"]}, @generic="e4a79d935b154d18af9742e7374a00885bb72a0d760a0378c07d6b689c99ab0563f314530d4f0225ffd43d13512bc66a2f55914b54c06b18c859d6e62684c755ad9d076f6b91ab28be0544d183d9b42efaf12f75816b382616a25c13281e0f44b50b02bb1f4ac0a1e0d559298fed69b8ba0ff90d9c211a0128c6b0", @generic="05dd0df9221a7c6008082bead6987944ba8ed5b69db706f2f1c48e9daf64420e3f6fe425751402fe5b5d7559fd490c312e8e3660bd5ee0ac946fba1f0c67fb26e2b81251300ef70b1add9dfdd21a17541e721c1541df58ba28c76eb6550c627c4dde192f0baf9d08268f13f6412929"]}, 0x694}, 0x1, 0x0, 0x0, 0x20008000}, 0x4000000) [ 2748.541532] binder: 3502:3505 ioctl 40046207 0 returned -16 [ 2748.543110] binder: 3527:3528 ioctl c0306201 20000600 returned -22 [ 2748.561469] binder: 3502:3519 ioctl 40086610 20000040 returned -22 [ 2748.592012] binder: release 3502:3505 transaction 8914 out, still active [ 2748.633562] binder: undelivered TRANSACTION_COMPLETE [ 2748.653276] binder: send failed reply for transaction 8914, target dead 14:35:41 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) flistxattr(r0, &(0x7f0000000100)=""/163, 0xa3) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:35:41 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='mounts\x00') sendfile(r0, r0, &(0x7f0000000040)=0x74000000, 0x5) fsetxattr$trusted_overlay_nlink(r0, &(0x7f0000000000)='trusted.overlay.nlink\x00', &(0x7f0000000080)={'L-', 0x4}, 0x28, 0x1) 14:35:41 executing program 4: r0 = syz_open_dev$usbmon(&(0x7f00000000c0)='/dev/usbmon#\x00', 0x9, 0x88000) ioctl$RTC_EPOCH_READ(r0, 0x8008700d, &(0x7f0000000100)) ioctl$SNDRV_RAWMIDI_IOCTL_DRAIN(0xffffffffffffffff, 0x40045731, &(0x7f0000000080)=0x7) syz_open_dev$sndseq(&(0x7f0000000000)='/dev/snd/seq\x00', 0x0, 0x0) getsockopt$inet6_mtu(r0, 0x29, 0x17, &(0x7f00000001c0), &(0x7f0000000200)=0x4) fsetxattr$security_smack_entry(r0, &(0x7f0000000280)='security.S\xd3\xe3\xbe\x7f\v\xcbi\xb8EC\x00\xb5\xc9\x92\xa8\x81L\xb1J\x11\x1b\b\xebAH\xde\xb9\x00\x92\xdb7\xa0\xa3q\xfd\x98P\xcbe\xcd]U\x03\xe3\xad\xf6$\xf3\xb7\x87_\x89\x7f(\xb9g\xe83\x0e\t:u2\xe2\x92\xb0\xd5\xbcx\xa7\xe4\x9d\xa5\x17cv\x05\xf2\x90R\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', &(0x7f0000000180)='\x00', 0x0, 0x2) 14:35:41 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xff\xff\xff\xf0\x00'}}}}, 0x68}}, 0x0) 14:35:41 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x163404000000000, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:35:41 executing program 2: r0 = syz_open_dev$admmidi(&(0x7f0000000000)='/dev/admmidi#\x00', 0x1, 0x105000) getsockopt$inet_sctp_SCTP_I_WANT_MAPPED_V4_ADDR(r0, 0x84, 0xc, &(0x7f0000000140), &(0x7f0000000180)=0x4) syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/net\x00') bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, 0xffffffffffffff9c, 0x0, 0x7, &(0x7f0000000080)='ns/net\x00'}, 0x30) syz_open_procfs$namespace(r1, &(0x7f0000000040)='ns/cgroup\x00') 14:35:41 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='mounts\x00') ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000040)={0xf1, {0x7, 0x3, 0xe296, 0x9, 0x1ff, 0xcad3}}) sendfile(r0, r0, &(0x7f0000000180), 0x40000000000006) bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0xc, 0x4, 0x3, 0xfff, 0x12, r0, 0x7}, 0x2c) [ 2748.746790] binder: 3543:3544 got new transaction with bad transaction stack, transaction 8919 has target 3543:0 [ 2748.779670] binder_alloc: binder_alloc_mmap_handler: 3543 20001000-20004000 already mapped failed -16 [ 2748.824071] binder: 3552:3553 unknown command 0 14:35:41 executing program 2: ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000040)=0x0) syz_open_procfs$namespace(r0, &(0x7f0000000140)='ns/ipc\x00') r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000700)='/dev/ubi_ctrl\x00', 0x101000, 0x0) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffff9c, 0x84, 0x73, &(0x7f0000000740)={0x0, 0x8, 0x30, 0x1ff, 0x1}, &(0x7f0000000780)=0x18) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f00000007c0)={r2, @in6={{0xa, 0x4e24, 0x1, @dev={0xfe, 0x80, [], 0x11}, 0x1cf7}}, 0x1ff, 0x8, 0x7, 0xfffffffffffffffb, 0x19}, &(0x7f0000000880)=0x98) syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/net\x00') syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/net\x00') [ 2748.845581] binder: 3552:3553 ioctl c0306201 20000600 returned -22 [ 2748.856013] binder: BINDER_SET_CONTEXT_MGR already set 14:35:41 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='mounts\x00') setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000000)="0ac23db7725674f6d9feec707149ce56dbea5dad0c064fe24e61eb63792050f2ec725cbc2ce86c003c0be09078f538918b9691f155f0cc22cae3e397e2db6e1aba772aab84478f8d066af832e0519ccc2790f673913a6283a7cf2d085150c7183897948c38bfc944d43b3e1f9ded65d8f7b17d3fc2d872b4ce263eafdf0519f603d5e865e6504d76a6d89c16e7e122cf0dfd7972aa1d6fb8bcd70868a26539ede6711853a5e41e011c6ebaa59eeea4efff5af8a9162ee6c06eca", 0xba) sendfile(r0, r0, &(0x7f0000000180)=0x74000000, 0x5) ioctl$EXT4_IOC_MOVE_EXT(r0, 0xc028660f, &(0x7f0000000100)={0x0, r0, 0x2, 0x2, 0x401, 0x8000}) 14:35:41 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xfc\x00'}}}}, 0x68}}, 0x0) [ 2748.900984] binder: 3543:3549 ioctl 40046207 0 returned -16 [ 2748.902443] binder_alloc_new_buf_locked: 9 callbacks suppressed [ 2748.902472] binder_alloc: 3543: binder_alloc_buf, no vma 14:35:41 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4c00, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 2748.985938] binder: send failed reply for transaction 8919 to 3543:3544 [ 2748.992919] binder: undelivered TRANSACTION_COMPLETE 14:35:41 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0f\x00'}}}}, 0x68}}, 0x0) 14:35:42 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x10000, 0x10d00) ioctl$VHOST_RESET_OWNER(r2, 0xaf02, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) getsockopt$IP_VS_SO_GET_INFO(r2, 0x0, 0x481, &(0x7f0000000180), &(0x7f00000001c0)=0xc) getsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r2, 0x84, 0x22, &(0x7f0000000080)={0x2, 0x4, 0x7fff, 0x10000, 0x0}, &(0x7f0000000100)=0x10) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(r2, 0x84, 0x6c, &(0x7f0000000640)={r3, 0x1000, "e6a360f6da8bd582eefd9900f4c61962e0c8c05bf5368820f304b8d24e1321cb3973a3d3573f9ad357f2f7973c839deef2d872d638913b899049531e69af8c64fda0f5d0c34bf77afef9ae52f5af2c68c8678d4283654828669c1e579173fb99a07358e5b6309b42ec6cc84b59c195684440d5d45bd18f9a9d4467c556f05fae5529c022f71a87adb406e9725e3b70ac405264db82f6bfa96e780018ca73519eb70a9c8637d6686852464c1852d83bbbe072c2912d07a7a275b37d7f387bfe9f8d2c49b3ff1a79644b71f7e410bc78ace35daa793039fdf6a27be6d23c368eb31caec93c4055610dbf6421b9a793946483f5776efbf6a1e5cfeed305186db63654b586a809f7f01c0994152aef8e63cc7ebb4faeb7aa02afedbb1073bb4223c2d4aa5dc1d5540cc444a26a56bc08da2848ae323853765f62efdded83101d8612403ec957b8c59f119333b4018dade8c8649cd7244b486a6075494e6dc1a6624a215fe7361da29a8312f8a94a9baaffbc7fb188b237cb712d03de8f3bdcb990b79920a25a3ce1ad65aa402fb87f5a7b4ed9cf1a1c7845074b62d8a6fee2ddf4e36e7fb2d2bd9922404ac35b79a1b3bedd7374cc4690d4cc191bde961250223c16578b8b5a8bf3314491323f218710697a6490100fbd95c8003cf80f4c01c6054d5b12f15cb40540150cb201b96239295344aec5ca4429f68b233fd61790d3d0b05ec0998232c89f399f759b01547a1040dde7982417a1232f5b9ad3c4fc3eb3208aec2ac913af9d5a0edd3597bf3002608c27884c00622701b853653b876fdad945ca97871b639dba66ff0f40de420fd69abe71003373d2e1de7e85a5c65061cf6bc493b1b021cb585e0e4a4233db094312e1badd6da6c38e88cbcbf75ebc76392f2384e0f2d19ec820fa75cbbf7aa8838f0cf6daeb776a3daffd5f98670cbf79efcea0de686fc00544112b9bad0e46bd4bfcc2363705c189dd681bedec9c4c5e51cb5a83772b16b986e429f0d3e68a80572d5fe62b1b8dce88f9f79511e6bebea325b3082a45427d06266b6e887272459fbfee745373aeaf8d0ccacc2db4d7e05de035fca1ad9148d1705828efcc8fb1232151c68ada6a15ec1df5d37d53199e6c269b983e90056fa1527fe48074ea967d35655b0211a540d6f5b072cd4ee31f0f5564c9a26170e765d90d0cce1cd35ecfbc38937dbc496ca9390427ae9578648c20667af8248fdb76f3a975342a1cdf8abb734b5cb2d0b8136e820585579dddee70a38f31796b0831f32187ff38e5bfe7625cd75651348ea50d7e85e9458ce8c25963afa08a89fe7063ffec4550d42316c7f3eb26d2d0354f937eec421059671c3333dfd9d289d38186b3b698ec59cc0fd97e914ee9591a97151f06a9649d24a0f9879cc8d880370fb7b177f08d35978dbe422b4d3190a555ad254d4b7d56e1c55292ab0d75b4f872e9856b7feb924a552a27c5d16ec6ac266882a94a2be2e63cae7bdcbabc1efb472c3e7ce3e6cd7d2f7d36592e07914267b09f80aa86c245a96f911a604326b1f2d7ae13abf7a127ced420a8f299ec94273bf09de09fcd321e683f6b5b1df5e8e2443b59a2bed5564c25457d1c1c53ea764ab8a5b3e74aa7ccb48487fafa0ddf954906423587b72a0577bda4f2597a235c962ea9f6da122a897fea773bf40c9a8db54e5cc7f91c26a633599722726c687df609c53da71f3fe8a979a40cf12b2e4499d5b2c74c546b49d710a0869c61129e4d7d11730e2689f093b97063edb27a140ce1df8152e72d3097d47213331530356e501983af0724662d9caa9b0e37d5b68149d35c923aa1dd8788c9b1cffe91608ed67208cc49e316afad9ff1e8274d905058568fd5ab39139c95a6f7488ba7f53fc25063a2a571a2e285619e71849769d21e27f31dcc620497e3e58d0ef2b4bebda3dbc783d8fe0803d1c15684e1bd057f64df696f50f0536f2fc946c632e105d718b9adbb5d427de7bd830e228bf43df52e391a9d7ec8dc311087989f3ae3d446bbd49119a7c67f6a405f056340e0fc69a2fcc5ca38e1e7c21268338460b5d492ddfcf2405da9470cae52bbb24ee35c266c3def5987aafa5bf4d557ddaa3f9dc79f5a09652a42dced66421af1a59205c0d47d4a59cd0eec4d6b10c2987c57889292ca250d3aa987944674fd9d318693355b966a57d31deb5919c27d6b438769356d8be3b5f957d51067619c3aa3801714456e5f619958bc9440fc884a02bf62b05702ba2df94c339a395d7f78809a5ea7b6b2de9839322fe40ed3932f16da458e206aa449fe91b49742f15a4107659d442923c759cd2d282fc9a2301d3008258828af0a4c558d9fcf4cea8664c27a0e4454fca07a398cbfb340ec8b9f64f3a5dc76d9bfdce327376e4b71cabf512dbb835967cc3241759b9f1333f8f2f8671ced07829b92fd564a272e6e85286d43fa10eb7fbbc896aace8c8acb6e0e9cc42d14cc1f253a01535e7fe2efd064bd4088a409d4e2c18f2fb99991599b941501293369cb575c84578ed6c4a604ce320a0dd6ef5ac34234e1dde12b69e76905af7d9dfa983d8a97bbc764fe26b4a99a88213fe735d73821432fe6b1edfefe4d41cd9526b97d85ea8aec7604a4ea3ac417cc4490d854a25b29e3080d4c9195a8b609afc13962e5bd9f60cb8faae1ca05cd5b8e617dfcdfebdc183d60f3c059d368f374b732f0103ce3dcd6cfba8b576ac1597edeb884b686692a34764432110bb7b9d094b79e45ecdb6e4415df5d0f37cdc5c40469f68c3ee8be1a53d980bd730feb5e5f20eaa43049796c6169b7dab0fde780cc71f1ec8250c679f17434b70a721a12c9983a180a14918c1099edf903dab95c4ee6bda302de856f067b8e0b48918644789aed8a880f99faf997bcdc75116bcb2f2e96903d6c1aa13ef82b6584079cead3e29a21eb7cee8b33e61b354d61d6e9daeaf2c5349216bb3a55045fe8384fc09af19b017afe309628cbdfa3915201a21370124a93d7d85786c73c66924daa5e0fb5e68f4be2be2a7d0aeac31b3ceb65452b913502a8f97a8e0d1625526e02c91a4533f637c0ed809efd2e63daeb7c38e316938a69f9781dd357048e16cd72b18199e57d02ba046392f5bcb2ab6a5e6f837350d8781bc07d18a80e73ea7c5ce62fa8b2f51df37f010bae1b872211541582267ab8d25979420e9186e8e3d6850f30d7bd477a211f136377d9f63118b76f0f691373a4cac8d2789b3851eca9b72f360dc3a1cb3a4dd1e0d13adf380315dfab45cd2eff23afac2df289b44391ff724ecbc093e78793480fc32098a87e1788698faa31cbb9097857a1f5b8f97b76a2090024f4189311f9aa0ab9c19f70dd59957cb22b313397c1efc460f4a5ba866b6e6bcc97a121ad9cfe8a956f709f2499b8d3f71b7028c3e9936474ef7299d9e5fe83b628f0c90df8a043b6b0ad73ade9fff17d543966a79e6d9dfc7ba5a781a2f1609c7e15556f7dc2bd92c9a5e2110389d53b41a7e6c211b0248a6569b5191fa8e5580d77d9e75027f9731340450bbd632b889ed13630e0f4cc07eef016860b477337b79caf3048fc9ae9f0aa3c5464c7b48d43b1a45695579688e5aeebe94c27adaeff4f130fddb1d5ab701fb26dbb992c9901898955a0aa608eaeef2462740095e9fe78788f1016e5cc39b22a12cbe340b842e4ae0184bd447b2b0bc391e121a4a8b5465d451a11449bf992b3d7c489c7a327d39e0218743915015225b555f482073b3acb2e9158aca0d5061086b69905fb0a03bbc2ec942af01a760d89f77c53f5e3975eb4f6d0af9ac1514982b4d0f048eaba0785474da4a29fe9fc3347da9af3f85369fcd06a4d418dcea74a941304ab3055edadf544ff2424164f4121b9706486246611401c9ae7a6a2541a5f4b391b5ab67153765e3d1ec582420f25039622bf5fbfb6cfde232fe2da6d4e6922dbfea0b014cd03a0012800be1dedd5fdad3290fdb508e98b1449344f0d5a6dbf7785271b10902785c04995ed7b999c644c22b7f5088a614fc6e8b1c04339e59a7a4ebb57f2ba9ea29ccdb010373a42a3a188326404c165fb963bad44c232a04b34174c800e30beb54a9687a24ae30ed24c686f61206fe3e9af194e056704619bc1b1065fe9785b83e260e4670583d5815998e3919604d2afb5c298998e95f3872685c19ca1d70b98c668943cc8eb8cb4f4e5617ecc01305206654210c656c8c48dc5252ceb2beb94cb42e6485412b900df9b4d52038aac80da6e94c43be9faf4b08cd5afe750a5a4908a593f7b3a18e201620c24c469f4ba14eecb382f2c0e1781eb5b25065d246cda9ed58a5b0f40cabe5913f61f918fc032cbcee3d02077ab38efda77c0c7b80d167ab2e9692c02531784fd000360b820f9d389dbf839fcc8eceaf3ee25e97f2d57b5d8c7474f8158d232ea6b883ab7398b8d78ec659b02f631e539d6bb9919fb837ce9982d0e594efa3467608febe19361bbb53a10057d3a6c4ef1f8b7c11943785e097367dc04f784bf2a7feffa8e41501c130f79d16716399c7d91931ac2172be0ce5b2a6fb6972fdccb1ee2bbe95033c0fb47148c7553581bb8ff81e476696708b867c51c4a4bcbc800f05a7c839735a048f7ce0aabbefcea9e0915ef1fd770f4e5a24e33654ee994243464de20543f52dba2c22f0a092aec1c14a90cb7985db4d7c86c7707a90b7a3fc422d6c872ae676d7cd4ef234576eeaf01a415d58ee457e21d24f1d9e810bf13408800e353f4bc1c0604c8783c6e723b6f5379bef53fbe55ccea1d3d93eaab49b2a5f4c7a25d398f4516b1715c5672e2fe388bdbb8618c4b95da3b99af29c2e3eedea4252e44b7cbf6f29bcdd0d4215077f1b771a1ddf6a831d3ad69c95d2343fa831810e02b2a1f4dac4c777f4540171c3a8d9d2a0f002c4a49bb74089e6c018153f8155952d925908ecbbbebaf7c5cda4ea07134e6bb63452b225fc2bcc77dd86e64ce2583b60d206c26b70bfdd227ea68b60066f819084e7ba38c0557df7c350ee79fd499088d733741ba8cd4aa30c50b7077e7bcd38ea38e4ee4feef8b6ae915da5ebdfe9fc49e1e353c946f30a62aef0e6b93b494afc18e8eef03e0c340b38b5195affd791c1d071fe68a74e56ffb902da574dd4efb98401cab799e7a96ffd94734d3e30bf785f9f934bf7f45d15010ca61a14132c3ea55567b2fb66a690290c74b0e832f6f1cb552e6d19e0339a3b697b23ba9f6a13523f5eee455d12153d7a9d86a7567d2a06bd07655b3511169e30346689503f1669c2da449b12fab9f57f1c729b887ed91e64cb1a6eed742bc1b6df499d53c72539ee71ab52016dcecc63034d2ef9cf5734aa85dcb10aec0359a88a747848c2975fc711d3ccb275217e4f6f751820b298120e2b9c6a2d4710f4fd0fecbb56764b8e3eed9e9699fc91380f5c0aaa7b71ba33004a23c1aa78aebcd8b44c6c6b70689ba6881085d6f2100a673a6a034fd8c7ecc3a4cebed7fcd55a2ab2806a4e21b6a506d6dd01e9819d3d9b182e4c7b9f1bec84a26d565bb8f400b90e09187bbd364fd00a24039be0af426d93c0f08aeaf98d9789bf21e656b0e1766563066654d930d8e3bf691b244c1a499eaa7f8c5fda5fe9b325c57914174cc969e1729cb33bdbda8646001fd03b65daaa6a4a1244907170d8afbbc942ee32b32aa29b5031cc8cc7ffbdb68d1c62161409b3951a13364ee6cb8eed6708ecda338d211c997cec821b471baee54a8444daa68d371a4d9d6c174f0637ce3448ca581210651ae56733c95eb5832a355c408"}, &(0x7f0000000140)=0x1008) [ 2749.030223] binder_thread_write: 13 callbacks suppressed [ 2749.030236] binder: 3576:3577 BC_ACQUIRE_DONE u0000000000000000 no match 14:35:42 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='mounts\x00') sendfile(r0, r0, &(0x7f0000000180)=0x74000000, 0x5) getsockopt$inet_sctp6_SCTP_RECVRCVINFO(r0, 0x84, 0x20, &(0x7f0000000000), &(0x7f0000000040)=0x4) [ 2749.110863] binder: 3576:3577 unknown command 0 [ 2749.143954] binder: 3576:3577 ioctl c0306201 20000600 returned -22 [ 2749.159124] binder: 3586:3587 got new transaction with bad transaction stack, transaction 8923 has target 3586:0 [ 2749.206509] binder_alloc: binder_alloc_mmap_handler: 3586 20001000-20004000 already mapped failed -16 14:35:42 executing program 4: r0 = syz_open_dev$sndseq(&(0x7f0000042000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r0, 0xc058534b, &(0x7f0000000000)) stat(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0}) r2 = getuid() stat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0}) r4 = getuid() fstat(r0, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f00000002c0)={{{@in=@loopback, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@initdev}, 0x0, @in=@dev}}, &(0x7f00000003c0)=0xe8) stat(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0}) stat(&(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0}) r9 = geteuid() fstat(r0, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) lstat(&(0x7f0000000600)='./file0\x00', &(0x7f0000000640)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) getresgid(&(0x7f00000006c0), &(0x7f0000000700)=0x0, &(0x7f0000000740)) getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f0000000780)={0x0, 0x0, 0x0}, &(0x7f0000000c80)=0xc) stat(&(0x7f0000000800)='./file0\x00', &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r16 = getegid() getgroups(0x6, &(0x7f00000008c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0, 0xee00, 0x0]) r18 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000b00)='/dev/qat_adf_ctl\x00', 0x22001, 0x0) r19 = syz_genetlink_get_family_id$fou(&(0x7f0000000b80)='fou\x00') sendmsg$FOU_CMD_GET(r18, &(0x7f0000000c40)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000c00)={&(0x7f0000000e80)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r19, @ANYBLOB="200027bd7008fddbdf2503000000080002000a0000006a21220ea5dd2f54ba16b325894b4a4f9bef4c10f1"], 0x1c}, 0x1, 0x0, 0x0, 0x20008085}, 0x4) r20 = semget(0x2, 0x3, 0x0) getpgid(r13) semop(r20, &(0x7f0000000e40)=[{0x3, 0x6, 0x1800}, {0x3, 0x80000000, 0x1000}], 0x2) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000900)={0x0, 0x0, 0x0}, &(0x7f0000000940)=0xc) getresgid(&(0x7f0000000980)=0x0, &(0x7f00000009c0), &(0x7f0000000a00)) r23 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000a40)='IPVS\x00') sendmsg$IPVS_CMD_DEL_DEST(r18, &(0x7f0000000ac0)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000a80)={&(0x7f0000000d80)=ANY=[@ANYBLOB="a2000002", @ANYRES16=r23, @ANYBLOB="000629bd7000fcdbdf250700000034000100080004004e2200000800020001000000080009005b0000000800080005000000080001000a00000008000b007369700008000400030000001800030014000600fe880000000000000000000000000101080006000400000008000500c7eb00001c00020008000300030000000800050060bf000008000900f7ffffff"], 0x94}, 0x1, 0x0, 0x0, 0x40010}, 0x4000) fsetxattr$system_posix_acl(r0, &(0x7f0000000080)='system.posix_acl_access\x00', &(0x7f0000000cc0)=ANY=[@ANYBLOB="02000000010001000000000002000600", @ANYRES32=r1, @ANYBLOB="dc000000609c5facf8", @ANYRES32=r2, @ANYBLOB="02000000", @ANYRES32=r3, @ANYBLOB="02000400", @ANYRES32=r4, @ANYBLOB="02000400", @ANYRES32=r5, @ANYBLOB="02000700", @ANYRES32=r6, @ANYBLOB="02000100", @ANYRES32=r7, @ANYBLOB="02000400", @ANYRES32=r8, @ANYBLOB="02000100", @ANYRES32=r9, @ANYBLOB="040004000000000008000400", @ANYRES32=r10, @ANYBLOB="08000500", @ANYRES32=r11, @ANYBLOB="08000500", @ANYRES32=r12, @ANYBLOB="08000500", @ANYRES32=r14, @ANYBLOB="08000100", @ANYRES32=r15, @ANYBLOB='\b\x00\x00\x00', @ANYRES32=r16, @ANYBLOB="08000400", @ANYRES32=r17, @ANYBLOB="08000600", @ANYRES32=r21, @ANYBLOB="08000100", @ANYRES32=r22, @ANYBLOB="10000200000000002000050000000000"], 0xb4, 0x3) 14:35:42 executing program 2: r0 = syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/net\x00') getsockopt$inet_sctp_SCTP_MAXSEG(0xffffffffffffffff, 0x84, 0xd, &(0x7f0000000040)=@assoc_value={0x0, 0x8}, &(0x7f0000000080)=0x8) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r0, 0x84, 0x66, &(0x7f0000000100)={r1, 0xffffffff}, &(0x7f0000000140)=0x8) syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/net\x00') 14:35:42 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00'}}}}, 0x68}}, 0x0) 14:35:42 executing program 3: bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='mounts\x00'}, 0x30) r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/nat_icmp_send\x00', 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000080)={0x0}, &(0x7f00000000c0)=0xc) r2 = syz_open_procfs(r1, &(0x7f00000001c0)='mounts\x00') mmap(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x40010, r2, 0x0) sendfile(r2, r2, &(0x7f0000000180)=0x74000000, 0x5) 14:35:42 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x300000000000000, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 2749.252724] binder: BINDER_SET_CONTEXT_MGR already set [ 2749.296966] binder: 3599:3600 BC_ACQUIRE_DONE u0000000000000000 no match [ 2749.318091] binder: 3586:3587 ioctl 40046207 0 returned -16 14:35:42 executing program 2: dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/net\x00') syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/net\x00') [ 2749.343671] binder: 3599:3600 unknown command 0 [ 2749.354775] binder_alloc: 3586: binder_alloc_buf, no vma [ 2749.369869] binder: 3599:3600 ioctl c0306201 20000600 returned -22 14:35:42 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00'}}}}, 0x68}}, 0x0) [ 2749.392759] binder_alloc: 3586: binder_alloc_buf, no vma 14:35:42 executing program 3: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0xb6b0, 0x20000) fsetxattr(r0, &(0x7f0000000040)=@known='trusted.overlay.impure\x00', &(0x7f0000000080)='\x00', 0x1, 0x2) r1 = syz_open_procfs(0x0, &(0x7f00000001c0)='mounts\x00') rt_sigprocmask(0x2, &(0x7f0000000200)={0x9}, &(0x7f0000000240), 0x8) sendfile(r1, r1, &(0x7f0000000180)=0x74000000, 0x8001) ioctl$TIOCNXCL(r1, 0x540d) ioctl$FS_IOC_GETVERSION(r1, 0x80087601, &(0x7f0000000140)) bpf$OBJ_PIN_PROG(0x6, &(0x7f0000000100)={&(0x7f00000000c0)='./file0\x00', r1}, 0x10) [ 2749.418194] binder: 3599:3600 BC_ACQUIRE_DONE u0000000000000000 no match [ 2749.445742] binder: send failed reply for transaction 8923 to 3586:3587 [ 2749.452739] binder: undelivered TRANSACTION_COMPLETE [ 2749.479068] binder: 3599:3600 unknown command 0 14:35:42 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0xffffffffffffffff) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$EXT4_IOC_GROUP_EXTEND(r1, 0x40086607, &(0x7f0000000040)=0x1) dup2(r1, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:35:42 executing program 2: r0 = syz_open_dev$dmmidi(&(0x7f0000000040)='/dev/dmmidi#\x00', 0x4, 0x0) ioctl$KVM_SET_CLOCK(r0, 0x4030ae7b, &(0x7f0000000080)={0x1cc, 0x3}) syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/net\x00') ioctl$TIOCGSID(r0, 0x5429, &(0x7f0000000180)) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(r0, 0xc0145401, &(0x7f0000000000)={0x2, 0x3, 0x9, 0x2, 0x3}) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000240)={0x0, r0, 0x0, 0x1, &(0x7f0000000200)='\x00'}, 0x30) syz_open_procfs$namespace(r1, &(0x7f00000002c0)='ns/uts\x00') 14:35:42 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='mounts\x00') sendfile(r0, r0, &(0x7f0000000180)=0x74000000, 0x5) getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000000)={{{@in6, @in6=@ipv4={[], [], @multicast1}}}, {{}, 0x0, @in=@remote}}, &(0x7f0000000100)=0xe8) [ 2749.515486] binder: 3599:3600 ioctl c0306201 20000600 returned -22 14:35:42 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0e\x00'}}}}, 0x68}}, 0x0) [ 2749.571216] binder: 3619:3620 ioctl 40086607 20000040 returned -22 [ 2749.623651] binder_alloc: binder_alloc_mmap_handler: 3619 20001000-20004000 already mapped failed -16 [ 2749.665494] binder: BINDER_SET_CONTEXT_MGR already set [ 2749.680247] binder: 3619:3620 ioctl 40046207 0 returned -16 [ 2749.701032] binder: 3619:3624 ioctl 40086607 20000040 returned -22 14:35:42 executing program 4: r0 = syz_open_dev$sndseq(&(0x7f00000000c0)='/dev/snd/seq\x00', 0x0, 0x4) r1 = syz_open_dev$usb(&(0x7f00000001c0)='/dev/bus/usb/00#/00#\x00', 0x8, 0x101100) ioctl$TIOCEXCL(r1, 0x540c) ioctl$FS_IOC_GET_ENCRYPTION_PWSALT(r0, 0x40106614, &(0x7f0000000140)={0x0, @aes256}) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r0, 0xc058534b, &(0x7f0000000000)) r2 = syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0x1, 0x2) ioctl$TIOCEXCL(r2, 0x540c) 14:35:42 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8631040, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:35:42 executing program 2: ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000040)=0x0) syz_open_procfs$namespace(r0, &(0x7f00000000c0)='ns/net\x00') syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/net\x00') 14:35:42 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='mounts\x00') r1 = syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x5, 0x20000) r2 = getpgrp(0xffffffffffffffff) getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f00000006c0)={{{@in=@remote, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@broadcast}, 0x0, @in6=@remote}}, &(0x7f00000007c0)=0xe8) getgroups(0x4, &(0x7f0000000800)=[0xee00, 0xee00, 0xffffffffffffffff, 0x0]) sendmsg$unix(r0, &(0x7f0000000900)={&(0x7f0000000040)=@abs={0x1, 0x0, 0x4e23}, 0x6e, &(0x7f0000000640)=[{&(0x7f0000000200)="b42a9611b786628556f24ae14a827b83e2c4547f55df4a8fc8b68e08624757db6fe0d2a2b782761ecdd9ebf6d44b8710d34e95e2d5484ce6963c471e8fc6d5efe8cb6273cebc0753b6413cfc32472507221f309408b6eceafac51f8c89d559b695fdb5ebb2280d221caf40264b7ff4781bf9ec2bb8f22b3198c0b079cad216fd11f3fb51d9d076c34cd0554cec7d6a7528edc3f82310db4b4f19c2b0f3dbeed56a3dc930f0d80be4ed4545f760f1b0ee13564b2d9cc231f4e552309178d2481c79d147903d4a040c57ec87cc52bcff169cdb7f3d30b13bbb0f50d99617530008b55b057580", 0xe5}, {&(0x7f00000000c0)="aa5e08aede274a520f8cd8c67698d5dea44f4e257250979f95097fa12816823ac2e87bb827418fbafce3105780", 0x2d}, {&(0x7f0000000300)="f54801d71f51ffb03979f3f06074eb603029c9ee5ea9c8d538774d22b0668e116d1c39d582b1a1a6558203e56d54083d4a57a9de83da6dfc7246bbbeea22a1f7717228b0227e692388daeb561ea92226986a3ab3939cede9f9d0bbc42057f341e99e964693b7390f536b3190fe67dc63618552d2e7410b3367848684afad80123073f575e92c5edf53a182733599a442b12298d5ccf2ff96165e16f351a2837156bdb5d98e2b00a28c5cc0dc6d6be1d1546c30904bb9b753aaca6e0c25701edf28134e6fa5d68ffc0d7233ac35e31e790fa5893c5a41", 0xd6}, {&(0x7f0000000100)="5845738832fa4bd6d697696859a9663cb981ccca632cd7471d8f8ad90290a91de1728d6814d0815db643863afe1b92c884459b538bb17c96945c7eeec2200a67385308", 0x43}, {&(0x7f0000000400)="68470ffaf3bf3f0e383f46320ef025687826a4a71853cda0c606f68daaac02780213137f917594bf2127085773454da8f7eabb5372339e01", 0x38}, {&(0x7f0000000440)="5a41366838ebdd26739dfbea785cc9cb7273469675c01bd4946a921ac80d5ee84d06d94a4d729fa8a3e298bc30f4fec9f75540b70037536c7027bd0e3380ff83358a2a22849f08d1ae22aa25a99594cb49c91b5ec49f2096e3005882a41c9c798879cf999c7a9105e5fb6362b6c946a51b48dc9c346baf7d603aed104bb7ead16a57bc102e6e92d1557d184817a2340c89364b9417e8911ccdf85a1848bcbd88e61e8efc58122978ae085d221f0a7a6471b0d86d20286ee58296423a15b76d47c2754d8e47c1cd6f2a73d2efcad6656daed4f604a5e3c64fbdd81a0a", 0xdc}, {&(0x7f0000000540)="180da8a7c5030dc775ca1a68eb6c36cf8697b5c02f3d3beb8ecca7d2054fbb05375fd7f577239d40ec9272c4334f3ac4dbcdbab621c96814a715d146c4c0b0d416ee22dad4a8e3dc54aa171b33c01d8f61cdba5ae28898c9498727bc05b9a23aba88e277e1af71a97b1d93a52632bb5aebd953334c481c09428442be970ea2654f906a200ea0ae3db7dd77b89292f787cd0a87e1abfdfeffe4d7cc3c6e951d4ecd29cbf55dae64dea5f349674bf09e586c45a0f06153e0902ba6216f17de2e014affdad8", 0xc4}], 0x7, &(0x7f0000000840)=[@rights={0x20, 0x1, 0x1, [r0, r1, r1, r0]}, @rights={0x28, 0x1, 0x1, [r0, r1, r0, r1, r0, r0]}, @rights={0x20, 0x1, 0x1, [r1, r0, r0]}, @cred={0x20, 0x1, 0x2, r2, r3, r4}], 0x88, 0x20000051}, 0x0) sendfile(r0, r0, &(0x7f0000000180)=0x74000000, 0x5) 14:35:42 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00'}}}}, 0x68}}, 0x0) 14:35:42 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r2 = fcntl$getown(r1, 0x9) ptrace$getregs(0xe, r2, 0x4000800000000000, &(0x7f0000000040)=""/62) [ 2749.825377] binder: 3643:3646 BC_ACQUIRE_DONE u0000000000000000 no match [ 2749.836663] binder: 3648:3649 got new transaction with bad transaction stack, transaction 8929 has target 3648:0 [ 2749.859143] binder: 3643:3646 unknown command 0 14:35:42 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x7f\xff\xff\xff\x00'}}}}, 0x68}}, 0x0) 14:35:42 executing program 2: syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/net\x00') syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/net\x00') socket$inet6_tcp(0xa, 0x1, 0x0) [ 2749.871622] binder: 3643:3646 ioctl c0306201 20000600 returned -22 14:35:42 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='mounts\x00') ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(r0, 0x40405515, &(0x7f0000000000)={0xa, 0x4, 0x1000, 0x1, '\x00', 0x5}) sendfile(r0, r0, &(0x7f0000000180)=0x74000000, 0x5) [ 2749.898854] binder_alloc: binder_alloc_mmap_handler: 3648 20001000-20004000 already mapped failed -16 [ 2749.935149] binder: 3643:3646 BC_ACQUIRE_DONE u0000000000000000 no match [ 2749.951012] binder: BINDER_SET_CONTEXT_MGR already set [ 2749.969818] binder: 3648:3649 ioctl 40046207 0 returned -16 [ 2749.976056] binder: 3643:3646 unknown command 0 [ 2749.980869] binder: 3643:3646 ioctl c0306201 20000600 returned -22 [ 2749.990337] binder_alloc: 3648: binder_alloc_buf, no vma 14:35:42 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00'}}}}, 0x68}}, 0x0) 14:35:42 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='mounts\x00') sendfile(r0, r0, &(0x7f0000000180)=0x74000000, 0x5) write(r0, &(0x7f0000000040)="bcf9c7141d0c7abdd3e49bab49dbfdbc7b27e0ab922ece2f1fd99a2dfcee5132a7721a98b52c0fbc6c3826437ddf802c36f4d86ed7c2d60196cfbb83d2216f92809ff1dfd5d4e3d22f1d9da7a3c670896d6394e745226a82f69502d14ecdb0589bcbef228ef76fc274005bb13f4d514719ad72fa4b141b399d6d26048a474edec878574ea2f833ed26eb5fb264556d5c78debc70ef314d335561fcc69cf74138b78821f494f8b00888d99a28bbd4c4cdcdad191ab8e12ccc1ed9e1988756133e7a802f56bc6474d464e6c7c3d85f5cc53c030fee88f2ec6deab91e7f74c55741bba5055f02", 0xe5) [ 2750.019269] binder: release 3648:3649 transaction 8929 out, still active [ 2750.030832] binder: undelivered TRANSACTION_COMPLETE 14:35:43 executing program 2: syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/net\x00') r0 = syz_open_dev$swradio(&(0x7f0000000040)='/dev/swradio#\x00', 0x1, 0x2) ioctl$KVM_REINJECT_CONTROL(r0, 0xae71, &(0x7f0000000080)={0x3}) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_REM(r0, 0x84, 0x65, &(0x7f0000000180)=[@in6={0xa, 0x4e24, 0x1b, @dev={0xfe, 0x80, [], 0x11}, 0x2d84}, @in6={0xa, 0x4e21, 0x8000, @loopback, 0x7f}, @in6={0xa, 0x4e23, 0x1, @local, 0x3}, @in={0x2, 0x4e22, @local}, @in={0x2, 0x4e21, @remote}, @in={0x2, 0x4e24, @broadcast}, @in6={0xa, 0x4e22, 0xafe, @initdev={0xfe, 0x88, [], 0x0, 0x0}, 0x6}], 0xa0) r1 = syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/net\x00') fsetxattr$security_selinux(r1, &(0x7f0000000100)='security.selinux\x00', &(0x7f0000000140)='system_u:object_r:hald_exec_t:s0\x00', 0x21, 0x3) 14:35:43 executing program 4: r0 = syz_open_dev$sndseq(&(0x7f00000002c0)='/dev/snd/seq\x00', 0x0, 0x7d) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r0, 0xc058534b, &(0x7f0000000100)={0x83, 0x3, 0x4e}) lremovexattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000300)=@known='system.posix_acl_default\x00') r1 = syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x5, 0xc001) ioctl$SNDRV_SEQ_IOCTL_DELETE_PORT(r0, 0x40a85321, &(0x7f00000001c0)={{0x0, 0x6}, 'port0\x00', 0xb0, 0x80400, 0x9, 0x2, 0x10000, 0x0, 0x5, 0x0, 0x2, 0xfffffffffffffffe}) getsockopt$inet_sctp6_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, &(0x7f0000000040)={0x0, 0x1a5f287e}, &(0x7f0000000080)=0x8) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(r1, 0x84, 0x7c, &(0x7f00000000c0)={r2, 0x9700, 0x40}, &(0x7f0000000180)=0x8) [ 2750.075630] binder: send failed reply for transaction 8929, target dead 14:35:43 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:35:43 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000000000000001561d0a4a41a6a4edf304b59f2000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) [ 2750.165854] binder: 3688:3689 BC_ACQUIRE_DONE u0000000000000000 no match [ 2750.172761] binder: 3688:3689 unknown command 0 14:35:43 executing program 3: r0 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) fcntl$F_GET_RW_HINT(r0, 0x40b, &(0x7f0000000080)) getpid() r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sequencer2\x00', 0x0, 0x0) ioctl$LOOP_CTL_GET_FREE(r1, 0x4c82) getpid() ioctl$UDMABUF_CREATE(r1, 0x40187542, &(0x7f0000000100)={r1, 0x0, 0x2000, 0x1000000}) clock_nanosleep(0x5, 0x1, &(0x7f0000000140)={0x0, 0x1c9c380}, &(0x7f00000001c0)) ioctl$TIOCGPGRP(0xffffffffffffff9c, 0x540f, &(0x7f0000000000)=0x0) r3 = syz_open_procfs(r2, &(0x7f0000000040)='cgroup\x00') sendfile(r3, r3, &(0x7f0000000180)=0x74000000, 0x5) 14:35:43 executing program 2: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000040)='/proc/capi/capi20\x00', 0x200000, 0x0) ioctl$SIOCGETNODEID(r0, 0x89e1, &(0x7f0000000080)={0x2}) ioctl$VT_RELDISP(r0, 0x5605) syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/net\x00') syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/net\x00') 14:35:43 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x04\x00'}}}}, 0x68}}, 0x0) [ 2750.212147] binder: 3691:3692 got new transaction with bad transaction stack, transaction 8933 has target 3691:0 [ 2750.249593] binder: 3688:3689 ioctl c0306201 20000600 returned -22 [ 2750.289036] binder_alloc: binder_alloc_mmap_handler: 3691 20001000-20004000 already mapped failed -16 [ 2750.299442] binder: 3688:3689 BC_ACQUIRE_DONE u0000000000000000 no match 14:35:43 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xf0\xff\xff\x00'}}}}, 0x68}}, 0x0) 14:35:43 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='mounts\x00') ioctl$VIDIOC_S_TUNER(r0, 0x4054561e, &(0x7f0000000000)={0x8, "c001dd70f713ba890ef04bee219637b65aaddffe9fdcbab41a317c9b8a756631", 0x3, 0x4, 0x84, 0x2, 0x1c, 0x2, 0x7, 0xafc2}) ioctl$KVM_SET_XSAVE(r0, 0x5000aea5, &(0x7f0000000200)={"188c4802cf19d4e1c647560deb4e0559f3cace538bae185b197750714807feddbba041977a6c43f6bcce7ddc090c61ab9d5e5a9500fe3f7e979c9a237876ebbecdca3a0cefb7f141a398c238554fd9e0a2d1bb954d5b672c5f7b40eedfcf133b42dff87702317d2bcef99d1bb14d5f274d02aaf57330c12c86fe9d23bb2f7d3e57ba25cc953b6c3f141a49a5f0db070b9e97f431d4877db6ae42dd2d2aea8561b6ccfa94cf7dff52948081629fd5f93cfb09fc87cb8d0afabb003e867d72ac043d1d40e48a8f6f6a3ef95818786f85a8f75e12b819a91321245c891ef6fa7835cc5868f9910a70ddc243e7509e3ca6eefe13cf00c4ca773a2e9950f876c82aab526943b6f992d216d5e9b199d364a00302a165e32b8bed98af93f57027a32f322511a4afeb12052b9a94f77fc7056b72b12087085a53cba0bcf9d28cca91ff4d198818781574c496bf5241a0827a360cff7833fc344cc72eb2a354655d773bb35e7aa40cf583431c0b01ed0108e47ee0e08d300dbb55d1521420eb66685d202cd048107a20eb216f2f9236c93bc699a084aa77405255aa1fc495fc809a564bea3d236d41ff2dd6a4fa9c2aa51c87e4220d5f46a7a4fc663cf5e81eb0b54c65280255d0e36efa588d70fd10dcd5ed9b465070857e627971e241c9517ff27451b06502f01d564f2a1f0a7a189be181b0ae60a5a414d7730c70be3302e775f76580cde938ba444efb0a16202f7c821083525634238358b37830a3fd3f92260d9989155e09cfa8fb6931745b8fa5d54236ea2df79e24d879f57f9a93e4912d821659575332ec2a2825ed11f7ffab8528b11330d3bb0e54ea11f5bf37321147d5744f98487a0315092d8d7608b03fb362d02f7d2ccd2fbb0ddf5c935c72360806c23a802224aa7aff4b8e2191fcf573ca09be8b2ade11796069b80bc9b5ae402785676bbeb766f743964eb786cd51d07437eebcf9b9ba9c665a351f3b8a097430c3260206d749d8212734359203cffe1573b22aad4b44143026de8c0d21cb0c522cf300763c1bb9ceb985fc8b6e415afa80ef485934c5a4d406d862e7a7438567e3667a5a397391d6c5a1f03f96a2bc6e346089c97003474f49b60a55a6adef2f15c16f9718ad13c81db62afc15b701abb690e828162379bb1c8d8efd7a86a04e78024295f02f2e4956b8c282e483cdd470146d2754f6b6a162548662f07673afd4037c738ab5a02600e6df70d10575e7d977f0fe2ba58f02a1dd216c79d8e3e394f54122dcb942c03979f18bdb3a3b7479735a082b7ffd469f0787f41dc68772182347a3a3f4863df6290b4d6a3828773384df9fbbebb2be7148f20cec2bc80c2795686006ae3edf8366370c3c92eef310a3b33214939eaa743c5521f96c2d1f4144fb3b286c2f36a05571c2d75c92a6f3b09d77b68f7064ee7e1bf80c0997a6e4bd"}) sendfile(r0, r0, &(0x7f0000000180)=0x74000000, 0x5) [ 2750.332218] binder: BINDER_SET_CONTEXT_MGR already set [ 2750.332722] binder: 3688:3689 unknown command 0 [ 2750.356583] binder: 3691:3692 ioctl 40046207 0 returned -16 [ 2750.357403] binder: 3688:3689 ioctl c0306201 20000600 returned -22 [ 2750.386231] binder_alloc: 3691: binder_alloc_buf, no vma [ 2750.386746] binder: release 3691:3692 transaction 8933 out, still active [ 2750.433975] binder: undelivered TRANSACTION_COMPLETE 14:35:43 executing program 2: r0 = syz_open_dev$adsp(&(0x7f0000000040)='/dev/adsp#\x00', 0x0, 0x206c40) ioctl$KVM_GET_MP_STATE(r0, 0x8004ae98, &(0x7f0000000080)) syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/net\x00') syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/net\x00') 14:35:43 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x500, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 2750.460158] binder: send failed reply for transaction 8933, target dead 14:35:43 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\x9e\x00'}}}}, 0x68}}, 0x0) 14:35:43 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='mounts\x00') syz_open_pts(r0, 0x103006) sendfile(r0, r0, &(0x7f0000000180)=0x74000000, 0x100000000) [ 2750.506463] binder: 3718:3719 BC_ACQUIRE_DONE u0000000000000000 no match [ 2750.550873] binder: 3718:3719 unknown command 0 [ 2750.576845] binder: 3718:3719 ioctl c0306201 20000600 returned -22 14:35:43 executing program 4: r0 = syz_open_dev$sndseq(&(0x7f0000042000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000080)='/dev/rtc0\x00', 0x0, 0x0) ioctl$KDGETLED(r1, 0x4b31, &(0x7f00000000c0)) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r0, 0xc058534b, &(0x7f0000000000)) 14:35:43 executing program 2: syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/net\x00') 14:35:43 executing program 0: syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, 0x0, 0x0) setsockopt$IP_VS_SO_SET_DELDEST(0xffffffffffffffff, 0x0, 0x488, 0x0, 0x0) r1 = syz_open_dev$radio(&(0x7f0000000000)='/dev/radio#\x00', 0x2, 0x2) accept4$inet(r1, &(0x7f0000000040)={0x2, 0x0, @multicast1}, &(0x7f0000000080)=0x10, 0x0) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000000)={'vet\x00\x00\x00\x00\x00\x00\x00\x00\x00\xbdh\x00', 0x43732e5398416f1a}) r3 = socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = shmget$private(0x0, 0x7000, 0x800, &(0x7f0000ff9000/0x7000)=nil) shmctl$IPC_STAT(r4, 0x2, &(0x7f0000000080)=""/19) r5 = socket$inet(0x2, 0x3, 0x2) r6 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000340)='/dev/sequencer2\x00', 0x0, 0x0) ioctl$SIOCSIFMTU(r6, 0x8922, &(0x7f0000000200)={'veth0\x00', 0x1f2}) getsockname(r6, &(0x7f0000000140)=@ipx, &(0x7f00000001c0)=0x80) syz_genetlink_get_family_id$ipvs(&(0x7f0000000500)='IPVS\x00') sendmsg$IPVS_CMD_SET_CONFIG(r6, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x10000800}, 0xc, &(0x7f0000000580)={&(0x7f00000003c0)=ANY=[@ANYBLOB="000229d95c8ff4e2c041d353b2475de4b5bb5aae0000000000000c0000000c0003000800040008000000"], 0x1}, 0x1, 0x0, 0x0, 0x80}, 0x2000c811) setsockopt$SO_VM_SOCKETS_BUFFER_SIZE(r6, 0x28, 0x0, &(0x7f0000000100)=0x1, 0x8) setsockopt$inet_int(r5, 0x0, 0xca, &(0x7f0000000000)=0x10001, 0x10) dup2(r3, r5) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x3e7, 0x0, 0x0, 0x3, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BLKGETSIZE64(0xffffffffffffffff, 0x80081272, &(0x7f0000000240)) r7 = syz_open_procfs(0x0, &(0x7f00000001c0)='clear_refs\x00') openat$vnet(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vhost-net\x00', 0x2, 0x0) lsetxattr$security_ima(&(0x7f0000000280)='./file0\x00', &(0x7f00000002c0)='security.ima\x00', &(0x7f0000000700)=ANY=[@ANYBLOB="070097f69b0c0e8b14dd3ab6f89bd0e535604ac1731be4323883ad3ddfa2affd1f0e828d08c7807640352786ce813bd1c7f477cf1fd5378dbbe925a27a180600da73874f839bb74f8a8b93efd91a631d869fb2ebf2a5a3e1e35d86a66f1efeba786c37636b57557cecc8fa7c0a5f3e1ebd3dee7774d79f382b4f2f4c19c25f9da7d74a8edaa8cd120000d653f229421871677024600e51f6c14e41de81f734830dc45c90a78b72b194bd5d6ffc22bed7fdcca32c505a6006d74a1748dc04d43fa8df522e4566d18067e39d6400ea9bdca43e2a405a897f9f066b760606a280e1f56627f9d914620bd4c8f4efffa03df86c70917cf5ffb45dae"], 0x1, 0x3) setxattr$security_capability(&(0x7f0000000540)='./file0\x00', &(0x7f0000000380)='security.capability\x00', &(0x7f0000000440)=@v1={0x1000000, [{0x4f83, 0x4}]}, 0x0, 0x2) pwritev(r7, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) 14:35:43 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x9e\xff\xff\xff\x00'}}}}, 0x68}}, 0x0) 14:35:43 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:35:43 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='mounts\x00') epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r0, &(0x7f0000000000)={0x40002000}) sendfile(r0, r0, &(0x7f0000000180)=0x74000000, 0x5) [ 2750.752580] binder: 3745:3746 BC_ACQUIRE_DONE u0000000000000000 no match [ 2750.772515] binder: 3745:3746 unknown command 0 14:35:43 executing program 2: syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/net\x00') r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000040)='/dev/btrfs-control\x00', 0x40000, 0x0) r1 = geteuid() sendmsg$nl_generic(r0, &(0x7f0000000340)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000300)={&(0x7f0000000100)={0x1f4, 0x2c, 0x4, 0x70bd27, 0x25dfdbfd, {0xb}, [@nested={0xc8, 0x17, [@generic="985b43bc1a2315ace3d3a3dea8ab44706fcce4fe731bb6d222b8bf365ee48ddd6068daacfde9711e1523eacca70ead650688d83317bf2a025f196b763c7ebd26ddb273051c5f", @typed={0x4, 0x2a}, @typed={0xc, 0x44, @str='ns/net\x00'}, @typed={0x30, 0x70, @binary="9554dbaa0141b1dea3cf8657f56e8abadd87f14441a4f2cd0bd070bf7f8a7a336a96fe0ce42051a4e3"}, @generic="1b01d2a3d9e213d913662de6c90baee9d5f0f81470269e95c621dfa8909faff797e75c70064f82d24d2b58aca34c2f6fec5d5c60958e13ee481850c3c1"]}, @nested={0x118, 0x12, [@typed={0x8, 0x6c, @u32}, @typed={0x8, 0x4b, @ipv4=@local}, @generic="9d24e059ae53bda0f48ae33c3fcc743f4438320e23dfc7769ba61fe8351a0fce1b9a76bb4594731fd0b838d61f6d9ab1812622da86307cc21cd38d569b03fd9e974cb9f4bc469183e07365ab7e236eee9cdcebee5ebe533453418226c773865a07ce4847707f22d03c789ffae6f3f92a4f8d9e8d165504747bd32699860c46437a73e4a769fa7308ef3f04a282316c", @typed={0x8, 0x35, @u32=0x78f}, @typed={0x8, 0x25, @uid=r1}, @generic="75dff4d215ef3542adf4ec8ad4f49a9e63afbe60415fecfcadaf9c6dadf8e902f8e772b423a6d56403fa982e02223532e3dc3fb1bfdf950967ffaec4993f2ea5a7bf10a7c7aec310e36abee025f9e1aaf0fcf18176e12c8f6ecc2a0dc0cec679626a"]}]}, 0x1f4}, 0x1, 0x0, 0x0, 0x5c4c04607519a83f}, 0x80) syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/net\x00') 14:35:43 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00'}}}}, 0x68}}, 0x0) [ 2750.804142] binder: 3745:3746 ioctl c0306201 20000600 returned -22 14:35:43 executing program 3: r0 = syz_open_dev$admmidi(&(0x7f0000000000)='/dev/admmidi#\x00', 0x0, 0x28000) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer2\x00', 0x212000, 0x0) getsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r1, 0x84, 0x76, &(0x7f0000000080)={0x0, 0x7f}, &(0x7f00000000c0)=0x8) setsockopt$inet_sctp_SCTP_AUTH_DEACTIVATE_KEY(r1, 0x84, 0x23, &(0x7f0000000100)={r2, 0x3}, 0x8) ioctl$NBD_SET_SOCK(r0, 0xab00, r1) r3 = syz_open_procfs(0x0, &(0x7f00000001c0)='mounts\x00') sendfile(r3, r3, &(0x7f0000000180)=0x74000000, 0x5) 14:35:43 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x700000000000000, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:35:43 executing program 2: r0 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000100)='/dev/qat_adf_ctl\x00', 0x42000, 0x0) ioctl$SNDRV_TIMER_IOCTL_STOP(r0, 0x54a1) syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/net\x00') r1 = creat(&(0x7f0000000040)='./file0\x00', 0x0) ioctl$VHOST_SET_VRING_ENDIAN(r1, 0x4008af13, &(0x7f0000000080)={0x1, 0x200}) bpf$OBJ_GET_PROG(0x7, &(0x7f0000000180)={&(0x7f0000000140)='./file0\x00', 0x0, 0x8}, 0x10) syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/net\x00') 14:35:43 executing program 4: r0 = syz_open_dev$sndseq(&(0x7f0000042000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r0, 0xc058534b, &(0x7f0000000000)) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000080)={0x5d, 0x7fff, 0x7}) 14:35:43 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='mounts\x00') sendfile(r0, r0, &(0x7f0000000180), 0x5) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000040)={0xffffffffffffffff, r0, 0x0, 0xa, &(0x7f0000000000)='[GPL\xeaeth0\x00'}, 0x30) fcntl$lock(r0, 0x0, &(0x7f0000000080)={0x1, 0x2, 0x30f6, 0x3, r1}) [ 2751.078955] binder: 3769:3772 BC_ACQUIRE_DONE u0000000000000000 no match [ 2751.100345] QAT: Invalid ioctl 14:35:44 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00'}}}}, 0x68}}, 0x0) [ 2751.124386] binder: 3769:3772 unknown command 0 [ 2751.129173] binder: 3769:3772 ioctl c0306201 20000600 returned -22 [ 2751.133639] QAT: Invalid ioctl 14:35:44 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x9) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xfffffffffffffd93, 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00c@@'], 0x291, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:35:44 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:35:44 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='mounts\x00') r1 = syz_open_dev$vcsa(&(0x7f0000000040)='/dev/vcsa#\x00', 0xfaa, 0x2000) sendfile(r0, r0, &(0x7f0000000000)=0x42, 0x5) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(r1, 0x6, 0x15, &(0x7f0000000080)=0x6, 0x4) 14:35:44 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00'}}}}, 0x68}}, 0x0) 14:35:44 executing program 2: syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/net\x00') r0 = syz_open_dev$amidi(&(0x7f0000000040)='/dev/amidi#\x00', 0x2, 0x400000) accept4$inet(r0, &(0x7f0000000080)={0x2, 0x0, @multicast2}, &(0x7f0000000100)=0x10, 0x80800) syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/net\x00') r1 = msgget(0x0, 0x8c) msgctl$IPC_INFO(r1, 0x3, &(0x7f0000000140)=""/8) 14:35:44 executing program 4: r0 = syz_open_dev$sndseq(&(0x7f0000042000)='/dev/snd/seq\x00', 0x0, 0x0) getsockname$inet(r0, &(0x7f0000000080), &(0x7f00000000c0)=0x10) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r0, 0xc058534b, &(0x7f0000000000)) 14:35:44 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000100)='c\xf7\nx\xba\x14lear_refs\x00\xc3<\x01\xbc\x80\xb8R\x1e\xde}\x13&2C\xd3\x9a\xe6\x14\xb7\xca\xf9\x002\xd3\x96\xbdnT\xca{/\x82\"\x8f}\xc7\x9f\xef\xd2\x82\xf6\x96.\xa3\x9e\xe3~\xba\x00$\x88\x99\xf0') ioctl$SG_GET_TIMEOUT(r0, 0x2202, 0x0) sendfile(r0, r0, &(0x7f0000000180)=0x74000000, 0x5) setsockopt$packet_fanout_data(r0, 0x107, 0x16, &(0x7f00000003c0)={0x4, &(0x7f0000000040)=[{0x80000000, 0x1, 0x6, 0x7fffffff}, {0x1, 0xd6, 0x10000, 0x1}, {0x0, 0x7ff, 0x3, 0x8c}, {0x9, 0x7, 0x3f, 0x5}]}, 0x10) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f, 0x1002}}, 0x20) ioctl$EVIOCSKEYCODE(r0, 0x40084504, &(0x7f0000000400)=[0x1f, 0x80000000]) write$RDMA_USER_CM_CMD_QUERY(r0, &(0x7f0000000080)={0x13, 0x10, 0xfa00, {&(0x7f00000001c0), r1, 0x1}}, 0x18) [ 2751.385253] binder: 3802:3803 unknown command 0 [ 2751.404707] binder: 3802:3803 ioctl c0306201 20000600 returned -22 14:35:44 executing program 2: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000040)='/proc/capi/capi20\x00', 0x80c0, 0x0) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffff9c, 0x84, 0xf, &(0x7f0000000100)={0x0, @in6={{0xa, 0x4e21, 0x5, @mcast1, 0x2}}, 0x7fffffff, 0x1, 0x5, 0x5, 0x7}, &(0x7f0000000080)=0x98) setsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r0, 0x84, 0x72, &(0x7f00000001c0)={r1, 0x37}, 0xc) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000000)=0x0) syz_open_procfs$namespace(r2, &(0x7f00000000c0)='ns/net\x00') [ 2751.448957] binder: 3806:3809 ioctl c0306201 20000000 returned -14 14:35:44 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xfc\xff\xff\xff\x00'}}}}, 0x68}}, 0x0) 14:35:44 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9631040, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 2751.492830] binder_alloc: 3806: binder_alloc_buf, no vma 14:35:44 executing program 2: ioctl$TIOCGPGRP(0xffffffffffffff9c, 0x540f, &(0x7f0000000140)) ioctl$TIOCGSID(0xffffffffffffff9c, 0x5429, &(0x7f0000000180)=0x0) syz_open_procfs$namespace(r0, &(0x7f00000000c0)='ns/net\x00') r1 = syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/net\x00') r2 = dup(r1) r3 = add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000100)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffff8) keyctl$get_keyring_id(0x0, r3, 0x5) ioctl$DRM_IOCTL_GET_MAP(r2, 0xc0286404, &(0x7f0000000040)={&(0x7f0000ffa000/0x3000)=nil, 0x1f, 0x2, 0x0, &(0x7f0000ffa000/0x4000)=nil, 0x8000}) 14:35:44 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='mounts\x00') sendfile(r0, r0, &(0x7f0000000180)=0x74000000, 0x5) finit_module(r0, &(0x7f0000000000)='mounts\x00', 0x1) [ 2751.542918] binder_transaction: 14 callbacks suppressed [ 2751.542934] binder: 3806:3809 transaction failed 29189/-3, size 0-0 line 3035 [ 2751.563253] binder: 3819:3820 unknown command 0 [ 2751.579509] binder: 3819:3820 ioctl c0306201 20000600 returned -22 [ 2751.664823] binder: 3806:3828 ioctl c0306201 20000000 returned -14 [ 2751.664861] binder: BINDER_SET_CONTEXT_MGR already set [ 2751.733137] binder_release_work: 15 callbacks suppressed [ 2751.733144] binder: undelivered TRANSACTION_ERROR: 29189 [ 2751.749314] binder: 3806:3809 ioctl 40046207 0 returned -16 14:35:44 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='t{@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:35:44 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00'}}}}, 0x68}}, 0x0) 14:35:44 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x12634840, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:35:44 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='mounts\x00') sendfile(r0, r0, &(0x7f0000000180)=0x74000000, 0x5) r1 = syz_genetlink_get_family_id$tipc(&(0x7f0000000040)='TIPC\x00') setsockopt$EBT_SO_SET_COUNTERS(r0, 0x0, 0x81, &(0x7f0000000280)={'nat\x00', 0x0, 0x0, 0x0, [], 0x2, &(0x7f0000000200)=[{}, {}, {}, {}, {}, {}], 0x0, [{}, {}]}, 0x98) sendmsg$TIPC_CMD_SET_NODE_ADDR(r0, &(0x7f0000000100)={&(0x7f0000000000), 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x24, r1, 0x200, 0x70bd2c, 0x25dfdbfd, {{}, 0x0, 0x8001, 0x0, {0x8, 0x11, 0x80000000}}, ["", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000080}, 0x20000000) 14:35:44 executing program 4: r0 = syz_open_dev$sndseq(&(0x7f0000042000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r0, 0xc058534b, &(0x7f0000000400)={0x1ff, 0x0, 0x200000}) r1 = socket$inet6(0xa, 0x2, 0x1) r2 = creat(&(0x7f0000000140)='./file0\x00', 0x84) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(r2, 0xc1205531, &(0x7f0000000180)={0x101, 0x3a, 0x7fffffff, 0x101, [], [], [], 0x1, 0x0, 0x8, 0x10000, "6968c279ab138fb7569bda75a13fab69"}) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r1, 0x84, 0x1f, &(0x7f00000002c0)={0x0, @in={{0x2, 0x4e24, @rand_addr=0x81}}, 0x7, 0x4}, &(0x7f0000000380)=0x90) setsockopt$inet_sctp_SCTP_ASSOCINFO(r2, 0x84, 0x1, &(0x7f00000003c0)={r3, 0x1, 0x7, 0x3, 0xe, 0x1d5}, 0x14) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, &(0x7f0000000080)={0x0, 0x1f}, &(0x7f00000000c0)=0x8) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, &(0x7f0000000100)={r4, 0x80}, 0x8) 14:35:44 executing program 2: r0 = syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/net\x00') r1 = getpid() syz_open_procfs$namespace(r1, &(0x7f0000000000)='ns/net\x00') r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000200)='/dev/ubi_ctrl\x00', 0x40a01, 0x0) perf_event_open(&(0x7f0000000180)={0x4, 0x70, 0x691, 0xffffffff80000001, 0x5, 0x7fff, 0x0, 0x7ad, 0x4, 0x8, 0x21, 0x7fff, 0xfffffffffffffff9, 0x4c60231b, 0x5, 0x6, 0x9, 0xffff, 0x1ff, 0x0, 0x9, 0xffffffff, 0x5, 0x0, 0xeb3e, 0x1ff, 0x60000000, 0x10001, 0xb648, 0xffffffff, 0x8, 0xd7f6, 0x7fff, 0x9, 0x1ff, 0x6, 0xffffffff, 0xcaba, 0x0, 0x3, 0x4, @perf_config_ext={0x400, 0x8}, 0xc00, 0x0, 0x0, 0x3, 0xffff, 0x101, 0x8}, r1, 0xc, r2, 0x0) stat(&(0x7f0000000040)='./file0\x00', &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0}) getgroups(0x1, &(0x7f0000000080)=[0xee01]) fchown(r0, r3, r4) [ 2751.843446] binder: 3842:3844 unknown command 0 [ 2751.857406] binder: 3842:3844 ioctl c0306201 20000600 returned -22 14:35:44 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2630440, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:35:44 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00`\x00'}}}}, 0x68}}, 0x0) 14:35:44 executing program 2: r0 = syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/net\x00') ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000040)) fcntl$getown(r0, 0x9) r1 = getpgrp(0x0) syz_open_procfs$namespace(r1, &(0x7f0000000000)='ns/net\x00') 14:35:44 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='mounts\x00') r1 = fcntl$getown(r0, 0x9) sendmsg$nl_netfilter(r0, &(0x7f0000000540)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000500)={&(0x7f0000000280)={0x26c, 0x7, 0x7, 0x300, 0x70bd25, 0x25dfdbfe, {0x3, 0x0, 0x1}, [@nested={0x160, 0x46, [@typed={0xc, 0x56, @str='mounts\x00'}, @generic="23935eac85ce36c2dc079a3a3e0a76c1f8df443ee0cb126554d1e075298be7269f577c2cd6534b0d4f6448d3cecc2f28816ac32e12c43ca210c62263012f6181d8127565783f59ac30e875766cf7817c938ded1f92809e10e22a781b8ffc2ae356237435476e2ddf1f11b15dae16d68c915422febc18870d8bde9f785cb48ffdf52f83e4936d755d97db4de8933237e267b7eba342d260ec1cdab9a6720e463759b1253022293ef27d7357f9dc4eb4be9bc6340f6ced17f2fe67f661ad548259728cb00855", @typed={0xc, 0x92, @str='mounts\x00'}, @generic="2b8630716cfc4b2a2130cd62a3e32b51a2d31b1e24b02e8991624d638c87f53c5d0886ce03b3994b305dcbca413e326eb997194f952d553e01", @typed={0x8, 0x26, @pid=r1}, @typed={0x8, 0x16, @u32=0x4}, @generic="01e09e0d4858c981d30ee12936bde832e9fed67a2548e7835a7862a9b8ff1e1b446dc4fb058698ba1535002345c2bf2f757474dc"]}, @nested={0xf0, 0x32, [@typed={0x8, 0x5b, @fd=r0}, @generic="6b9df29727c00de7cf684376d48fe4c4abe162ae3f1c5dd843b0e9038edcedb019b6046d7a33741279503adab6e96a1ce72d4277966489f20d5a6adf4df468dbc0144a25624ab52880c32d18cc869aa8337c763815c7ad8c3ec4a5374ad229184c6ef8d75288e1257ed0f4ace2b16d5a3f4d91394824a37ffd1590b5d6e28f0a99f2ad0309a631a7b8e65f5cc4b02d62b621725cae6a93cb653373327b863a8bc2d25f33d4a67b4636bc6d3f33bdccf1b97dcaae6d2cb95abe5e3bdf6d07ad48ea0efb6c4cf4c742a919962fa35ff750f28f47170d8bc89147afa03bcfa0ff3985"]}, @typed={0x8, 0x30, @ipv4=@rand_addr=0x9}]}, 0x26c}, 0x1, 0x0, 0x0, 0x20004084}, 0x4044000) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f0000000040)={0x0, @in6={{0xa, 0x4e24, 0x58, @dev={0xfe, 0x80, [], 0x17}, 0xd0}}, 0x7, 0xe9, 0x3, 0x3, 0xc8d4}, &(0x7f0000000100)=0x98) getsockopt$inet_sctp_SCTP_ASSOCINFO(r0, 0x84, 0x1, &(0x7f0000000140)={r2, 0xf717, 0x1ff, 0x2, 0x2fa, 0xe722}, &(0x7f0000000200)=0x14) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x5, 0x400, 0x8, 0x2, 0x3, 0x80000000}) sendfile(r0, r0, &(0x7f0000000180)=0x74000000, 0x5) [ 2751.885505] binder: 3841:3846 unknown command 1077967732 [ 2751.906125] binder: 3841:3846 ioctl c0306201 20000000 returned -22 [ 2751.966800] binder_alloc: binder_alloc_mmap_handler: 3841 20001000-20004000 already mapped failed -16 14:35:45 executing program 2: r0 = getpgrp(0xffffffffffffffff) getpgid(r0) ioctl$TIOCGPGRP(0xffffffffffffff9c, 0x540f, &(0x7f0000000180)=0x0) syz_open_procfs$namespace(r1, &(0x7f00000001c0)='ns/net\x00\xa2\x14\xe8\r0B\xd9_\xf7\x004\xeb\xb9\xb0\xdeD\x9d1\x8b\xa3\xf8\xa9\\\xd9\"\xe3\x9b\x90Q6<\xcd\x89\xa6\x1a3\xbc\xab\xd0\xd7\xe7)\xa0\x87\xab\x82^\x8b_\x12\xcf\x9e\xe9z\x10\x9d\x12J\x16\xad\xeb\x01\xdb\x7f\f{\r\xeb\xa1\x11\xa0\xf1\x8cwz\x97\xb2\xa5\xba%/\x0faK\x1f6\'\xb6\x8d\xfd\xcb\x9a4G\xd4O\xf2\x84UT\n[\x1b\xbbQW\x15\xf1\x1cR&\xcd\xca\xe3\xa6\x7f\x1e\xad') r2 = syz_open_dev$media(&(0x7f0000000040)='/dev/media#\x00', 0x1, 0x80040) getsockopt$inet6_buf(r2, 0x29, 0xd3, &(0x7f0000000080)=""/4, &(0x7f00000000c0)=0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/net\x00') [ 2752.012861] binder: BINDER_SET_CONTEXT_MGR already set [ 2752.023701] binder: 3841:3846 ioctl 40046207 0 returned -16 [ 2752.033496] binder: 3841:3868 unknown command 1077967732 [ 2752.040833] binder: 3841:3868 ioctl c0306201 20000000 returned -22 [ 2752.049214] binder: release 3841:3855 transaction 8939 out, still active [ 2752.057086] binder_alloc: 3841: binder_alloc_buf, no vma 14:35:45 executing program 3: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000)='/dev/hwrng\x00', 0x10000, 0x0) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/pfkey\x00', 0x0, 0x0) sendfile(r0, r1, &(0x7f0000000080), 0x2dac) r2 = syz_open_procfs(0x0, &(0x7f00000001c0)='mounts\x00') sendfile(r2, r2, &(0x7f0000000180)=0x74000000, 0x5) [ 2752.068747] binder: undelivered TRANSACTION_COMPLETE [ 2752.104242] binder: 3841:3846 transaction failed 29189/-3, size 0-0 line 3035 [ 2752.124440] binder: send failed reply for transaction 8939, target dead 14:35:45 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40406300, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:35:45 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) close(r0) 14:35:45 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00'}}}}, 0x68}}, 0x0) [ 2752.166403] binder: undelivered TRANSACTION_ERROR: 29189 [ 2752.216950] binder: 3879:3880 unknown command 0 14:35:45 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='mounts\x00') openat$vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vsock\x00', 0x80000, 0x0) sendfile(r0, r0, &(0x7f0000000180)=0x74000000, 0x5) [ 2752.243172] binder: 3879:3880 ioctl c0306201 20000600 returned -22 14:35:45 executing program 2: alarm(0xe7) r0 = syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/net\x00') r1 = syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/net\x00') ioctl$FICLONERANGE(r0, 0x4020940d, &(0x7f0000000040)={r1, 0x0, 0x5, 0x8, 0x4d}) 14:35:45 executing program 4: r0 = syz_open_dev$sndseq(&(0x7f00000000c0)='/dev/snd/seq\x00', 0x0, 0x200000000082) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ubi_ctrl\x00', 0x8000, 0x0) ioctl$DRM_IOCTL_AGP_RELEASE(r1, 0x6431) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r0, 0x404c534a, &(0x7f0000000140)={0x4000006, 0x7, 0x2}) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r0, 0xc058534b, &(0x7f0000000200)={0x0, 0x6, 0x1}) 14:35:45 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xea\xff\xff\xff\x00'}}}}, 0x68}}, 0x0) [ 2752.315094] binder: 3887:3889 got new transaction with bad transaction stack, transaction 8942 has target 3887:0 [ 2752.337720] binder: 3887:3889 transaction failed 29201/-71, size 0-0 line 2946 [ 2752.353269] binder: release 3887:3889 transaction 8942 out, still active 14:35:45 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 2752.371859] binder: undelivered TRANSACTION_COMPLETE [ 2752.374080] binder_alloc: binder_alloc_mmap_handler: 3887 20001000-20004000 already mapped failed -16 14:35:45 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='mounts\x00') sendfile(r0, r0, &(0x7f0000000180)=0x74000000, 0x5) ioctl$VIDIOC_STREAMOFF(r0, 0x40045613, &(0x7f0000000000)=0x1) r1 = msgget(0x1, 0x8) msgsnd(r1, &(0x7f0000000200)={0x0, "564fbe6dee8457c1ba890116b5400a41cdc19a66ceb6bd85c1cc90b39f707557b6b25b63ce55af2d9f3aae1301ca158d434ce966fb12b233d8e42b77619f0ef56da5fb23f8c09950cd1370c4a4cb411fe78ce5bf2c8e8fabc809a7063bc1eb3f72ad87785f44fc62267a16d88f5d87bd6242663010dac8660fbe29f5de5715a536a18b6c00687d1ef643e1623de8945b89eed2a9883718891a0d16241489d2793c3d1702771910f81d0766b50ac1914f0e4f68c192d045317b8f6275f51a5cfebeb422de286ce9175eed672a2e5893b22e23d8ac64f3375a329f83918fa6ee2302aab75ad119776712b824f484661e55e66c8f8b8398fff3b576772ad83305bc65875b6f62a3954c3b861b2a44fb77cb82cc234e51b22f382369c91e748d83bb2ad15077547ecf738a2e46c328b1eac592916945ceea3ddc7017d0139df4d870f7239adecfd7d3c77efe47762c8a1fd122867181bea1f316c705293871310905c41fd7b7e944dbfea3a05c2fe86040bc331f8f39e6b98449f460c23a7b0e5a9c4e171849c01a74ba1413c8cf278510fb0593663c9a631e9f9052f14bf5094ec7cfbc6959e414faebe94ee1bd9f5bc08fe67c70d5ce68d28ec3cb75926f6580f08beebd706fdabb542ce8dc563c37c47695ed5881d5785f785f75faf3f2c0a0425269f378ab9e78171b17b3ef32fe9756ac21439c9f11fde32a120581edf2e6098cbcbc97877f5a084f213790a638e371867a2df54a98d84df67d828abf21af755c47adbb0c493b17bd96de2b9fd39529edece754b9bb6d42d6be84376d09bbe59260f90d4ecb87c41b95b9df93b6e310afb8265c087e20c2bbe8355b1e8fc97621e0f35f061562ada0c81bdf787c73d7c65f86a56ea6ca9cca3454fb9f5db8f76f8f825e8f95e72383a374c305919b9ee8387e145b724e4d9f408a2a6f357b7da100b65ffc33b4ebb30116961736283654b47b96e773bfc3f590551c7f8b9a333c6ef5cf19cacbf908daa404f0f623e232f11ecd4a3841cb1356debaae51ddfa18215a59e9539756bb40d738dc871b293125137cb0c4279325323cc7780577d493c423bab5b0091aeb91c710427f41f559f47d4e68ccb1d698b1962dab0337a126a858556233af363a5ea7b1e252d3de9935f412ae43a36db741286ed28df798d3a547b86d302280fbfbb2099d8b5fa25122ec7ca64dbe3c3b92c09212987248970b2788009dcb5c48d6137a56955b4c42442f4512354e86176ae7906dfc389ea817d6db243d1954cb11f77dad8a234a88d8d45049cd72573b54b611b8dd0293c183164deb2f3acd4be6b6b7b58e079d0312817401ef4a7bf0dd3988c8213ced552b6c64dbc372636451c03d7dc047ce52cca8db899d14c05acb1420124a9271fa4b3bdee8bff356dedc260540be4de28d7e5df4bc07f327a8ad8bcd412a4eebe59b7ef790aab011e206efdb2339945e500399f122883ecde660243775c26fcce31664ed292321debe7508d2646f79cc8f7e2a2ecec1ac0eac35529a71839526488caea0b0275bbf856a305b6c6ae4a4b91741e6ca6a144d92007ca0fb8395eb5e0db973fc00560e5e732266caf609f8c2c4007120d9eac2daca61d29c060ab894f0003b8e4d4d0b1df59686640225258a906b8f969280ef1350486587696fb6ab81e6221bd1918decf53349c79beeb24be7e01ecb0cf1f5b68142d4477f05287ef672878a649dea440cbcb2053bf8024cdcd0da0aa55f3d97b84d5f9a35b7b65dd42b387070c19863ce8f1ab1aee87ba9785f9751360c92966907953bbb3ceee244de5a2871f3a629bf43a2046a60a29f6131666b506da5a237236e66bd6cd1cc46d3b3bced8247a78a64142d99a5a1be02e4af256bef35349c30b724426a91edead714816517674f846d2e228dacc64c5b085e64d8ba80f2c132a960e33e7768dcd1f797d48500de5a10bf1f3c79eee0dc5c2140add6eec0f5a0cd6a01982fa11b1a62a4d0102521827b44246fe4a3ee8802af7e32bb044c466368145b9af9cad149d8c0b9127beac659e5f0e70bc1d897fe8c70da0dcc20ac8746e13ae485bd7370e1bc976839ccc9fc9969a2cb476dad3b85bdd8eab4552b9c2aae3dd9a01923b7f51824fa2b4e8f36fbeabe80408f31257405e3c7fdec19df47f8b441aafec0c54bc68b0457794c20bc244359400064b9df4973ece38462480bc34058b6ce0bc60c29deb3d2f76274a12fae8bbe9e75225c51d1addc12bcaa775fc00a9fedf9e1cc6f18c1cd115aa270767124f7104adf941c748dc014da51af5970789261cb53990914ea9c87e29d55e2f5418f7b01cef480d5a16b60039186828f095d0445c98645618b9464c9c8053de3cd27aecc49e82450dfbc5a731dedc7b9962c309c29b3d6daf2406e7ca1cfd3f8ff54100cb81343d507a57c6767556986d369cf920afb8cc7e86c3f4213513deb33a64abee490baa65a43042d9b989f745b60386ee9cad20be308a9ecb2002cd362633085b34d8798140e7c97f4bd6459742bc2755440459670b4f22062a7e3e6668d91dede9157b781bad9bb20673b296bd83673ec4343e75e30f041154d46bc43a5929fe6d1b2891b4a8a44c20fd6e664e892c9ad92cd126911aba1d65c25483bb4174d9032037cab573618efde2cb25f073cefa407050f1bb680587d561ab91317f49232bfe977ba8cd3ab5104124ec60ed54eb58be2021c49f5c417bf1f2731c75fe8f5eff13497c0319480ec47a775bb1285e0cb4e3cb82e41c8a23f7a747fe38839fb8d8b915ae401a12601b311706731e1034fe7c8d5e5008d268792e374b3462cb44aa963b5a961df107d52d51ad4c264208961cbcb7bc58072c007841749e93b1d68fd8d0f2f4e0d55c75bc7cc2c35795d73079a14ffd4d67de5a4701b4cc2c101c51b53629061796743e1c76b230001bf9a28c0f14d83d554890a0771d98672f8aa1b2e9bb35c8c6bc38b205c5dc84994fef5acb56ad9c13facce5727f41ab73db275950f552a8ae9ce1166f23a74dc9856be07d325a456d5132186f2606bf6cfee7bf1f3a019c86341967270e123ba9e5c9d9c49b1ee484c80b29e0c6483f7ab065c8fdf2f06a03b767f2ac71ec040b56408b302a91ad304f65d6b9f8506f119fd40dbfdcd099377fbaff207e1aedcd205a2752de1c69ff609f6f4a0eb6900d58425893336e99113a8169b4079f90fb2faac35f8197229e44d6120fdc8a10b4d45da408826efe26d39799eb048e512eef442efce7eacf0dc28c05b1bdc38ee8da0490e3f90663b2be76b77daeadfcdbc8e8c04bfa2d374caa52f146eb6e1e4927a418203f67b1f6df4fe6567a947703dcbb5ff36459f0e8d9897ee848de27b971b970aba3101ce7ea4064282ea696ef88348e64902768c32ccb577f38319526df00e3fc1ace0c4bd113d8c5f29d4583912d5d922e3e12e16aafdda170281098b50e6b8e7d4f6b158236617879f2d318a7819c5a18ad1dcfd61bfbbdede6b5173b8e1b30a38c10ab131a9bd72db75aaf91f0c5b927d2586e992b5c309fb73e19bbb7c5d02018c17a30957bd03763a1e8bb78742d229fa005033d04762a062eeffa42f43f529aef3162cf4d6db104e81d69c82936ec9ee9121e7aef9813981e1a07a859cd3cf1fd3f18f3930c34dbe3c3d74691ff43f1e8dc3bdcae02b2017931865f242ad2182e4f21d7b49e9301b026ef3450dfec876eedf747815ae51e565d83a58c52e8553f4d5e95f631bb90740ef9eb5ab098f087fb32314218f45ac6b3314d6ab77aa7bddd01393209bf385d9ed96b1008d4481354ec718ae65e59ccc035541718d7e6f4df2a2ca5a37e04c150781fd9c23c195355d267a8e0ba1576be3000e291bcb15baab0ec7b1f553bb04a731bfb5d8ae8f971ed3b79b1dded14499741100fcab4689c8800425a52db5123d3958c60ef149d89755a76422876ee625e8476672d8c93677d05d976623e11753075731ec0ffdb2ea7397935ce101687f16777f60775c668dd1dab5da301554e643f0b37e9a6f15dce884da1c2d4d94c063fe9c55ddd13136d9590b5a2430c98dc49aea5c204b6731533d79128a3c68484834ce33edabe4275813295e9463d4591a292744db752f1c95447b4054a794e139acf53c70cb33661e9aee0c6e1368fac018964e4b1f4683ff2802d77dd818532e19b4f60964ef2a4c2d8058ad56d997b85578b72c8dfde589904ee7195ce3319f8bb8ce248f14da6468fc79751050ee2ce6572b925847876185bb350ea629f5b6708161b9734da85b5f16c5f1370b576f4d33e3ddda5d33c55a1c282637416324f1409b04a2a2fbfe6d2e0450b8f95f3eaee8f143b5c697368b3c76d27454d034bb626aae1aafe493310a6fd18cfb878c720afd86fe46f84294e4b04e12b11063a0f2b40ab1121e34a68850574cd84c47a5d0c650dd22650721bbabbc132f6ebc0890140a136193262a1989610c1205cadca297227fccccd5529562df76034edfb7fdf763ae67bf56c607c8fe90e5094a58a0355afe8ef131ffc60f23022bceec02c6b7d02f1263fe491132f280460b993c187d6df74364a262dcd13d122e13f07e83fd0a2163e644edab08ef5a4b81e74b9547d6a44237ee85f84225e14464c5d85e02a670295b1b8121aebbe893bfa7b7fdc6e3efc115c109c5fc61be3a6198e0dbb2532accfffe1f92fd743c3fc260c01401313affc8768d79d05bbb9cf96d67c9b407fe61d55fe8808f31d71c8590e99311fa4638829b2f4ee94115266f988c6eb54410c6c6fd683a11666050ea682aaee4fee34968c698c80fbf3d71c194ae17a9908755f2c29e87de8cd46736c6eef5a011bdfdd52aba87fa8bc98b297d4a3c1af4880c9ea68b2cc678345c463f93359766798a504430e3351593514907e7ad7e078c34684a3c59eb3fed8ff069d75ee602386166a1775c9c6e5ac88f3f67700529521f9b77ccc07135116c493d17c25f723a3ef92bc02dffaf833b842edc870513090a61d2dd9266558edb047d5b27a921ecf329831d589e87d33bc2d95bad072ad3190e42416172523a56f3b6109807405010558f4c07ab59576dde4d198e3990451463317206efe1abaac9e0c5925b0c4f86c25a1a1e8f355accd2f6114b4d8547ee93e2b2f440204d6c95bdcb6f4c90a1448c211a906048a7c374dca8c5b386a1df47d5f49c18c7b89daf6f7d9f5b5e561f8c7dff155953e1a59cf12958a4bac0a19106352958878650179c8748c3183a814f328a3b7bd82944c0e7324840497898bef6cc813a81eedf98efd8adfe5b29f13b8906e815ff6e5c4cf8f9ec68fa63cb8890ba00bda88160936be2ff9285f61ef5ee0d2ea0e739604b013a0e260ddaf994bf33892c90958d85dccf12e203a1fb3b6098ecb668805cc8074312f7d93450f173954f4b1ecddfd5fef1d91bfe6d37bc701f139e84814e47723a0ea229a33754423b55f606a4d95429e26064ddd37c03e929b52cd025106fa13ec739cb36aaa1447bc9d977c91a738af4d72f3c475daf9da7af56ff5bae0576987ec3775ca142acb317059c87692434f1aaf6ed866a55d54fc5f8d464b10a163931a75ac02b7e74fe8f46306f663586853a52eaf2433dc1551f6a6eadf6e8a30a3d8dd4df017fb86d9ca2db2813adea9516472392e05e57bfdb4078f2b0734707813d85b11cb4da10e575ea66a5223bee99fd25f738f64217b58c8634aadddea8fcf31b9294c5801bd3a7d443809fdf36d2749f982a3dc5a3689fbfe1de956d8a4d196f38094678b9842ca3"}, 0x1008, 0x800) getsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000040)={@loopback, 0x60b, 0x0, 0xff, 0x1, 0x8001, 0x8}, &(0x7f0000000080)=0x20) [ 2752.413949] binder: undelivered TRANSACTION_ERROR: 29201 [ 2752.419723] binder: BINDER_SET_CONTEXT_MGR already set [ 2752.431984] binder: 3904:3905 unknown command 0 14:35:45 executing program 2: syz_open_procfs$namespace(0x0, &(0x7f0000000100)='ns/net\x00') syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/net\x00') ioctl$TIOCGPGRP(0xffffffffffffff9c, 0x540f, &(0x7f0000000040)=0x0) syz_open_procfs$namespace(r0, &(0x7f0000000080)='ns/ipc\x00') syz_open_procfs$namespace(r0, &(0x7f00000001c0)='ns/cgroup\x00') 14:35:45 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xfc\xff\xff\xff\x00'}}}}, 0x68}}, 0x0) [ 2752.466174] binder: 3887:3889 ioctl 40046207 0 returned -16 [ 2752.466582] binder_alloc: 3887: binder_alloc_buf, no vma [ 2752.480716] binder: 3904:3905 ioctl c0306201 20000600 returned -22 [ 2752.532448] binder: 3887:3908 transaction failed 29189/-3, size 0-0 line 3035 [ 2752.537802] binder_alloc: 3887: binder_alloc_buf, no vma [ 2752.558170] binder: 3887:3889 transaction failed 29189/-3, size 0-0 line 3035 14:35:45 executing program 3: dup2(0xffffffffffffffff, 0xffffffffffffffff) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, &(0x7f00007b1000), 0x4) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pipe2(&(0x7f00007f2000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f00000000c0)=@nat={'nat\x00', 0x19, 0x1, 0x168, [0x20000200, 0x0, 0x0, 0x20000230, 0x20000308], 0x0, &(0x7f0000000000), &(0x7f0000000480)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff01000000030000000800000000000000616d300000000000000000000000627269646765300000000000003d08d4db70365f76746930000000000000000076657468315f746f5f626f6e64000000ffffffffffffffffff00ff00aaaaaaaaaabbff000000ffff00177431d0dcc0c21d76b0007000000070000000a8000000736e61740000000000000000000000002200000000000000000000000000000010000000000000000180c200000e0000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000001000000fcffffff000000000000000000000000000000000000000000000000000000000000000000000000000000000100381e8b898ae4a953fa6f3911c6bf049d9f84df9cc1a024b0c9614adcf56ce4aa6515365e8f9a9e26080eb906d3c57d080eccb5edcfd197e26174a181c702626b058ebb71cc511f010f07f78823cd9f0b949b67e0b84d33d6ce2ad05b17d5b14e6a6cb3c4d1e100a236225258af0618ecab07aa21b858228ebd"]}, 0x259) vmsplice(r1, &(0x7f0000e79000)=[{&(0x7f00003fb000)="f7", 0x1}], 0x1, 0x0) r2 = syz_genetlink_get_family_id$fou(&(0x7f0000000140)='fou\x00') sendmsg$FOU_CMD_ADD(r0, &(0x7f0000000440)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000400)={&(0x7f0000000200)=ANY=[@ANYBLOB="440001049934ed5e71d4e4c5eefce86e9aadce96ae8e207caac6f9dce0e58756db3e12c1d5ef580e5a5f154fa432d6baea402280585a8af41bb1f1064262f6140eebe35871fe301c9af74f4d4d904f6afbf50f8d5294128f5ea6bb02b01c0398e2fa3f8513c1fffd3e5cad799d3491255d022520af9c4f6cfad6f2fcdd14", @ANYRES16=r2, @ANYBLOB="100228bd7000fddbdf250100000008000400020000000800040003000000040005000400050008000300ff00000004000500080001004e23000004000500"], 0x44}, 0x1, 0x0, 0x0, 0x20000000}, 0x40) mbind(&(0x7f00003b5000/0x800000)=nil, 0x800000, 0x0, &(0x7f0000000080), 0x1, 0x3) ioctl$CAPI_INSTALLED(r0, 0x80024322) r3 = syz_open_procfs(0x0, &(0x7f00000001c0)='mounts\x00') sendfile(r3, r3, &(0x7f0000000180)=0x74000000, 0x5) 14:35:45 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00`\x00'}}}}, 0x68}}, 0x0) [ 2752.584505] binder: send failed reply for transaction 8942, target dead [ 2752.617291] binder: undelivered TRANSACTION_ERROR: 29189 [ 2752.622901] binder: undelivered TRANSACTION_ERROR: 29189 14:35:45 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x12, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:35:45 executing program 4: r0 = syz_open_dev$mice(&(0x7f0000000080)='/dev/input/mice\x00', 0x0, 0x40000) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r0, 0xc0405519, &(0x7f00000000c0)={0x2, 0x6, 0x6, 0x72, '\x00', 0x672}) r1 = syz_open_dev$sndseq(&(0x7f0000042000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r1, 0xc058534b, &(0x7f0000000000)) 14:35:45 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x3cb, 0x0, &(0x7f0000000100)=ANY=[@ANYRESHEX=r1], 0x6a, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000a250b00bd8c479412fdd7620a750466bda29228"], 0x0, 0x0, 0x0}) 14:35:45 executing program 2: syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/net\x00') r0 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x0, 0x501200) syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/net\x00') ioctl$EVIOCGEFFECTS(r0, 0x80044584, &(0x7f0000000500)=""/235) [ 2752.730879] binder: 3928:3929 unknown command 0 [ 2752.761905] binder: 3933:3934 unknown command 808482864 [ 2752.770197] binder: 3928:3929 ioctl c0306201 20000600 returned -22 [ 2752.796723] binder: 3933:3934 ioctl c0306201 20000140 returned -22 14:35:45 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03@\x00'}}}}, 0x68}}, 0x0) 14:35:45 executing program 2: syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/net\x00') r0 = socket$inet6_dccp(0xa, 0x6, 0x0) getsockopt$inet6_dccp_buf(r0, 0x21, 0xf, &(0x7f0000000100)=""/166, &(0x7f0000000040)=0xa6) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000240)='/dev/hwrng\x00', 0x80000, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) io_setup(0x8, &(0x7f0000000100)=0x0) close(r2) openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x0, 0x0) io_submit(r3, 0x1, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x5, 0x0, r2, 0x0}]) ioctl$TIOCSTI(r1, 0x5412, 0x9) syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/net\x00') r4 = syz_open_dev$mouse(&(0x7f0000000080)='/dev/input/mouse#\x00', 0x9, 0x0) ioctl$BLKPG(r4, 0x1269, &(0x7f0000000200)={0x0, 0x200, 0x23, &(0x7f00000001c0)="605edafa331041d62dcc990079ed7de2b0e57156fa9f2ee9a4a10d266807e3bb95f813"}) [ 2752.824342] binder_alloc: 3933: binder_alloc_buf size 2147483648 failed, no address space [ 2752.832852] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288) 14:35:45 executing program 3: bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000100)='mounts\x00'}, 0x30) flock(r0, 0xa) r1 = syz_open_procfs(0x0, &(0x7f00000001c0)='mounts\x00') sendfile(r1, r1, &(0x7f0000000180)=0x74000000, 0x5) open_by_handle_at(r1, &(0x7f0000000000)={0xf9, 0x7ff, "4308e74f5588c2baf642b798ba810920d4d03f641cb318b81aaf41044c2104655c977921e7a29ceaeaccf6c7edf1ea56dd01ebcb3422ab74d26b01930c3be3390cee208b44bf9129353df162ee60859d2347bc452508d899ea1a0c5bf0468056cd27f400298a8fb92cbd7403a96fe2586051b6e202d2a81171d41b9e4585579d8884eaa2b789806c7d5d03a937d0ecb398f9ca3f0e6a2d4aedd86d14eaae48bba4f01d72b29f08eb5b31487fdd145eb9f154a350a93b2fbfbf6982447ab4cf3396a61d07dde6ccfb27470b4f1acea16499b3fcfe1ef095d637669ea0651e6aecc1e2168330d00d949a45ac03fb59a54d2b"}, 0x111800) 14:35:45 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x12000000, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 2752.873910] binder: 3933:3934 transaction failed 29201/-28, size 0-2147483648 line 3035 14:35:45 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x004\x8c\x00'}}}}, 0x68}}, 0x0) 14:35:45 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='mounts\x00') sendfile(r0, r0, &(0x7f0000000180)=0x74000000, 0x5) r1 = getpgid(0x0) getresuid(&(0x7f0000000200)=0x0, &(0x7f0000000240), &(0x7f0000000280)) getresgid(&(0x7f00000002c0), &(0x7f0000000300)=0x0, &(0x7f0000000340)) ioctl$TIOCGPGRP(r0, 0x540f, &(0x7f0000000380)=0x0) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000003c0)={{{@in=@remote, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@loopback}, 0x0, @in=@empty}}, &(0x7f00000004c0)=0xe8) lstat(&(0x7f0000000500)='./file0\x00', &(0x7f0000000540)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$TIOCGPGRP(r0, 0x540f, &(0x7f00000005c0)=0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f0000000600)={{{@in6=@mcast2, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@broadcast}, 0x0, @in6=@local}}, &(0x7f0000000700)=0xe8) stat(&(0x7f0000000740)='./file0\x00', &(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$TIOCGPGRP(r0, 0x540f, &(0x7f0000000800)=0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f0000000840)={{{@in6=@local, @in=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast2}, 0x0, @in=@broadcast}}, &(0x7f0000000940)=0xe8) r12 = getegid() r13 = getpgid(0xffffffffffffffff) lstat(&(0x7f0000000e40)='./file0\x00', &(0x7f0000000e80)={0x0, 0x0, 0x0, 0x0, 0x0}) getresgid(&(0x7f0000000f00), &(0x7f0000000f40)=0x0, &(0x7f0000000f80)) r16 = gettid() lstat(&(0x7f0000000fc0)='./file0\x00', &(0x7f0000001000)={0x0, 0x0, 0x0, 0x0, 0x0}) r18 = getgid() ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f0000001080)=0x0) fstat(r0, &(0x7f00000010c0)={0x0, 0x0, 0x0, 0x0, 0x0}) getgroups(0x3, &(0x7f0000001140)=[0x0, 0xee00, 0xee00]) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000001180)={0x0}, &(0x7f00000011c0)=0xc) stat(&(0x7f0000001200)='./file0\x00', &(0x7f0000001240)={0x0, 0x0, 0x0, 0x0, 0x0}) lstat(&(0x7f00000012c0)='./file0\x00', &(0x7f0000001300)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmmsg$unix(r0, &(0x7f0000001440)=[{&(0x7f0000000000)=@abs={0x0, 0x0, 0x4e23}, 0x6e, &(0x7f0000000140)=[{&(0x7f0000000080)="913e7723567ebf87267b86ab6c1a78b7533532d36ed0759938e1d36206a0ba144a9c3fe0b39d93538b4617040e89454fd5261eeb491eb12b97930ab66b2b5c004d77dff0f494", 0x46}, {&(0x7f0000000100)="f69ae50aa7da779ab3b4772668306c3f5bd542b51c457ca8a9f5378a038f63902b8d36b62537", 0x26}], 0x2, &(0x7f0000000980)=[@rights={0x38, 0x1, 0x1, [r0, r0, r0, r0, r0, r0, r0, r0, r0]}, @cred={0x20, 0x1, 0x2, r1, r2, r3}, @cred={0x20, 0x1, 0x2, r4, r5, r6}, @rights={0x18, 0x1, 0x1, [r0]}, @cred={0x20, 0x1, 0x2, r7, r8, r9}, @rights={0x18, 0x1, 0x1, [r0, r0]}, @rights={0x20, 0x1, 0x1, [r0, r0, r0, r0]}, @rights={0x10}, @cred={0x20, 0x1, 0x2, r10, r11, r12}], 0x118, 0x4001}, {&(0x7f0000000ac0)=@abs={0x0, 0x0, 0x4e20}, 0x6e, &(0x7f0000000dc0)=[{&(0x7f0000000b40)="27300926560d8189ce9cc80a4e6faaf65e4f66d2c9e3b2434bbab84d6166a90f5812dc37a8a910c390acf899c4ce77b49f435b8bdbe112c7d7d6c15828b5b49816c3cfc2218dc6687f98a486bc9294f49290b7164e43fc061cd1e6397abec272b5efaff3d94bb6cf204e2c59167669df8d6d8a62572c81e8a04bacf00ab2ea22b4e73e8c0fa13f68119254cb94dcc2fa442866990223c7ae66cca9a77315df0dfb3ad718", 0xa4}, {&(0x7f0000000c00)="2ac07293bf92d15987430f2d6fde2f413b912e987e1b7eb72d95f638269b5a4845d7f2f10ad33b2efcabb0474d452e787655e3262cf0363b38ff", 0x3a}, {&(0x7f0000000c40)="28701093fb0b9ac93d668a7bcb63e46d9a6be59017eaf187c06916ad24b53c8a3ec8aebd373876f8dc4e1b6895ddb2583a2f3caa9c62f544a9ce40518bad9dbca46d2558d73612ffde9fdecc65d6d1635d242fbc2fab25b0edf9014b", 0x5c}, {&(0x7f0000000cc0)="f4c3bdb574cd7791d6a3c4f4954cb357224d67a4ca7608ddf35ce3b0803db141e2aee24db272482ee787f29db36649fb6d1acfe59bdac828a4f4c92be106f69ef7a2b301c49ebd912898b4a821adb777a21d3a2f751e37ca483c41b20d8b529f11abee333ea45ac6119dbed6ce92648469a294dc86adaaa6b1c920a8e410d3be487ff2b4efa1fde1addfb948fcb498846de8a5693261d29a1a34d4b51853da8520281b2731354e0e80670c14035d77e7bf3b20e80349a73fb2", 0xb9}, {&(0x7f0000000d80)="49ffff1254f0", 0x6}], 0x5, &(0x7f0000001380)=[@cred={0x20, 0x1, 0x2, r13, r14, r15}, @cred={0x20, 0x1, 0x2, r16, r17, r18}, @rights={0x18, 0x1, 0x1, [r0]}, @cred={0x20, 0x1, 0x2, r19, r20, r21}, @rights={0x28, 0x1, 0x1, [r0, r0, r0, r0, r0, r0]}, @cred={0x20, 0x1, 0x2, r22, r23, r24}], 0xc0, 0x40000}], 0x2, 0x4000000) [ 2752.933360] binder: 3942:3943 unknown command 0 [ 2752.942246] binder_alloc: binder_alloc_mmap_handler: 3933 20001000-20004000 already mapped failed -16 [ 2752.953028] binder: 3942:3943 ioctl c0306201 20000600 returned -22 [ 2753.036149] binder: BINDER_SET_CONTEXT_MGR already set 14:35:46 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x634040, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:35:46 executing program 2: syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/net\x00') r0 = syz_open_dev$audion(&(0x7f0000000040)='/dev/audio#\x00', 0x1, 0x2800) ioctl$SNDRV_SEQ_IOCTL_SUBSCRIBE_PORT(r0, 0x40505330, &(0x7f0000000100)={{0xc85, 0xf815}, {0x0, 0x3}, 0x7fff, 0x6, 0x5}) syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/net\x00') [ 2753.066014] binder: 3933:3934 ioctl 40046207 0 returned -16 [ 2753.092167] binder: 3933:3960 unknown command 808482864 14:35:46 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00`\x00'}}}}, 0x68}}, 0x0) 14:35:46 executing program 4: r0 = syz_open_dev$sndseq(&(0x7f0000042000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r0, 0xc058534b, &(0x7f0000000000)) socket$caif_stream(0x25, 0x1, 0x0) [ 2753.122660] binder: 3933:3960 ioctl c0306201 20000140 returned -22 [ 2753.136988] binder: 3963:3964 unknown command 0 [ 2753.180939] binder_alloc: 3933: binder_alloc_buf, no vma [ 2753.188572] binder: 3963:3964 ioctl c0306201 20000600 returned -22 [ 2753.196375] binder: undelivered TRANSACTION_ERROR: 29201 [ 2753.218784] binder: 3933:3934 transaction failed 29189/-3, size 0-2147483648 line 3035 14:35:46 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) fcntl$getownex(r0, 0x10, &(0x7f0000000100)={0x0, 0x0}) fcntl$setownex(r1, 0xf, &(0x7f0000000140)={0x1, r2}) r3 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x206440, 0x0) ioctl$PIO_UNISCRNMAP(r3, 0x4b6a, &(0x7f0000000280)="855ba6d034ae2501a7a793a6b82d6156a9e34c22631916a3bb740a2d97d5f28c39a89f006c90fc1593cc13ac58f5e2fcf80b220fb71b37ed38b421206a22838e617936c10baece289560ddaa070cbdbbc9a3aaf596c2b1ce36509fc17b1c03928b2a6c2d1055781bfb8daf11239ffc60de4a2cb5081bc5e9cb54da2d7c0a49d5312b24ebb941c0a1b5490b0157fa01d5345086ce018169d48eb11022666dd81d0e5a295b5d17d044aa614bf419bf1d4a0deefd3ee50b0ee226ade86eaa8586cf9a1c77db1b97374847ecdd3a375995b91780d2b05ef2fd224ac3eb8b199addbc623e87a61b17d81fafe62bde66bed2d2fee04b300b4906f97cc3") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="7032fcfffe8e162e96da9d53fb9f43b24049e9c418435a7e47ef235bd70cc4cd1b81f7e33653a649d5e4ceae40a62c9c3e80aef85cabe3bd6ce9dc1ee2783c7904ab3c0d352a73e9394286f402e14462de1aecbb72305e"], 0x0, 0x0, 0x0}) fcntl$getflags(r0, 0x401) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) lsetxattr$security_smack_transmute(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) [ 2753.263244] binder: undelivered TRANSACTION_ERROR: 29189 14:35:46 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='mounts\x00') sendfile(r0, r0, &(0x7f0000000180)=0x74000000, 0x5) r1 = geteuid() getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000080)=0x0) lstat(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0}) lstat(&(0x7f0000000200)='./file0\x00', &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000002c0)={{{@in=@initdev, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@dev}, 0x0, @in6=@loopback}}, &(0x7f00000003c0)=0xe8) r6 = getgid() getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000400)={{{@in6=@loopback, @in6=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in=@local}}, &(0x7f0000000500)=0xe8) lstat(&(0x7f0000000540)='./file0\x00', &(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r9 = geteuid() getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000600)={0x0, 0x0, 0x0}, &(0x7f0000000640)=0xc) getresuid(&(0x7f0000000680), &(0x7f00000006c0)=0x0, &(0x7f0000000700)) stat(&(0x7f0000000740)='./file0\x00', &(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) write$FUSE_DIRENTPLUS(r0, &(0x7f0000000800)={0x3d0, 0xfffffffffffffffe, 0x5, [{{0x2, 0x3, 0x1, 0x9f1, 0x4, 0x3, {0x2, 0x81, 0x7, 0x6, 0x7ff, 0x8, 0x3, 0x5bb, 0x7, 0x0, 0x82c, r1, r2, 0xfd88, 0x1}}, {0x2, 0x2, 0x7, 0x4, 'mounts\x00'}}, {{0x6, 0x3, 0xea2, 0x1000, 0xb2, 0x5, {0x3, 0x8001, 0x7, 0x5, 0x1ff, 0xffffffff00000001, 0x8000, 0x4, 0x3ff, 0x1, 0x4, r3, r4, 0x7a, 0x200}}, {0x3, 0x1, 0x7, 0x0, 'mounts\x00'}}, {{0x4, 0x1, 0x7ff, 0x3, 0xab78, 0x10001, {0x2, 0x8, 0x7, 0x800, 0x7, 0xeb, 0x400, 0x3, 0x633c649e, 0x4, 0x2e, r5, r6, 0x6, 0x9}}, {0x4, 0x7f, 0x7, 0x6, 'mounts\x00'}}, {{0x2, 0x3, 0x5, 0x6583, 0x5, 0x6, {0x5, 0x40, 0xc2f, 0xd2e8, 0x9c6a, 0xfff, 0x8, 0x0, 0x84, 0x3, 0x3012, r7, r8, 0x7fff, 0x4}}, {0x2, 0x0, 0x7, 0x8000, 'mounts\x00'}}, {{0x0, 0x0, 0x200, 0x55, 0x8, 0x6dd, {0x3, 0x3f, 0x1, 0xd9e0661, 0xfff, 0x7, 0x2, 0x3, 0x0, 0x1, 0x40, r9, r10, 0xffffffffffffff6d, 0x4}}, {0x1, 0x1, 0x7, 0x0, 'mounts\x00'}}, {{0x1, 0x0, 0x8, 0xa92c, 0xffffffffffffff67, 0x4, {0x5, 0x1f, 0x0, 0xfff, 0x3, 0x9, 0x5, 0x9d0, 0x6, 0x0, 0x4, r11, r12, 0x2, 0xdaf}}, {0x3, 0x100, 0x7, 0x1, 'mounts\x00'}}]}, 0x3d0) 14:35:46 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xf0\xff\xff\xff\xff\xff\xff\x00'}}}}, 0x68}}, 0x0) 14:35:46 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000000, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:35:46 executing program 2: syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/net\x00') ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000080)) r0 = getpgid(0xffffffffffffffff) syz_open_procfs$namespace(r0, &(0x7f0000000000)='ns/pid_for_children\x00') restart_syscall() r1 = syz_open_dev$audion(&(0x7f0000000040)='/dev/audio#\x00', 0xffffffffffffffff, 0x400) ioctl$TCSBRK(r1, 0x5409, 0xfffffffffffffffe) 14:35:46 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x7f\xff\xff\xff\x00'}}}}, 0x68}}, 0x0) 14:35:46 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='mounts\x00') sendfile(r0, r0, &(0x7f0000000180)=0x74000000, 0x6) ioctl$LOOP_SET_FD(r0, 0x4c00, r0) [ 2753.369627] binder: 3981:3982 unknown command 0 [ 2753.389777] binder: 3985:3986 unknown command -249232 [ 2753.392211] binder: 3981:3982 ioctl c0306201 20000600 returned -22 [ 2753.401125] binder: 3985:3986 ioctl c0306201 20000000 returned -22 14:35:46 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa00, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 2753.452705] binder_alloc: binder_alloc_mmap_handler: 3985 20001000-20004000 already mapped failed -16 14:35:46 executing program 2: r0 = syz_open_dev$dmmidi(&(0x7f0000000040)='/dev/dmmidi#\x00', 0x81, 0x0) write$FUSE_OPEN(r0, &(0x7f0000000080)={0x20, 0x0, 0x2, {0x0, 0x2}}, 0x20) syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/net\x00') 14:35:46 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='mounts\x00') sendfile(r0, r0, &(0x7f0000000180)=0x74000000, 0x5) vmsplice(r0, &(0x7f0000000200)=[{&(0x7f0000000000)="cf524e5f0c77fb8fb3352cf760b73a9e290d7e6b60f472b69ab377e2fb38008b7998b47c3fae3b82f5fa1601b58727d605c513331399aa0eff6bf1eb912254cdda3df640f6407affa304ef3ddbbc9ada0f52a2304dbf11f932e35e45b489085a57b3b90fa16ec15a45fc9d4a1d9f1a8bbf86507d9c3d8a94eadf9d87a11c734dcc899a22d3a0231bd8d2555685b428", 0x8f}, {&(0x7f00000000c0)="fb2ba0856e24d4590d6f00a408b4b8a9cbae6acfb0d870a2e5c38a26f4b9db0d1f41", 0x22}, {&(0x7f0000000100)="25dd750bc099efe236a8f242fef50c2f0fa1e7a1e4f606ca1cc043b3059200567fbd494976baa3f72a1b9b25cbea165f7386f6768ce7e1e9e16dafbea8c3011d30606dab4393feea628f4a2de37092dfe121e762db0e01beb4b8b944b2632bb0633e1ea1b93baf1815c5af62", 0x6c}], 0x3, 0x3) 14:35:46 executing program 4: r0 = syz_open_dev$sndseq(&(0x7f0000042000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0x400, 0x0) openat$cgroup_procs(r1, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r0, 0xc058534b, &(0x7f0000000080)={0x0, 0x0, 0x2}) openat$null(0xffffffffffffff9c, &(0x7f0000000100)='/dev/null\x00', 0x10880, 0x0) socket$inet_sctp(0x2, 0x5, 0x84) 14:35:46 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x04\x00'}}}}, 0x68}}, 0x0) [ 2753.540214] binder: BINDER_SET_CONTEXT_MGR already set [ 2753.557476] binder: 3985:3986 ioctl 40046207 0 returned -16 [ 2753.601702] binder: 4002:4003 unknown command 0 [ 2753.614641] binder: 3985:3991 unknown command -249232 [ 2753.619892] binder: 3985:3991 ioctl c0306201 20000000 returned -22 [ 2753.620700] binder: 3985:4009 transaction failed 29189/-3, size 0-0 line 3035 [ 2753.654366] binder: 4002:4003 ioctl c0306201 20000600 returned -22 [ 2753.674184] binder: release 3985:3986 transaction 8950 out, still active [ 2753.681120] binder: undelivered TRANSACTION_COMPLETE [ 2753.695273] binder: send failed reply for transaction 8950, target dead 14:35:46 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000040)) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:35:46 executing program 2: r0 = syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/net\x00') setns(r0, 0x50000000) syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/net\x00') 14:35:46 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='mounts\x00') ioctl$DRM_IOCTL_AGP_RELEASE(r0, 0x6431) sendfile(r0, r0, &(0x7f0000000180)=0x74000008, 0x9) 14:35:46 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x630c, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:35:46 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0f\x00'}}}}, 0x68}}, 0x0) 14:35:46 executing program 4: r0 = syz_open_dev$sndseq(&(0x7f0000042000)='/dev/snd/seq\x00', 0x0, 0x880) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r0, 0xc058534b, &(0x7f0000000000)) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r0, 0x404c534a, &(0x7f0000000080)={0x0, 0x8001, 0x401}) [ 2753.749239] binder: undelivered TRANSACTION_ERROR: 29189 [ 2753.802649] binder: 4022:4023 unknown command 0 [ 2753.842046] binder: 4022:4023 ioctl c0306201 20000600 returned -22 14:35:46 executing program 2: syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/net\x00') r0 = gettid() syz_open_procfs$namespace(r0, &(0x7f0000000040)='ns/net\x00') 14:35:46 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='mounts\x00') ioctl$KDSETLED(r0, 0x4b32, 0x10000) [ 2753.852177] binder: 4029:4031 unknown command 0 [ 2753.869798] binder: 4029:4031 ioctl c0306201 20000000 returned -22 14:35:46 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00`\x00'}}}}, 0x68}}, 0x0) [ 2753.925609] binder_alloc: binder_alloc_mmap_handler: 4029 20001000-20004000 already mapped failed -16 14:35:46 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40486311, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 2753.989711] binder: BINDER_SET_CONTEXT_MGR already set [ 2754.029541] binder: 4029:4034 ioctl 40046207 0 returned -16 14:35:46 executing program 2: syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/net\x00') syz_open_procfs$namespace(0x0, &(0x7f0000000100)='ns/ipc\x00') r0 = syz_open_dev$audion(&(0x7f0000000040)='/dev/audio#\x00', 0x2, 0x40000) ioctl$TIOCSBRK(r0, 0x5427) ioctl$KDADDIO(r0, 0x4b34, 0x6) 14:35:47 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00'}}}}, 0x68}}, 0x0) [ 2754.050156] binder: 4029:4047 unknown command 0 [ 2754.060844] binder_thread_write: 11 callbacks suppressed [ 2754.060857] binder: 4045:4046 BC_ACQUIRE_DONE u0000000000000000 no match [ 2754.080545] binder_alloc_new_buf_locked: 1 callbacks suppressed [ 2754.080554] binder_alloc: 4029: binder_alloc_buf, no vma [ 2754.093971] binder: 4029:4047 ioctl c0306201 20000000 returned -22 [ 2754.108577] binder: 4045:4046 unknown command 0 [ 2754.117915] binder: release 4029:4034 transaction 8953 out, still active [ 2754.134013] binder: undelivered TRANSACTION_COMPLETE [ 2754.135583] binder: 4029:4048 transaction failed 29189/-3, size 0-0 line 3035 [ 2754.139417] binder: send failed reply for transaction 8953, target dead 14:35:47 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r2 = socket(0x17, 0x8000a, 0xfe0) r3 = openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x80, 0x0) write$P9_ROPEN(r3, &(0x7f0000000200)={0x18, 0x71, 0x2, {{0x41, 0x0, 0x6}, 0x7}}, 0x18) ioctl$sock_bt_cmtp_CMTPGETCONNLIST(r2, 0x800443d2, &(0x7f0000000040)={0xa, &(0x7f0000000100)=[{}, {}, {}, {}, {}, {}, {}, {}, {}, {}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:35:47 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='mounts\x00') write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x8, {0x7, 0x1c, 0x3, 0x800, 0x3fb9, 0xffffffffffffff7f, 0x40}}, 0x50) write$binfmt_elf32(r0, &(0x7f0000000000)={{0x7f, 0x45, 0x4c, 0x46, 0x3, 0x1, 0x4, 0x0, 0x81, 0xffffffffffffffff, 0x3f, 0x9, 0x240, 0x38, 0x2000294, 0x8000000003, 0x1, 0x20, 0x2, 0x7, 0x4000000004, 0x8}, [{0x70000000, 0x8, 0x0, 0x24b3, 0x8, 0x5, 0x6}, {0x70000202, 0x355c, 0x0, 0x7, 0x1f, 0x1, 0x0, 0x9}], "5aaca904d18175850a321e32481c2d0dc45061550b70609134694a2f8aabcd0885c72232c29c70c64fa626a6b2890bdd61d220dc841373dc8c7c94830ed85b3b13d4990362ddff3edf408cea46b40dabd7f6341a6daffdf2ebc379731302d02fe8b6537fca4e973706433f51"}, 0xe4) sendfile(r0, r0, &(0x7f0000000180)=0x74000000, 0x5) 14:35:47 executing program 2: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vcs\x00', 0x2005, 0x0) ioctl$VIDIOC_DBG_S_REGISTER(r0, 0x4038564f, &(0x7f0000000080)={{0x4, @name="1ca2e9336c4825edeace512d2876ef4038df47d1d56526c9b31a781bda45df7d"}, 0x8, 0xc48, 0x2}) getsockopt$ARPT_SO_GET_INFO(r0, 0x0, 0x60, &(0x7f0000000140)={'filter\x00'}, &(0x7f0000000040)=0x44) syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/net\x00') syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/net\x00') 14:35:47 executing program 4: r0 = syz_open_dev$vcsn(&(0x7f0000000080)='/dev/vcs#\x00', 0x1, 0x400800) ioctl$VIDIOC_SUBDEV_G_EDID(r0, 0xc0285628, &(0x7f0000000100)={0x0, 0x3, 0xffffffff80000001, [], &(0x7f00000000c0)=0x1}) r1 = syz_open_dev$sndseq(&(0x7f0000042000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r1, 0xc058534b, &(0x7f0000000000)) [ 2754.158357] binder: 4045:4046 ioctl c0306201 20000600 returned -22 [ 2754.194675] binder: undelivered TRANSACTION_ERROR: 29189 14:35:47 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x363084000000000, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:35:47 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='mounts\x00') openat$vsock(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vsock\x00', 0x200000, 0x0) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r0, 0x84, 0x1f, &(0x7f0000000000)={0x0, @in6={{0xa, 0x4e22, 0x80, @remote, 0x9}}, 0x2, 0x820c}, &(0x7f00000000c0)=0x90) getsockopt$bt_BT_CHANNEL_POLICY(r0, 0x112, 0xa, &(0x7f0000000300)=0x1, &(0x7f0000000380)=0xffffffffffffff7b) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r0, 0x84, 0x1a, &(0x7f0000000200)=ANY=[@ANYRES32=r1, @ANYBLOB="bb000000b22460303e285d1c6538033a01762aadf507000000ab238842106ba97c3f67f16b424c719da06b50e8c997686bf45cbdf92b532bd1d9796c73424546f5dce9a16f8abacdb646ec8df9dd97f57bb1bba6a37dbe25772e809227d4f43905fdb04cccf2a1a59e316503ec275c447c851508147cab4803b76405933d06453f6d424b36f23c26894cdabf209881c21192da5f0e6755638da1ad2d09a2a5ed6cb9c77203cd80a7d6091e52b3b22869b2ef6d3eadd81ad8b68757aded27ea"], &(0x7f0000000100)=0xc3) sendfile(r0, r0, &(0x7f0000000180)=0x74000000, 0x5) 14:35:47 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xff\x00'}}}}, 0x68}}, 0x0) [ 2754.300863] binder: 4069:4070 BC_ACQUIRE_DONE u0000000000000000 no match 14:35:47 executing program 2: syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/net\x00') syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/net\x00') r0 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vsock\x00', 0x80400, 0x0) ioctl$FIONREAD(r0, 0x541b, &(0x7f0000000100)) ioctl$TUNSETSNDBUF(r0, 0x400454d4, &(0x7f0000000080)=0x9) getpeername$packet(r0, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000180)=0x14) connect$packet(r0, &(0x7f00000001c0)={0x11, 0x1f, r1, 0x1, 0x2}, 0x14) [ 2754.347699] binder: 4069:4070 unknown command 0 [ 2754.352442] binder: 4069:4070 ioctl c0306201 20000600 returned -22 14:35:47 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='mounts\x00') ioctl$SG_SET_TIMEOUT(r0, 0x2201, &(0x7f0000000000)=0x6) sendfile(r0, r0, &(0x7f0000000180)=0x74000000, 0x5) ioctl$void(r0, 0x5451) 14:35:47 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00'}}}}, 0x68}}, 0x0) [ 2754.395064] binder_alloc: binder_alloc_mmap_handler: 4066 20001000-20004000 already mapped failed -16 [ 2754.427185] Unknown ioctl 21531 [ 2754.434172] binder: BINDER_SET_CONTEXT_MGR already set [ 2754.441136] Unknown ioctl 1074025684 [ 2754.460392] Unknown ioctl 21531 14:35:47 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 2754.483134] Unknown ioctl 1074025684 [ 2754.485422] binder: 4066:4067 ioctl 40046207 0 returned -16 [ 2754.489259] binder: send failed reply for transaction 8956 to 4066:4067 14:35:47 executing program 3: ioctl$TIOCGPGRP(0xffffffffffffff9c, 0x540f, &(0x7f0000000000)) r0 = syz_open_dev$adsp(&(0x7f0000000080)='/dev/adsp#\x00', 0xfff, 0x400000) ioctl$IMGETCOUNT(r0, 0x80044943, &(0x7f0000000100)) setsockopt$CAIFSO_REQ_PARAM(r0, 0x116, 0x80, &(0x7f0000000300)="20d211ff58e07075f188ea7d80badad2ef0923151608f658200313cf11bdb999bfe342ca1ccc7b01bc31176414160abdefc35c5d1cac3e7be3dd95c02d1ebb0d92eeef3720c21dae8a3080e27baa211b98a7f286b44fb13874c272f034f08cfd52f9b2bbad64fddf909f594ab0d41ed822debd5c4fe9760e9f9b39475e8da399e56955ac3953582558188cc43655fcf3ac560deeeb4376f2f0b26436b7feb87ffede25b1ad2dd65e4263ebab0367dcc701a588b173b10e9051fc6987d6840a6608f5ac37e83d799a54cd224f6df5aee934027b0de56510881eaca292bffd09a7fa3dc8ccca37710a7b6e52fafcab554015389de18d78ca4b8e8d0f9e6f92dd", 0xff) ioctl$VIDIOC_G_AUDIO(r0, 0x80345621, &(0x7f0000000240)) ioctl$TIOCGSID(0xffffffffffffff9c, 0x5429, &(0x7f0000000040)) ioctl$TIOCGPGRP(0xffffffffffffff9c, 0x540f, &(0x7f00000000c0)=0x0) write$P9_RREADDIR(r0, &(0x7f0000000400)=ANY=[@ANYBLOB="c500160029010004000000000000000008eb947f0000000000000006000000000000000307002e2f66696c653000020000000000000000000000f4050000000000000207002e2f66302003000000070000000000000000000000000000000007002e2f66696c653040040000000400000000000000e98b0000000000000507002e2f66696c653090ca080000000000000000000007000000000000000307002e2f66696c6530c003000000030000000000000002000000000000000907002e2f6669ad3ec7c2b33ca5b06a072d4c870637ea58cd90f7a9bf0f9b9142c2b58eaa990fa749dd5ce069e9b3435db06b979187000000"], 0xc5) r2 = syz_open_procfs(r1, &(0x7f0000000140)='map_files\x00') sendfile(r2, r2, &(0x7f0000000180)=0x74000000, 0x5) [ 2754.527026] binder: send failed reply for transaction 8957 to 4066:4077 [ 2754.545687] binder: 4097:4098 BC_ACQUIRE_DONE u0000000000000000 no match 14:35:47 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000000000000000007429e74abc370686ea4aea4100000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) [ 2754.578416] binder: undelivered TRANSACTION_COMPLETE [ 2754.595850] binder: 4097:4098 unknown command 0 [ 2754.615885] binder_alloc: 4101: binder_alloc_buf size 1105873648 failed, no address space 14:35:47 executing program 2: syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/net\x00') syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/net\x00') [ 2754.623785] binder: undelivered TRANSACTION_ERROR: 29189 [ 2754.629891] binder: undelivered TRANSACTION_COMPLETE [ 2754.647725] binder: 4097:4098 ioctl c0306201 20000600 returned -22 14:35:47 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xf0\x00'}}}}, 0x68}}, 0x0) [ 2754.675547] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288) [ 2754.682403] binder: 4097:4098 BC_ACQUIRE_DONE u0000000000000000 no match [ 2754.695497] binder: 4097:4098 unknown command 0 [ 2754.704155] binder: 4101:4102 transaction failed 29201/-28, size 1105873642-0 line 3035 14:35:47 executing program 4: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x800000000000000, 0x0) syz_open_dev$sndseq(&(0x7f0000042000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = syz_open_dev$admmidi(&(0x7f0000000100)='/dev/admmidi#\x00', 0xff, 0x200003ffffe) ioctl$FIBMAP(r0, 0x1, &(0x7f0000000080)=0xffffffffffffff80) ioctl$SNDRV_TIMER_IOCTL_PAUSE(r1, 0x54a3) acct(&(0x7f0000000040)='./file0\x00') prctl$PR_SET_FPEXC(0xc, 0x10000) 14:35:47 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='mounts\x00') sendfile(r0, r0, &(0x7f0000000180)=0x74000000, 0x5) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000000)={0x0, @in6={{0xa, 0x4e23, 0x8, @remote, 0xfffffffffffffff9}}, 0xae, 0x7, 0x2, 0x5}, &(0x7f00000000c0)=0x98) getsockopt$inet_sctp_SCTP_ASSOCINFO(r0, 0x84, 0x1, &(0x7f0000000100)={r1, 0x1000, 0x273, 0x7, 0x35, 0xd20}, &(0x7f0000000240)=0x14) 14:35:47 executing program 2: syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/net\x00') r0 = syz_open_dev$swradio(&(0x7f0000000040)='/dev/swradio#\x00', 0x0, 0x2) r1 = syz_genetlink_get_family_id$tipc(&(0x7f0000000100)='TIPC\x00') prctl$PR_SET_THP_DISABLE(0x29, 0x1) sendmsg$TIPC_CMD_GET_NODES(r0, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x1c, r1, 0x200, 0x70bd28, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x24008000}, 0x20000000) syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/net\x00') [ 2754.731027] binder: 4097:4098 ioctl c0306201 20000600 returned -22 [ 2754.739838] binder_alloc: binder_alloc_mmap_handler: 4101 20001000-20004000 already mapped failed -16 14:35:47 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:35:47 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='fd/3\x00') sendfile(r0, r0, &(0x7f0000000180)=0x74000000, 0x5) [ 2754.836953] binder: BINDER_SET_CONTEXT_MGR already set [ 2754.870368] binder: 4101:4102 ioctl 40046207 0 returned -16 [ 2754.880142] binder: 4124:4125 BC_ACQUIRE_DONE u0000000000000000 no match [ 2754.928021] binder: 4124:4125 unknown command 0 14:35:47 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:35:47 executing program 2: r0 = syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/net\x00') setsockopt$inet6_udp_encap(r0, 0x11, 0x64, &(0x7f0000000100), 0x4) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/pfkey\x00', 0x200200, 0x0) ioctl$RTC_RD_TIME(r1, 0x80247009, &(0x7f0000000080)) syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/net\x00') 14:35:47 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00'}}}}, 0x68}}, 0x0) 14:35:47 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='mounts\x00') sendfile(r0, r0, &(0x7f0000000000)=0x74000000, 0x4000100000000) [ 2754.963693] binder: 4124:4125 ioctl c0306201 20000600 returned -22 [ 2754.989292] binder: 4131:4132 got transaction to context manager from process owning it 14:35:47 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe630c40, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 2755.055002] binder_alloc: binder_alloc_mmap_handler: 4131 20001000-20004000 already mapped failed -16 [ 2755.096685] binder: 4142:4143 BC_ACQUIRE_DONE u0000000000000000 no match [ 2755.110609] binder: BINDER_SET_CONTEXT_MGR already set [ 2755.116420] binder: 4142:4143 unknown command 0 [ 2755.128190] binder: 4142:4143 ioctl c0306201 20000600 returned -22 [ 2755.138754] binder: 4131:4132 ioctl 40046207 0 returned -16 14:35:48 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00'}}}}, 0x68}}, 0x0) 14:35:48 executing program 2: r0 = syz_open_dev$dmmidi(&(0x7f0000000040)='/dev/dmmidi#\x00', 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000080)=0x1, 0x4) syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/net\x00') syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/net\x00') [ 2755.139092] binder_alloc: 4131: binder_alloc_buf, no vma 14:35:48 executing program 4: r0 = syz_open_dev$sndseq(&(0x7f0000042000)='/dev/snd/seq\x00', 0x0, 0x0) mkdir(&(0x7f0000000100)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000280)='sysfs\x00*\x86OK\xc0\v\xce\x1b\xdb cr\x13\xb1\xe8\x94\xd1 q_\x9d\xc1\x12[\x04,r&\xeb\x016\xd9bN\xa1\xd23t\xa6`\xfeZ\xc1sr/\xd3g\xad\"\xe8U0%\xa2\xe8\xbe\v\xc5QCy\xafr\x13\xd3+\x8d]\x06\xdc\x8f\xbf,\x84\x9e\xd9\xcd\xef\xc7K\x03\xdf\xa9\xcbZ\x90\xb2\x8bK$\xd7\x86,=f\xfc\xa51g\xd5BB5CZ=\xbbv\xbc}0x0, 0x8, 0x9, 0x10000, 0x80}, &(0x7f0000000140)=0x14) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(r2, 0x84, 0x13, &(0x7f0000000180)={r3, 0x1000}, &(0x7f00000001c0)=0x8) 14:35:48 executing program 3: getpid() r0 = fcntl$getown(0xffffffffffffffff, 0x9) fchmod(0xffffffffffffffff, 0x2b) r1 = syz_open_procfs(r0, &(0x7f0000000140)='net/ip6_mr_vif\x00') sendfile(r1, r1, &(0x7f0000000180)=0x74000000, 0x5) ioctl$DRM_IOCTL_CONTROL(r1, 0x40086414, &(0x7f0000000040)={0x1, 0x6}) 14:35:48 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x600, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:35:48 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = dup2(r1, r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$KVM_SET_MP_STATE(r2, 0x4004ae99, &(0x7f0000000040)=0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="006340400000000000000000000000fffffffffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) 14:35:48 executing program 2: r0 = syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/net\x00') r1 = syz_open_dev$admmidi(&(0x7f0000000100)='/dev/admmidi#\x00', 0x5, 0xa80) ioctl$KVM_SET_PIT2(r1, 0x4070aea0, &(0x7f0000000140)={[{0x2, 0x227, 0x1, 0x7, 0x8, 0x6, 0x3ff, 0x0, 0xff, 0xe3, 0x6}, {0x4, 0x2, 0x10000, 0x2, 0x18af, 0x7fff, 0x6, 0x0, 0x6, 0x8, 0x10001, 0xad1, 0x4}, {0x1, 0xe144, 0x7, 0x7fffffff, 0xf6, 0x1, 0x89fa, 0x4, 0x1ff, 0x3, 0x6, 0x5cb, 0xff}], 0xe474}) fsetxattr$trusted_overlay_redirect(r0, &(0x7f0000000040)='trusted.overlay.redirect\x00', &(0x7f0000000080)='./file0\x00', 0x8, 0x3) syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/net\x00') 14:35:48 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00'}}}}, 0x68}}, 0x0) [ 2755.347549] binder: 4159:4165 BC_ACQUIRE_DONE u0000000000000000 no match [ 2755.379252] binder: 4159:4165 unknown command 0 [ 2755.384847] binder: 4168:4170 ioctl 4004ae99 20000040 returned -22 14:35:48 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='mounts\x00') ioctl$RTC_IRQP_SET(r0, 0x4008700c, 0x122e) sendfile(r0, r0, &(0x7f0000000180)=0x74000000, 0x5) 14:35:48 executing program 2: r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dlm-control\x00', 0x0, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, 0xffffffffffffff9c, 0x0, 0x7, &(0x7f0000000080)='ns/net\x00', 0xffffffffffffffff}, 0x30) ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r0, 0xc1105511, &(0x7f0000000180)={{0x4, 0x3, 0x8, 0x2, 'syz1\x00', 0x1}, 0x4, 0x0, 0x9, r1, 0x2, 0x21b6, 'syz1\x00', &(0x7f0000000140)=['ns/net\x00', 'ns/net\x00'], 0xe, [], [0x0, 0x200, 0xd13, 0x9]}) syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/net\x00') getdents64(r0, &(0x7f00000002c0)=""/58, 0x3a) syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/net\x00') 14:35:48 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\n\x00'}}}}, 0x68}}, 0x0) [ 2755.401932] binder: 4159:4165 ioctl c0306201 20000600 returned -22 [ 2755.419538] binder: 4168:4170 got new transaction with bad transaction stack, transaction 8964 has target 4168:0 14:35:48 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 2755.495449] binder_alloc: binder_alloc_mmap_handler: 4168 20001000-20004000 already mapped failed -16 14:35:48 executing program 2: syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/net\x00') r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x240, 0x0) ioctl$NBD_SET_TIMEOUT(r0, 0xab09, 0x3) syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/net\x00') 14:35:48 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xf0\x00'}}}}, 0x68}}, 0x0) [ 2755.590977] binder: 4186:4187 BC_ACQUIRE_DONE u0000000000000000 no match [ 2755.593639] binder: BINDER_SET_CONTEXT_MGR already set [ 2755.603557] binder: 4168:4170 ioctl 40046207 0 returned -16 [ 2755.610126] binder_alloc: 4168: binder_alloc_buf, no vma [ 2755.638625] binder: 4168:4189 ioctl 4004ae99 20000040 returned -22 [ 2755.663679] binder: 4186:4187 unknown command 0 [ 2755.675451] binder: 4186:4187 ioctl c0306201 20000600 returned -22 [ 2755.695530] binder: release 4168:4170 transaction 8964 out, still active [ 2755.698323] binder_alloc: 4168: binder_alloc_buf, no vma [ 2755.704727] binder: undelivered TRANSACTION_COMPLETE [ 2755.731947] binder: send failed reply for transaction 8964, target dead 14:35:48 executing program 4: syz_open_dev$sndseq(&(0x7f0000042000)='/dev/snd/seq\x00', 0x0, 0x0) 14:35:48 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='mounts\x00') dup2(r0, r0) sendfile(r0, r0, &(0x7f0000000180)=0x74000000, 0x5) 14:35:48 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00'}}}}, 0x68}}, 0x0) 14:35:48 executing program 2: r0 = syz_open_dev$swradio(&(0x7f0000000040)='/dev/swradio#\x00', 0x1, 0x2) getsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(0xffffffffffffffff, 0x84, 0x76, &(0x7f0000000080)={0x0}, &(0x7f0000000100)=0x8) getsockopt$inet_sctp_SCTP_MAXSEG(r0, 0x84, 0xd, &(0x7f0000000140)=@assoc_value={r1, 0x8}, &(0x7f0000000180)=0x8) syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/net\x00') syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/net\x00') 14:35:48 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:35:48 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa00000000000000, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 2755.845653] binder: 4203:4207 BC_ACQUIRE_DONE u0000000000000000 no match 14:35:48 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='mounts\x00') sendfile(r0, r0, &(0x7f0000000180)=0x74000000, 0x5) r1 = syz_genetlink_get_family_id$team(&(0x7f0000000280)='team\x00') accept4$packet(r0, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000300)=0x14, 0x80800) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000340)={0x0, @empty, @local}, &(0x7f0000000380)=0xc) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1f, &(0x7f00000003c0)={@remote, 0x0}, &(0x7f0000000400)=0x14) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000480)={{{@in=@multicast1, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@ipv4={[], [], @multicast2}}, 0x0, @in=@initdev}}, &(0x7f0000000580)=0xe8) getsockopt$inet_mreqn(r0, 0x0, 0x24, &(0x7f00000005c0)={@loopback, @local, 0x0}, &(0x7f0000000600)=0xc) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000640)={'team0\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000680)={'vcan0\x00', 0x0}) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000940)={{{@in, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@loopback}, 0x0, @in=@multicast1}}, &(0x7f0000000a40)=0xe8) getsockopt$inet6_mreq(r0, 0x29, 0x1d, &(0x7f0000000a80)={@remote, 0x0}, &(0x7f0000000ac0)=0x14) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000b00)={{{@in6=@initdev, @in, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@loopback}, 0x0, @in6=@dev}}, &(0x7f0000000c00)=0xe8) getsockopt$inet_mreqn(r0, 0x0, 0x24, &(0x7f0000000c40)={@empty, @empty, 0x0}, &(0x7f0000000c80)=0xc) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000cc0)={'nr0\x00', 0x0}) r14 = accept(r0, &(0x7f0000000d80)=@hci={0x1f, 0x0}, &(0x7f0000000e00)=0x80) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffff9c, 0x29, 0x23, &(0x7f0000005380)={{{@in6=@mcast2, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast2}, 0x0, @in=@dev}}, &(0x7f0000005480)=0xe8) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r14, 0x29, 0x20, &(0x7f0000000440)={@mcast1, 0xaca, 0x3, 0xff, 0x4, 0x8001, 0xffffffffffff0001}, 0x20) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000005680)={{{@in6=@mcast1, @in=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@loopback}, 0x0, @in6}}, &(0x7f0000005780)=0xe8) sendmsg$TEAM_CMD_OPTIONS_GET(r0, &(0x7f0000005e00)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x5100000}, 0xc, &(0x7f0000005dc0)={&(0x7f00000057c0)={0x5cc, r1, 0x300, 0x70bd25, 0x0, {}, [{{0x8, 0x1, r2}, {0x78, 0x2, [{0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8}, {0x8, 0x4, 0x6}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}]}}, {{0x8, 0x1, r4}, {0x128, 0x2, [{0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8}, {0x8, 0x4, 0xfffffffffffeffff}}}, {0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x8}, {0x8, 0x4, r5}}}, {0x3c, 0x1, @user_linkup={{{0x24, 0x1, 'user_linkup\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r6}}}, {0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x8}, {0x8, 0x4, 0x100}}, {0x8, 0x6, r7}}}, {0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x8}, {0x8, 0x4, r8}}}]}}, {{0x8, 0x1, r9}, {0x4}}, {{0x8, 0x1, r10}, {0xc0, 0x2, [{0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8}, {0x8, 0x4, 0x4}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x8}, {0x8, 0x4, 0x100000000}}}, {0x4c, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x8}, {0x1c, 0x4, [{0xb, 0x6, 0x1, 0x3}, {0x5, 0x7, 0x6b, 0x20}, {0x1, 0x2, 0x0, 0x8001}]}}}]}}, {{0x8, 0x1, r11}, {0x234, 0x2, [{0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}, {0x3c, 0x1, @user_linkup={{{0x24, 0x1, 'user_linkup\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r12}}}, {0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x8}, {0x8, 0x4, 0x9}}, {0x8, 0x6, r13}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}, {0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x8}, {0x8, 0x4, r15}}}, {0x40, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x8}, {0x10, 0x4, 'loadbalance\x00'}}}, {0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8}, {0x8, 0x4, 0xfccc}}, {0x8, 0x6, r16}}}, {0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8}, {0x8, 0x4, 0x80000001}}, {0x8}}}, {0x44, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x8}, {0x14, 0x4, [{0xa9, 0x5fbd, 0x3, 0xacd}, {0x1000, 0x6, 0x60af, 0x6}]}}}]}}, {{0x8, 0x1, r17}, {0xf0, 0x2, [{0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x8}, {0x8, 0x4, 0x3}}}, {0x44, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x8}, {0x14, 0x4, 'activebackup\x00'}}}, {0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8}, {0x8, 0x4, 0xc5}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x8}, {0x8, 0x4, 0xfffffffffffff0ad}}}]}}]}, 0x5cc}, 0x1, 0x0, 0x0, 0x4}, 0x1) ioctl$SNDRV_RAWMIDI_IOCTL_INFO(r0, 0x810c5701, &(0x7f0000000000)) fsetxattr$trusted_overlay_opaque(r0, &(0x7f0000000140)='trusted.overlay.opaque\x00', &(0x7f0000000200)='y\x00', 0x2, 0x2) [ 2755.888731] binder: 4208:4211 got new transaction with bad transaction stack, transaction 8969 has target 4208:0 [ 2755.909006] binder: 4203:4207 unknown command 0 14:35:48 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xa1\x00'}}}}, 0x68}}, 0x0) 14:35:48 executing program 2: syz_open_procfs$namespace(0x0, &(0x7f0000000040)='n_/net\x00') r0 = syz_open_dev$vcsn(&(0x7f00000000c0)='/dev/vcs#\x00', 0x6, 0x400001) ioctl$TIOCSTI(r0, 0x5412, 0x5) syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/net\x00') openat$vim2m(0xffffffffffffff9c, &(0x7f0000000080)='/dev/video35\x00', 0x2, 0x0) [ 2755.936765] binder: 4203:4207 ioctl c0306201 20000600 returned -22 [ 2755.955489] binder_alloc: binder_alloc_mmap_handler: 4208 20001000-20004000 already mapped failed -16 [ 2755.966028] binder: BINDER_SET_CONTEXT_MGR already set 14:35:48 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1263484000000000, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 2756.002403] binder_alloc: 4208: binder_alloc_buf, no vma [ 2756.020958] binder: 4208:4211 ioctl 40046207 0 returned -16 [ 2756.041098] binder: release 4208:4211 transaction 8969 out, still active [ 2756.061532] binder: undelivered TRANSACTION_COMPLETE 14:35:49 executing program 2: syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/net\x00') syz_open_procfs$namespace(0x0, &(0x7f0000000080)='ns/net\x00') 14:35:49 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='mounts\x00') sendfile(r0, r0, &(0x7f0000000180)=0x74000000, 0x5) r1 = getpid() stat(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0}) lstat(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fremovexattr(r0, &(0x7f0000000380)=@known='trusted.overlay.impure\x00') ptrace$PTRACE_SECCOMP_GET_FILTER(0x420c, r1, 0x9, &(0x7f0000000300)=""/106) setsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000200)={r1, r2, r3}, 0xc) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(r0, 0xc0bc5310, &(0x7f0000000240)) [ 2756.089428] binder: send failed reply for transaction 8969, target dead [ 2756.115407] binder: 4229:4230 BC_ACQUIRE_DONE u0000000000000000 no match [ 2756.150053] binder: 4229:4230 unknown command 0 [ 2756.170279] binder: 4229:4230 ioctl c0306201 20000600 returned -22 14:35:49 executing program 4: r0 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x3, 0x2) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f0000000140)={0x0, 0xffffffffffffffc7, &(0x7f0000000240)=[@in6={0xa, 0x4e23, 0x1ff, @loopback, 0x7ff}, @in={0x2, 0x4e20, @rand_addr=0x6250}, @in6={0xa, 0x4e21, 0x8, @local, 0x3}, @in={0x2, 0x4e21, @multicast2}]}, &(0x7f0000000180)=0x7) getsockopt$inet_sctp_SCTP_GET_PEER_ADDRS(r0, 0x84, 0x6c, &(0x7f00000001c0)={r1, 0x2d, "88658488eabb46a1306309b4e9f93267c874391312e6dd80b0b6de6997532044d90defb7cfb4574443e3db1d2d"}, &(0x7f0000000200)=0x35) r2 = syz_open_dev$sndseq(&(0x7f00000000c0)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r2, 0xc058534b, &(0x7f0000000000)) 14:35:49 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00'}}}}, 0x68}}, 0x0) 14:35:49 executing program 0: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x220000, 0x0) ioctl$sock_inet_SIOCSIFDSTADDR(r1, 0x8918, &(0x7f0000000080)={'eql\x00', {0x2, 0x4e22, @remote}}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0xfffffe5a, 0x0, &(0x7f00000000c0), 0x33d, 0x0, 0x0}) 14:35:49 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='mounts\x00') sendfile(r0, r0, &(0x7f0000000180)=0x74000005, 0x2c0) 14:35:49 executing program 2: r0 = getpgid(0x0) syz_open_procfs$namespace(r0, &(0x7f0000000040)='ns/pid\x00') r1 = syz_open_dev$vcsa(&(0x7f0000000080)='/dev/vcsa#\x00', 0xff, 0x400000) openat$cgroup_ro(r1, &(0x7f00000000c0)='cpuset.effective_mems\x00', 0x0, 0x0) r2 = getpgrp(r0) syz_open_procfs$namespace(r2, &(0x7f0000000000)='ns/net\x00') [ 2756.211658] binder: 4229:4230 unknown command 0 [ 2756.230990] binder: 4229:4230 ioctl c0306201 20000600 returned -22 14:35:49 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a00000000000000, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:35:49 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000100)='/proc/self/net/pfkey\x00', 0x80000, 0x0) r3 = gettid() stat(&(0x7f00000017c0)='./file0\x00', &(0x7f0000001800)={0x0, 0x0, 0x0, 0x0, 0x0}) r5 = getgid() r6 = fcntl$getown(0xffffffffffffffff, 0x9) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000001880)={0x0, 0x0}, &(0x7f00000018c0)=0xc) stat(&(0x7f0000001900)='.\x00', &(0x7f0000001940)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$unix(r2, &(0x7f0000001a80)={&(0x7f0000000180)=@abs={0x0, 0x0, 0x4e24}, 0x6e, &(0x7f0000001740)=[{&(0x7f0000000200)="ae3114c2fb220cffdf693869c1c24ecfbbe61f50ce46f3a7cf3c8d64855f342b0255d93efb79b0f42795a8f66a05225fbecd1eddbcbc67969d429e792f2c499fe001557ac534ab9ad3e489357baa34fab112b01ecee4f682a6973013d3e52cc850f85263ba25d8d6da9edaf7aee7ce231c62778d66d4e11631b1c57aef2439f698ce5a9c737825c9fed961c740ddcf19830fd3be42e7936a96913bc9d3be6b0efd70e96ca41be6735a39c9683976d7346068d8e00d1edffe90a84c5880efd69dc3fa9cac5d440a86ff34c914bf42937167b753f5341bd4ddfa92c5", 0xdb}, {&(0x7f0000000640)="f1181e3be0fc13f7a63981ebbce7dd99207c05167c63b6314f5569b4180c275b2578ccab801f141afce8f619531074e278b46f36032f266f4cf44a9ca13ef0ac0d38110b96f83870fed74a50ad93dc49b3dcb23a0345b93d02fc343e7ee5a5cecb0a9ef24c87b0d984a650de4dca92ddca253b8702e9d7b3f175d6dcc80258955d00531815a237483728c635eb6524142f40e1ed3e8109acf6747dfcd48f933ea51bd7269082e4da0cb7dc8ed1979a33a7237bcee92efc19324a35e9471efffcaad6bcbfb70acc55e2a515daca057ec0f3cc2a18e2216841be2bb897d03064ac3547aecb84e9d69736f7e74d35310ad06c8d1f41bd2ea749dc2415f476c797a9ba583d2d7e774c08c9479101fae0611d2098fc303189d47f8cbc5057aef7045232f4f8aace49199fc68c80472e82ffca27cdb1549e13c132aed633027c850cb52e0775fed368179e90ced17656d15198a6103e8a497f85413320de705f80148bcf1232069b4610122a9354311031c5fd2827b490f4014022b7c8000cb2e42116b979565049fd0ce4b3d0df0f4589c5a66518e67269e3e92aef0664539971c558403295bb2b39fbb9a11e0a26f33e94b69d64e8f6044d3e4c71aaf97a0700c4e3d38825d149af63a8b4052fbf1fc2c934f65be96ddd86eec3d8883d45ee9eebaa8844c47c7c9c46401899c9938e7f1832cf52a92658eabeb8ae67a8adc8245644c7045c79dd30a7cc13dafd77bbb6a567c33d6710ecc05fe07360d8cccbce9ecd2c1d08e59dd6a4baf3e7f61abfe76edc86925cd18bdb67f99e5634cc9faf71d567eac74d01fc57cbb9ad0afc163cc8a02695bfc9f30784ec7b8b6096edf0a043b1c44b1f865c762b7ab50c9b583d193407d428ae6a5278606794486d3d378dea76f4d334af081c3c0bade2541c27c69acb28b0597f6f6d58d8fd6d804d3536d3df76247d6aa154e702395611e676ba7834f36c9900e477fdb5d55c890b980c5fc03c56357db527c3f2c18847459ade8f080f0f27bb2162541d8be1f7c1775826344974fe0f14cf25eb9ebe29ab12b31aea6a3103fe85493db595969d2222bdbd4da6783aa83dc5ca6f8af579446258fe6842d246a8da4ad91748c44596bab24f3d7ffc1f1ab9164186883ba3d2498e91995635eb07051763e5ac7ec74a2393a324355ee1bb61739df085a46afeaa80dd63872b857ca84533f0cfa181c4aee582f864c23d4040104d330c8d5b764e0ec0dbaef57da85adc03e8cb0cba925d8f4c29ff7ff6f784f13eece8db77ef3d02b4b827487248703bca133eb05eda29dcf4a1412784c1960dfe27aa74c3519fcedce31e006dfcf0e38708e1aab691fb01898a67fa08df11f6a2910a076cbad096348774cc4a36bed8de8cf3ce3b2b67b198085f5f5825c7051625fc9a2781871ebe3f1bbcdee2f93ebe2c50f1589a706bf34c80255c3df93eeb5bbfbb89dbb6d85b22369d7c88e78937746905fd7a09462b868d131cf50b82ffdf4708e4075feea8ab26eddaa5087ceecac3cd2941bef317d65ed3b2884e462ffdaf3f0d46625663f5ce5bb7cb791a220599326c8e54ee47e2c00009b52375580eee475d376915a8bf5f75affe9f2083ae0bd95829151c3adee49393534d14d0eadee5cca2003a16de85d10ad25f7e909421b47b2661126a9e8074496ea03bf5781e3bc69ba2c90389600a1b8b4682898a884061b3f2e280a12f3d86ca731b5d3d157c03f3ab2f085eb215645a57715e36d97744a448bb0c295ba97b5352fbe38c6f48eb62f1017cc1b9b8dfc8921fde13927de85db75afe356398277f36e040f88361d8ce55e89fe6b91a2641b4f7f4c1b748c721e8169897786c1b31afab7cf9fdb14b9759984f3b96b4ce3d585fa08ac13fca5b608522f21f25fcee742e678d88ec783cf4d9de810761d137d28bfbc5934c61300420a40a6d0803f4914489acfb1377cee652568ab406a9e300fd8da1d333dd18eab85228bb7f8f6814e1a60be9aeaba2b8a7b59114d09b986ab0fa7c69a630f036a45e4c3d678c6c46fd6e16398bb325a73e76f1c905f0f1b3d42cc41a9fff748025c2674c9d4b5b9c93b69517e3b7b0c2b3be2e96ace6e1a777042949cf0f6183f75808dea90de84c965e4612516682a6fc743371cdf1eb8f1d0f213ccd22143ee6a3bee93d7a76d69147888755cf872b943d1d35d1951763bee921a339f3d3cfdf7207e0c2f937385688fec8240397b81d9e0c64c3a3d9098e3870c738dcb248f2a1ae9befd996426e849c25e8c0517a1fc43eaefd08f52d335ab77ee187e9a7e8255fa7639eca76bde6bb811c2818085f42dba7ea91eb7ec8b9f3b2f88e801412d9e39dd1fcb466ffddd4a9b73b3c0693637915952498e403ac6ad913f06a96d07d1364c659eadf99aea9bc77ec924699992da7f432068768020848a51a0714ee2136f2d3ba14660be21a0b77d6688a29e422dcfb9beb7c1f42c16f700dccccfc91a2c229ff33f67761e30f1671109b99d6dedae97b6c67dd2b7ffb8d78c794119af4a8bb3b922784952d5c0369c5de427004c904c9c0f85f1ccfc9e909c16aab356c5bbc9c0933c1fcfe9ea62c9f03d83d241d451d51a9968d62750dc84b53c546f9b6e017f6d5ec1aa7b8b29aceb4c5b35a677ab76cb6208217190d4578ab795428d7d57d3fd66e2cdd1957afdcd147cfdf79cea553c16a7e9e03483e112fa1f7bb48c21c4196fbc1b6a4fd90e719644e6f986c0e5414068a9e1373139cc12985839e128499c64c913557524fe5437452847535fd2b75da5f41f61ea7f1b2eba30735abe9c44a1115fd1bc074015a6a79d63d9bb7ba11f3acb64de88fc120dc52a0a16c63b0cd232b2b701b13c674828da5725dc26ae4f0f4cb893f06a7b4fae614456655c269d6f3640bafb21f060b0364f999acee665449b0cc5c78e9eaa1a9bca215606554aef533b3809acb7428dacc19419e438037ea45cead08af975be11bce2a2e69e807dd9fb3db8f6f48c7f8b7c6a8cca713e40e5775dbc7d9b457849c97e1f08efefda9096de895710de9968af96cede0fdc090cf160d2a7fbb434eafa27306dda94a6846c207dff72eceae5c7feb9c25cfce6b88ef81afd9d9ba12e95e720251c399a3af86d4c48dbb86683480a708b2cc21040f16de3bf7cd69d4fae8140073e95c96e05e1e37af50f5c74af1c797678c0304c7f6a9418913334e16a739501dbaefc8566d8825965484566836c60548b4798d043e6185a997f195f16bcc47a1049299b14276d14d404e278d08786cdc2b6cde3c0925b6c60e2741f537b3ad13fa496e5527a3c40213cfc386b83e00dd84967064a4c14d66c805cb9cf6187594bbe21af95c3fbda3496e3abc044a9795471387d92c2ba32381e2bba173023af32ba9116b5adea1a61b245c4ea160a2e9ed1acd72f376aa001d4256f147957620a2fabf2e7643ad2d58f9686bf5bfc5af7436acde548b5333bc74c8643c96e17112e976243b8a4f649f8d14796416dfb97145b0bdbdcc4d70070fae3f0afee6df20f9ff1d66c5ba0d3f9c484ec88d67c2de68fa9a289c2f675148b00f0d0d082e634ebaa9c487915aed62a2e783b58d6424448ddcc98025e6c0da07f57abb5fcc9445aee4578e46c81ee9750b2769f7bd7c63d48fcfe9678438e4555d39f23cb7ee406af9fc7e26103187fd7f91ee6ebf07a6ffbc3eb764e5de657064f31ceecd00b0c2e17fb788c1e855ab3dfab8835a84afada33862e6729e2f8280225a0c016b3a779288de4ba92f8447b43a20f0a0487559dec7d2c78c47c5e1fe6302c5f798e24e80f38d421f28f70f6f33e5d9f7588d3f8ddc7ef244893a1537962329adb651d560bae3fb9bfbb52c8f0c083df4562140ebff026304bc2329ab5b55a4ddb61b4f1da6533d5a599d99a8acf7dfe3a0b1c8152b914576518e4ceac1cf6b100c47afbda108945e35ffa42ffaa933d7fdced7a92a74606b15ff4b0159860650fdc8f313b18e0ee06d280e889c836d2ced9855c4c292851331f2e45e1f27dde11a124332ae0699b779ff2e4624d05ac9baf20860a33e073a44809ea4b8e10c28aed0fc6d45634eb96935cda62af864a3478db4004204601fb37e471609425a87ec1e60ef190aaf27c0c5bd8bf88f37376d497681b83fa559d071797f68e833eaeab6ca81818cd5da5b0a4b9a3c64df4a8d0946f24141f40a25f3940587a87994d972869bcd9a223cb3c3f619812db870c13d2b028c5d077c7eb6569f9146fc699d688c9bc9a0a87f291872cb0cfd3e92f8838d429450535a9daf8fe13e221881dd5fdf3f59d8bf9d6fb9fa41a9867edf47b9250348f53b50d3fd63e1c6dc1b46c173f212337ad8fff82979b018383f7896ae86b1e0feff15ef1c67188682638e25ecb6bc8a7d9fc5b07a40acec86eabb4914ad6bcfde6eea002a0f3c542dfebd18749bcce73498f49ce667225a4646316c3cacc6ee6a4a0f93712a48618ac5f9e8f5720c8e88cc7f0929896f800100d7eac0ad30d9808fe70b1523f77e35462578d84372ffdf50d7e0cef00b6ed6a83b91ea720838e671b440cb6f3eb62b32dffa50eac6aaca03dc60d0318fbe0a03fd438616bffeb40cc06c364419748e2f24aa38d0b4e1d7063600c66b91c081e744dff747536e912df0440b16d5cdd2f4d774460381d0d66f7c52ac1fc3c61719700e1dedbcbe4c1d48d884f19065d33435311d19e0e643903605008c6fe904d07267015ef215977e942322d5d405bc16f693e5cc2c041d5959b389c413106666033fee02e24dd0f3f053fc64027b5797f603f8d14e73633ca3eaa55909e68804fb8cef1ec641489fadf4e8e8c1a8609644fa60505e55fc4ab738a2f9c6cbcfb6b2913eba359e149cfe71ed87a9975de21aea2df35b37733809e73a5c48c7d8ff01188038e6b1061994577f72a8ec7aff570c8e57b86b87a0dbe90d7299371bce796daf502cca0be9b65ba8e73bd11892ef1ba47630caaddbcd8629c23da9acc59d6d20ba88f48631d7a77a45d37af46cd2fba978c8df436c88fa90a5523aac1d82e0bb3945c2c4e19570e6b1a66c3fabf3e295b9bb56e088d10cce9e72be1d43f5735c1fa63dedc00fed5ba01db6e56e6edaf39d2893be16a8ac95ede2d2434f0e792128617d5878f709436a023628e844631f2e5cba0c6d62aa4d3e0e89fa36dfb028fc1a44afb30fa14d8620e502cec56f7f025240194897d76d9800fae8d92df38011305d54123ad3a0ba80482f5ddc9f48fa45b23ed94c78b29a732f81182c2e9798c23aa55e3933f676b175c6951775b44d201b49fbb67bbfa1cdee33ac6c93b9544522b697334c1356d324fc14b76fdfbbdfb5978af2dfe517673dd1f07cb0c9d450b15995e7e3a9204072efd23e75b093b967445e11a69885b3aa222ffdbc6eb2b1af51f7ac5469ce5b7e6c8c18d2ca81e40fc5a14165a17570b16f3def79f955b86f63a0f40750e71200ed41ed2e4311007d4424c0d558ed609f9d2a4d6521470bb9c0ae5bb3c36bbab4c71bc4557da2f837edd4caa42806311a5098f76251dceca8d85545e79bdea3e1bd2f67fcca09e25ed5e5b8102ebd7024b67435c7cd7117e9bfae6bb9ad429ebd10de6c13bfac154db6aec5c497b4cae6ae329dcaa22a4715a62f2d49ddb415cbc7781b2500e60c25764948de8d005d3979c22207947a8f69baf7ef9f64804a2d8577a6cce317aa426c6dcfd545d921a3daafa6f52a145af35195fcdf678eaec420ecdaa9a4250cc3ea627d213ff1e81872f0eabfae9744c081d9b5911940", 0x1000}, {&(0x7f0000000300)="7a3c8b13261d384f2ce0bac60306774ce5f9c723f74ceff97cfde94cdd4788445f5993f0291f654a31261ec98d90bfc68baf0ee8cc0587ae1ccb3b1b2c67540b7025f6deea274e2549a9eb5816a667d14afb7f8fc365bd198244b056cf7271c5437a8c1b0c32cc30a96114850e9dc125b3a2c41c7046d01ee4d314b04c735692254f2964f605d600675b01a78f14e20c1f588e3b20296ec6aeb7082f9aeaf3cef296bcf8fee5548309d9", 0xaa}, {&(0x7f0000000400)="3d1001a62844211b2abbd986ea9665ade65f073f32a109e6bba9b152cf5d38647a3206b36a26de1474ff54a6406f90c5225100b74eeeef6fc798cd9d0eae7adbbe30dd4c1a7142665fb12223957398f066afae8a669f0ccfb28ebc38547532e62fa5db160df5e05948d3d08379f3109a27028b0355d98302ace37aec5ce201b31b1878c010236841db78fa3214d03e0a008091040060a1a23449e5c0c263c1cfd78984082c93a88f9a7845d29d13b9b49412f3e91dc50173d32b5e5ae7e626c681e1afb4bd74e2d47b966d25b1b1fc980e8b0312e1e6d51cee8bf4dfba2b0110eb1180df8b707170afc685", 0xeb}, {&(0x7f0000000540)="6c6243dbfdd075d630345816429052df0f60b43a8bc555e798e4a6bda9c9", 0x1e}, {&(0x7f0000000580)="2bcdfb3f69a2f34e0479ffa191961953d5d19dd33d06ff1321cf7a571c0c7c9fd6228b1173c62ad3f4622bad1a6bd8245bacd1839d81f11837856dc8fbe7eb6390a685a8f9721b574f8cd6fa6a022274f62ae072d191fa199c38", 0x5a}, {&(0x7f0000001640)="d7b8f57c13b51d81e3f10c8a9bb4419f59bfcd323d02b131f87feddef6fe7976ccc371af773b05536ab4487405c5db775453c1272372717cc3aef7e663b5229b51dba433fd8103c09440b9c6c8eaa5268c6417c02be1f8edb140bd4e63cca75b4434c46d4fc5400948ad9d0139c6c794437b3e8d57d516b220cab2dba39ca7c01ad5586864f781a5d6695b98bed50f2e46743512c91425f850049996f171998641a8ae81d17a7d065271f3cb", 0xac}, {&(0x7f0000001700)}], 0x8, &(0x7f00000019c0)=[@rights={0x30, 0x1, 0x1, [r0, r2, r2, r1, r0, r0, r1]}, @cred={0x20, 0x1, 0x2, r3, r4, r5}, @cred={0x20, 0x1, 0x2, r6, r7, r8}, @rights={0x18, 0x1, 0x1, [r0, r1]}], 0x88, 0x4000000}, 0x8001) ioctl$UFFDIO_WAKE(r2, 0x8010aa02, &(0x7f0000000140)={&(0x7f0000002000/0x3000)=nil, 0x3000}) r9 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dsp\x00', 0x200, 0x0) epoll_ctl$EPOLL_CTL_ADD(r9, 0x1, r1, &(0x7f0000000080)={0x20000002}) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x30, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c18f9c65e777"], 0x0, 0x0, 0x0}) 14:35:49 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='mounts\x00') ioctl$VT_RESIZE(r0, 0x5609, &(0x7f0000000000)={0x0, 0x1, 0x1}) sendfile(r0, r0, &(0x7f0000000180)=0x74000000, 0x5) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x4, &(0x7f0000000040)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_NOTIFY(r0, &(0x7f00000000c0)={0xf, 0x8, 0xfa00, {r1, 0x6}}, 0x10) [ 2756.379182] binder: 4251:4252 unknown command 0 14:35:49 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@\x03\x00'}}}}, 0x68}}, 0x0) [ 2756.417610] binder: 4251:4252 ioctl c0306201 20000600 returned -22 14:35:49 executing program 2: r0 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x40) fcntl$getown(r0, 0x9) syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/net\x00') r1 = getpgid(0xffffffffffffffff) syz_open_procfs$namespace(r1, &(0x7f0000000000)='ns/pid\x00') 14:35:49 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000000000000, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 2756.472588] binder_alloc: 4257: binder_alloc_buf, no vma 14:35:49 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='mounts\x00') sendfile(r0, r0, &(0x7f0000000180)=0x74000000, 0x5) r1 = syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0x3, 0x2) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000200)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x117, 0x8}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(r1, &(0x7f0000000240)={0x16, 0x98, 0xfa00, {&(0x7f0000000100), 0x5, r2, 0x10, 0x1, @in={0x2, 0x4e21, @multicast1}}}, 0xa0) open(&(0x7f0000000000)='./file0\x00', 0x80402, 0xe8) chroot(&(0x7f00000000c0)='./file0\x00') openat(r0, &(0x7f0000000040)='./file0\x00', 0x181200, 0x100) [ 2756.520372] binder: BINDER_SET_CONTEXT_MGR already set [ 2756.531442] binder: 4257:4267 ioctl 40046207 0 returned -16 [ 2756.547290] binder: 4266:4269 unknown command 0 [ 2756.552233] binder: 4266:4269 ioctl c0306201 20000600 returned -22 [ 2756.562819] binder_alloc: 4257: binder_alloc_buf, no vma 14:35:49 executing program 4: r0 = syz_open_dev$sndseq(&(0x7f0000042000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r0, 0xc058534b, &(0x7f0000000000)) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000080)='/dev/snapshot\x00', 0x2000, 0x0) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000000380)='TIPC\x00') sendmsg$TIPC_CMD_GET_NODES(r1, &(0x7f0000000440)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x1c, r2, 0x200, 0x70bd29, 0x25dfdbff, {}, ["", "", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x40010}, 0x1) setsockopt$inet_udp_int(r1, 0x11, 0x67, &(0x7f00000000c0)=0x7, 0x4) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r1, 0x84, 0x1d, &(0x7f0000000200)=ANY=[@ANYBLOB="00000000a9837cb411e0740eb95a975f9cab38b5c842f4271b87e412d78e001543", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0], &(0x7f0000000140)=0x10) getsockopt$inet_sctp6_SCTP_MAXSEG(r1, 0x84, 0xd, &(0x7f0000000180)=@assoc_value={r3, 0x100000000}, &(0x7f00000001c0)=0x8) ioctl$DRM_IOCTL_SET_UNIQUE(r1, 0x40106410, &(0x7f0000000100)={0xdc, &(0x7f0000000240)="8f540c61041c8bb642f27bcf6aebb9f922c21fef1769e2c26518f8e5c0ca27580bf94d84be4761b7206b58788e5c7bd448c631b216535bdc8a4561b390c778b79c5fa6e0b849c4d924f4198eecd15bd2c0ca10e02e9f4a1236d16300c5a34b046022e6889a318b44f897f0c50a01df17258975b2acbf8eae92c259ac726c6db15d546189c63b67103b11c104cdb59e08c68296f325d5f7402b6c9ffd2704f935701ea81774dd46c578cda295d8a3f0d4c6b88c0dd0f0d647d7b21622e2f0dd02d1c7250ef5529ae0f5d50d546808383705e2e5cb3ad4d77d0aff6f96"}) sendto$inet(r1, &(0x7f0000000580)="7f973922640619d467b44d80dd842296643c744660a225fc1196fd88860d22bf2c3c6387b83a1f3a07ded909d8eb629b10c098e7de38ce5cc6090314a8ea9852388a459cae7330f84ef0f2b847ac52dfd935e1ea7166476746eb1deea4a91424128eabf87d514b4a6918db1b4999abe20565b903b67a0755cb2504465e47b5351eb2572ba275634777ef385cb6899e6e60a6183431416db18ba1e816fe3d440facc13e46", 0xa4, 0x0, &(0x7f0000000540)={0x2, 0x4e23, @remote}, 0xff81) 14:35:49 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\n\x00'}}}}, 0x68}}, 0x0) 14:35:49 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4800, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 2756.639262] binder_transaction: 8 callbacks suppressed [ 2756.639278] binder: 4257:4267 transaction failed 29189/-3, size 0-0 line 3035 [ 2756.640678] binder_alloc: 4257: binder_alloc_buf, no vma 14:35:49 executing program 2: syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/net\x00') setxattr$security_evm(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='security.evm\x00', &(0x7f0000000100)=@ng={0x4, 0x7, '7`'}, 0x4, 0x2) syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/net\x00') 14:35:49 executing program 3: r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x202, 0x0) getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(0xffffffffffffff9c, 0x84, 0x6d, &(0x7f0000000200)={0x0, 0x1000, "a43ea22f562707a047f984bca660da98ce81aad87f04536123c415e4d85f05b92e816730ec396489536b8bf9cced59c50573784103c2b30b7c3f353279d1efa621cd0bea375f7c7e555fc4a848c322fdf63160bff545978763378cced373c72971ac3f003e6ba72efeaec4e80c26cab3b18ce5b0072f368ccdb88fd6598684c2fba8d638779f3a6300b8bb49dfbc9e964f1e1d61547dbd7001f3cc8f753087a726e999d5e0d0e073bd13f0d2c6abbcbd5cd88ef98280b524ba58ae299bb003098b83058e1eb85b01475e3c2355653619b6262f8ecd2099aa5f9e3fbd2b325b7b9f912673353603b0ca43be5133796e8427baf5494034a71e60a2873fa885b88463884c5c1cf2458a4a5d6be9a404ed33393e80a6336f21b0bf9026e2ea486f46456786ed20b933f1ef74c4912f316fe6249da4aafe26992cc52e3e8955be0545ae9fdfe6363c3154bbe4dc74dbdac642f7f9db9ae42eaf64a33eb478636d2e913bdf8b00359bde9840340e192134461daa54c2994eff77fa2d20588c7c2d40c1ba88f0e2989e6e3f6370d2da502ad79edf47d2ce1fe3f1de4d49a20bbbd055acf450c9c87b64f898086eedf3c00a89336ae7eafd70b0c4c3a2060e9872591c4c689e7db97d3e3061088af142d0f3677a3dba194152e006ec74e6b87178243a082e8269ada3c22445facd2e5f445ed5913fc9e4b8c33f845ae4576957739bfb505688b5f295d913a2fa9b4ab182f95a2e2ccd824202034a788ec6302e355d9f4bed6803a25d114be637e7de41e166bcf00575d8f292bd4e4501cabd5651c0c593739b18e36f31a8c16d6e65b33f2e2277c4a44b3ab031d14d6953dde3fe877e6a809a2932c1ebcff75e28fb5bd93e05fd12e5b80b0589fc025d5619e77826ee759f1184afd3b288cb66b91a2479d5f2463533c9f3a54ca9ea7e99a24cab3fd1f86ceb32092e9c62473e11f2eaceddce4bde5410be0d13ec5bcf943dc0668833fae0a9e7296918dec27167ee1abf3c0dcdd84e4e85e9b3cafe1998604ac955b5632314f291e08c4306a52f2f982d17bb89274ce3bd2a61322639c65da48fcc06fc7ad99fc489a4b3416dd529300230585728e48237734afecdfba9c4e5618603e6b1315ca1fb5e0592d6caea86936c7755711df6d0c2f6bcab8577a50a733ce25c812ce80e29966d1989c01cf0cfc044ec4d69e45818164f0863f4ad0d38f7b385001001672df5bc1baad43c81e8ecbab7a900415ca2e39b8e88840be5a348844a6498d3d8c4387aeb7722e74819e80d121343bc83d56cde4df9a4426fe27f1ba1e51519ff30d6a065cf5b0d7e267281c9f147861638de010686f28a5557fd6e092a69544659ecac2c8fdeae5ef4ada6de4fa2423628e0120ce3caf36b48fffec755c930e72357f32e6feb72b174a0f395abf5e21275d26b9150483beb6983c3afd9f1155f2223f93b9426b91dae190070e365d610754d6756477b6d9b891e7cc1f5a69d0076a4ab0658eceb94d9c90140a0cb73ae81014a79788f3b62aacd75a5d8daca9a93e73bb678b4d6ea6948cd212665e5ac4dadf15270f217908bca109a75025c7a322bb94aa3aea630079325df528353046b786e4be2db0372de8738a820aca39e6eeecad37567c6ec4c60398abf3d8b6695137e7cb634783909df7b80ad2b262cb57d2e4cbb5e58819e05f7df453050ca31012409b8ac3e0b05a5dc02631b7a480207d65f2e814e63935dfa80efe37459cf56ee0983a8c62785e22345f0d45115e8b0ab78c5fdee6c403a4634fa1fbdd533cd4272c711371ef146995f81ddff10aed71aa9a243330ac837cea204e9b022720e7ec9d0d1e620a6e213e01acb8e3f28530fd9bd36962dd896ec550f442b87b440a3c59fb936b5ea8f2d2454925c533bc508f0a9a828697a65579df2bb98f5fbc60d757dd55866b66f4548fac52a6e5001ee5e27992219c0e422397ef73acfc431f9b4f3689308b60a79d711ae244e62700a4515cc6196de55dda9c5177d65952a994f4a1b7239292ebcbbb7a84bb4fd032c073cd22547f94dcbc8ea92843f4205869240696c9178518bf7f047987ec0ee1dcfdef52e27f8c05d8503a4771d2c9e965ee43967f1ac18a85e19c3bb39924942652b6bf1e00f92f43788ac572682c7fda51d086dd1ec5bdb2b49141eedacd43311cdd4905e90730f8ba707f438efafdda09c2d988a073641f90c5830090e1e3a0ea87e30dbce4dc063835d01b6203a5ff2a3b0a1de2cd65e421e3f2b4fdea76f12b0116aab56dd24d81a37a5d226a6565938e49392ec3e15308e071aba18f402a19b37f3077fb6e028add1d59fbcb85736da9535ac383da518df1cf7b073703751a0dffd6dd1b74b19a3845da64fadea83d5512f0b6454fbb5848fb1114cd1e012032005db82f750e2219c559961ee569df95362b0120ae840cb460cb76bfb4f2a40e79973249e31de7b434c03f72f39ffaae1670cae30687d32a642e50bf6710cc6aa26b451e5a3689ca429514d10c5f899a4a4fabf8a13a263afd80ca4b113b90475890cd6e33b215c9adf50efd0deecbe0ce095036c7572a6224ff73fc50f0c22ea912ce801b730dc81b2ff60fd27bdb76ea6b6bef293b037d473ea66ccb325f0921de219730a5961db155e1c211a3624e82f5cf2ef3da5b61a4854aa4150f99c6bef5cc9bbe0191a3e2a8dc896bed27382579ae99397fbf43c11fdf2cb92146c70c20e432492b45c0aa3acf11635d70ad794e7fcffdc9fac00d8986c589d932cfdbba971bcf2ee711c85acd859465ee85c87bb4bc73f4aa84b0ba69a504d7e371c6d2395344367380516d0e864b04292d4ef4f7e9e76428da091ae7301744fcb0b7846628cd92e94b00cd710a446bc2738e34fe20ea15a10e75926557a1802cabeeb9d488b53fe34e7ee1b112b4454227006025d61db2c69f418a03f0c9fbce1ec33d85660f279161d3f7b95d523f3468adc3d459060d0f398bb4549a2625328a84fb549b3291c5c8efbf6b16471d12d5d63093ef59f546e80c9c2335033e70bb446c0cf017ae4adab52370387e1ec2735f6f6920bb5ec724b4838ab03a46651a45d26e8a9f61a58f6f2313852be36c50e4fefe5a167b0f4875982536029e6e87583ebc421d8f7d652d2ff3fc3b2d678c090a7e786ec80f58cd79da1dafbe195dc6306722cf0ed1c7eeac75ef28627136dc8a6603a4c238430b68a4120b650219042c107c9b81ac6ea46e15b5d8549a0fa17dd9b5e425ebe45c158a8f0b749dd2c14654633f0c2f66681ba14ab1712562d6ffda731cb1e44419e5a176155843bbbe42ba18f3f5670b5f70fcf790c4a9e49f9e209bfdd242059034a7207e1e99e6c3e2d23e8f8fc751dea08560e9afcf7cda30e3f5d568ccb359ba0a7c41e7646b7693aed7a16fbef4dd1b892113cf1f4ec4a4a2c45732006fca291fc139404d7b862def74a3c926d254aa835d3c15cd5f75a1c187b5a2defcbe059feeb78afc8e2f06862f0fac98c0ae676a36e974dce18d175da02c78f111fa67c408fbc4e42671c5a63c79f07bf20199f3460ad6f63ec764c9a0a27e4292d7cdd93f006f398d67b0bcaf3efa92d27dca7a176f7c128b6773ec0e469651a9f83b33af9f1b1475ba388998d4cb47b43f29ab2ef4f9fa664e85f2d867e990d010c1c0b61294e2ec3500532eb9804245b1186bec7a3e8592a0b62ca18d1ccf602646b1143c8d756178f5c6fe2ed72d52c3113efb8c3092281bc213bc44209e4ce433f836e1165bbe26aec99935b8b73ba51adcbeb1840e64dbac79bc8a680f007ed10c532ce1ede28c5a0aa1fbe8a3e467838672007da8eb3f6a86f581b302a286a934b9826ea0424aca3d04197b7bceac192bd70bda60c2cec2f5d0244684955cc19c7d756a20115d8a07655e6743a6356aa04227be484385daf6518b312530758c4a2d9c6fe13c1135ef690247fdb1c5fb4305227cc01e8c560ad32a4e43187aa3008ca5cdf36aca23c6099db40b7ec9ec276eccf6972d7038b0f860d424052e09474aed0e47b096b5b8c1d749a17f8c96b0e92893cbcf769b13f7f0e1c35dae553a67518c5789bec132c823298b73de4bfc9978d69d26df42abab141abb89784da04a602a03536e703542c87396f658958ea9a8167932be0121d65b1a0cc1214680f217054fcca795c56db1e1736e717bd8ad17c6c67d80ace5f8844dee44290ea40490aa547cce01a906754904d1431c0a2e6951db7a832ec0126cd62ec588a6956dbe6035d7567d9a974fd33b61a0d5e2b04c94a8f4b5f05e5ea76ed71ddf452bd9926529ce61755f9a1aa21379db08e9864359bf66ede2bda50be134bbb755da0a901f0aef2502850a8fb30ee18fe4e9f9f172bf808217d3e2728ec5f5d69de51333b11d08e316752af8ecc625af215f4211d33d1f2560565b3029ec894d65c5c15852213370334a42f283c44118286c99e36407cf0daacf795e74c373af01eb9ba49d5c476f68eb70665bceeab3137c95345a8051e961589d2c5943b7c8194ba13e9af2be43012feb66ad6fbde99d32fb209c97f082d437427a714199a53290152a9d284f73479b14dfb190a155580a203522c2703ee1cdfd370385f9054b42fb44c50002295cc7f5cb1411d3d0655546f1ccc51183c03a24ff4ed3ba42bd391f922a77254ec0a24a475b533ea165c73c473b405928e86ad14d1d54aa131fc27be4e3ac0a312ae6d71087afe0d4e33cd5d4f0d1c9b21ad2b95114485ba32c525f5421841d0a998d2259c624fb5086e00cd17bf4a2e3d977f06c1e1d4bb1f95eebb2031f5e4514d958a33ddba274907af83e1870ad998b06748135ac4ef428a50267d6ded1e2c3a46d3d59f39d5fc660b8824bbadc8010614c548a60fcf3fa5e59937c1b170792232fd6ddd8c04e790264350a5a7949570910dd39fb1e1314048487882656b1b59c5a6bf5f52fd5a1dc08ebb7c407922ee2bf2f8b3b08ff05a26a4a488620e064249660ce09ee8e93e4eb01bdf7ce135b33231fc7d5432a61576c5c41897ca7493dec0672ad55361b6a40e668a807d224b93688359f7c4d456a57d69bb81e6ad1fee02a51eea7b62d4e2bcdc05e2f38f13d53bd4f4d28876a40fb361ad838474ca2128c9c75f93195dc9ee3fd164a1d68f8349120e404408c5072620b3a6628436382a27f87f854ab7f92356169fd3102b9e549e7e992f85e9b0b07390795b01e85862790172c33ee12a675176750e9b6a626ebf35fda3b34e99469af549de2f53b5a292ab0001e434c703cd08b40875dfd5359b3571636143a6ac6663ddaac93a9fba4918b13367fade7f89f572401813efadf3f699421c13d7096480f23707daf591afe75ee1c7b9ad6c4ca9a6f92490150efa475c207da352386046c3acf433699c08f85ced06d6c8808f4320c40de8ba86d580c5297c62084ee1ea82b4f7d3988e828e6f4d447659f7a991bf6f038cf25e3b05af3e2f92882f0ddd2777bf0f70867cf232d9decb142b80b3c5c087161a1616046c8b67ab56ec96b22550abfa33f8fe46f856a07b8a7bdb254635e8324b0aff729ab0817175475d17b9b2827d9da6ce9c8ce7635247ffbe902b9b082c7e6aa7ffbca48963d66c8092471fa76e8ffed10fea0511b31bb106e4248675af5a778467661f97d3efe735c3ed06550b690912565cba6a10c68733713c755b3082b2140e08f3beb8205cec76149f7a5ee6c54c2ccb95a8279cfcc41149f33d1b9f3e38beb79e87ac53e52efe19201b568e82ec874c43b1a4e7a2de07db591d86403d3bb9"}, &(0x7f0000000040)=0x1008) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, &(0x7f0000000080)={r1, 0x1}, 0x8) r2 = syz_open_procfs(0x0, &(0x7f00000001c0)='mounts\x00') sendfile(r2, r2, &(0x7f0000000180)=0x74000000, 0x5) 14:35:49 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00'}}}}, 0x68}}, 0x0) [ 2756.768026] binder: 4257:4259 transaction failed 29189/-3, size 0-0 line 3035 [ 2756.845953] binder_release_work: 10 callbacks suppressed [ 2756.845960] binder: undelivered TRANSACTION_ERROR: 29189 [ 2756.891081] binder: undelivered TRANSACTION_ERROR: 29189 14:35:49 executing program 0: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) getsockname$inet6(r1, &(0x7f0000000280)={0xa, 0x0, 0x0, @mcast1}, &(0x7f00000002c0)=0x1c) 14:35:49 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa630840, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:35:49 executing program 4: r0 = inotify_init() syncfs(r0) r1 = syz_open_dev$sndseq(&(0x7f0000042000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r1, 0xc058534b, &(0x7f0000000000)) 14:35:49 executing program 2: syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/net\x00') syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/net\x00') ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f0000000040)={0xffffffffffffff9c}) r1 = getpgrp(0x0) prctl$PR_SET_PTRACER(0x59616d61, r1) accept$alg(r0, 0x0, 0x0) r2 = syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0x3, 0x2) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r2, 0xc08c5336, &(0x7f0000000100)={0x7f, 0x67b, 0x1, 'queue0\x00', 0x4}) 14:35:49 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x04\x00'}}}}, 0x68}}, 0x0) 14:35:49 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='mounts\x00') sendfile(r0, r0, &(0x7f0000000180)=0x74000000, 0x5) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r0, 0x84, 0x1d, &(0x7f0000000000)={0x4, [0x0, 0x0, 0x0, 0x0]}, &(0x7f0000000040)=0x14) setsockopt$inet_sctp6_SCTP_CONTEXT(r0, 0x84, 0x11, &(0x7f0000000080)={r1, 0x1f}, 0x8) 14:35:50 executing program 2: syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/net\x00') r0 = gettid() syz_open_procfs$namespace(r0, &(0x7f0000000040)='ns/net\x00') [ 2757.007883] binder: 4303:4307 unknown command 0 [ 2757.022900] binder: 4303:4307 ioctl c0306201 20000600 returned -22 14:35:50 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x802) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$inet_pktinfo(r2, 0x0, 0x8, &(0x7f0000000080)={0x0, @dev, @empty}, &(0x7f0000000180)=0xc) write$binfmt_elf64(r0, &(0x7f0000000640)={{0x7f, 0x45, 0x4c, 0x46, 0x5, 0x1, 0x6, 0x8, 0x2, 0x0, 0x7, 0x80, 0x14e, 0x40, 0x166, 0x5, 0xffffffff, 0x38, 0x2, 0x80000000, 0x3, 0x401}, [{0x6474e557, 0x7, 0x3, 0x9, 0x7, 0x3, 0x9, 0x20}, {0x6474e555, 0x2, 0x0, 0x6, 0x5, 0x1, 0x400, 0x100000001}], "d3356db517faccc5300600d589f75a7b03c2ff35b6dc38c7dde7cf3c4174e8ddcdb3133a67ac5485c7aff45f1a8b1bf0057526f43e55ab4c2f26a9a9b17f669ec40aa8d09c4724ae45c90fa2b1f6a994eef246c1e0b62b341259c054ab1eaaaf837ba0da3a69ac10b431d5bdf5a48977e818367e352ab33f93fb67656899a3265a7bde7feec78a9174f910bb495a", [[], [], [], [], [], [], [], [], []]}, 0xa3e) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r3 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x1, 0x200000) ioctl$VIDIOC_TRY_DECODER_CMD(r3, 0xc0485661, &(0x7f0000000100)={0x5, 0x1, @raw_data=[0x9, 0xea24, 0xffffffff, 0x3, 0x6e1, 0x8000, 0x1000000000, 0x400, 0x1, 0x1, 0x3, 0x7fff, 0xfffffffffffffffc, 0x6, 0x8, 0x6]}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$PERF_EVENT_IOC_DISABLE(r3, 0x2401, 0x2) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:35:50 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00'}}}}, 0x68}}, 0x0) 14:35:50 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='mounts\x00') r1 = inotify_add_watch(r0, &(0x7f00000003c0)='./file0\x00', 0x3fffffd) inotify_rm_watch(r0, r1) sendfile(r0, r0, &(0x7f0000000180)=0x74000000, 0x5) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6, &(0x7f0000000000)={0x0, @in6={{0xa, 0x4e22, 0x0, @initdev={0xfe, 0x88, [], 0x0, 0x0}, 0x5}}}, &(0x7f00000000c0)=0x84) ioctl$KVM_SET_SREGS(r0, 0x4138ae84, &(0x7f0000000200)={{0x3000, 0x106000, 0x3, 0x3ff, 0x9, 0x7fffffff, 0x7, 0x51, 0xff, 0x1, 0x7fff, 0x3f}, {0x1000, 0x106000, 0xf, 0x7, 0x2, 0x8, 0x9, 0x7, 0x200, 0x400, 0x2, 0x3f}, {0x0, 0x0, 0xf, 0x4, 0x8001, 0xf90, 0x8, 0x3, 0x1510, 0x2, 0xfffffffffffffffc, 0x2b}, {0x2000, 0xf001, 0xe, 0x100000000, 0x9, 0x100, 0x2, 0x4, 0x7f, 0x9, 0x4, 0x7}, {0xd000, 0x106000, 0xb, 0x2, 0x8001, 0x7, 0x4, 0x7, 0x1000, 0x81, 0x4, 0x1}, {0x5000, 0x10000, 0x0, 0x10000, 0x1, 0x80000000, 0x100000001, 0x9649, 0x4, 0xffffffff, 0x2, 0x8}, {0xd005, 0x3000, 0x0, 0xfffffffffffffffc, 0x6, 0x9, 0x7, 0x2, 0x8000, 0x1, 0x6}, {0x10f004, 0x1000, 0x9, 0x0, 0xfda, 0x1000, 0x0, 0x20, 0x1000, 0x2, 0x101, 0x3}, {0xd002, 0x6}, {}, 0x14, 0x0, 0x17002, 0x10080, 0xb, 0x1000, 0x2, [0xdf31, 0x100, 0x8, 0x6]}) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(r0, 0x84, 0x13, &(0x7f0000000100)={r2, 0xfff}, &(0x7f0000000140)=0x8) 14:35:50 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40486312, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:35:50 executing program 2: syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/net\x00') syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/net\x00') link(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='./file0\x00') 14:35:50 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0e\x00'}}}}, 0x68}}, 0x0) [ 2757.167531] binder: 4330:4331 unknown command 0 [ 2757.185853] binder: BINDER_SET_CONTEXT_MGR already set [ 2757.187281] binder: 4330:4331 ioctl c0306201 20000600 returned -22 14:35:50 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='mounts\x00') sendfile(r0, r0, &(0x7f0000000000), 0xffffffffffffffff) [ 2757.234440] binder: 4328:4333 ioctl 40046207 0 returned -16 [ 2757.234612] binder_alloc: 4328: binder_alloc_buf, no vma [ 2757.286350] binder: release 4328:4329 transaction 8977 out, still active [ 2757.298484] binder: undelivered TRANSACTION_COMPLETE [ 2757.304259] binder: 4328:4329 transaction failed 29189/-3, size 0-0 line 3035 14:35:50 executing program 4: syz_open_dev$sndseq(&(0x7f0000042000)='/dev/snd/seq\x00', 0x0, 0x0) r0 = syz_open_dev$media(&(0x7f0000000080)='/dev/media#\x00', 0x100, 0x400000) ioctl$SNDRV_RAWMIDI_IOCTL_PARAMS(r0, 0xc0305710, &(0x7f00000000c0)={0x1, 0x6, 0x0, 0x8}) ioctl$UDMABUF_CREATE(r0, 0x40187542, &(0x7f0000000180)={r0, 0x0, 0x10000, 0xfffff000}) setsockopt$inet6_MRT6_ADD_MFC(r0, 0x29, 0xcc, &(0x7f0000000100)={{0xa, 0x4e20, 0x7fffffff, @dev={0xfe, 0x80, [], 0x1f}, 0xd}, {0xa, 0x4e22, 0x8001, @empty, 0x2}, 0x8974, [0xfff, 0x1, 0x1703, 0x8000, 0x88a, 0x3, 0x5, 0x1ff]}, 0x5c) 14:35:50 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6800000000000000, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 2757.328293] binder: send failed reply for transaction 8977, target dead [ 2757.354287] binder: undelivered TRANSACTION_ERROR: 29189 [ 2757.368950] binder: 4344:4345 unknown command 0 14:35:50 executing program 2: syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/net\x00') syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/net\x00') getresgid(&(0x7f0000000040), &(0x7f0000000080), &(0x7f0000000100)) 14:35:50 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x004\x8c\x00'}}}}, 0x68}}, 0x0) [ 2757.382494] binder: 4344:4345 ioctl c0306201 20000600 returned -22 14:35:50 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="005c9e6f2036b6e135aa7c97e137f24b2976ece2598c8f729f080cdc06935463bb38a128ee162ab40ab29fd650d5d54d76aff0f27f023c08448a26125e47b162d8527afb7508c5bc688aff033479cb66dfd4b4a3abe09d1f1d4c1c27c59739744f807bae58826f42b51df08abf3532079de97b49085f0988f4e05a4ed545d111"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:35:50 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x863104000000000, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:35:50 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$netlink(0x10, 0x3, 0x0) write(r1, &(0x7f0000000040)="220000002000070700be0000090007010a00001e00003c0000ff040405000c008000", 0x22) r2 = syz_open_procfs(0x0, &(0x7f00000001c0)='mounts\x00') setsockopt$IP6T_SO_SET_ADD_COUNTERS(r2, 0x29, 0x41, &(0x7f0000000000)={'mangle\x00', 0x2, [{}, {}]}, 0x48) sendfile(r2, r2, &(0x7f0000000080), 0x5) [ 2757.489649] binder: 4351:4356 unknown command 1872649216 14:35:50 executing program 2: getpgid(0x0) gettid() fcntl$getown(0xffffffffffffff9c, 0x9) ioctl$sock_SIOCGPGRP(0xffffffffffffff9c, 0x8904, &(0x7f0000000140)=0x0) syz_open_procfs$namespace(r0, &(0x7f0000000100)='\xfa\xff\x00') syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/net\x00') [ 2757.537027] binder: 4351:4356 ioctl c0306201 20000000 returned -22 [ 2757.547669] binder: 4357:4360 unknown command 0 [ 2757.554748] binder_alloc: binder_alloc_mmap_handler: 4351 20001000-20004000 already mapped failed -16 [ 2757.573479] binder: 4357:4360 ioctl c0306201 20000600 returned -22 14:35:50 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xea\x00'}}}}, 0x68}}, 0x0) [ 2757.585946] binder: BINDER_SET_CONTEXT_MGR already set 14:35:50 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7400000000000000, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 2757.632641] binder: send failed reply for transaction 8980 to 4351:4361 [ 2757.640214] binder: 4351:4356 ioctl 40046207 0 returned -16 [ 2757.647209] binder: undelivered TRANSACTION_COMPLETE [ 2757.657156] binder: undelivered TRANSACTION_ERROR: 29189 14:35:50 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$amidi(&(0x7f0000000080)='/dev/amidi#\x00', 0x20, 0x414000) ioctl$UI_SET_PHYS(r1, 0x4008556c, &(0x7f0000000240)='syz0\x00') r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$RNDCLEARPOOL(r1, 0x5206, &(0x7f0000000280)) r3 = creat(&(0x7f0000000040)='./file0\x00', 0x4) ioctl$KVM_SET_SREGS(r3, 0x4138ae84, &(0x7f0000000100)={{0xf002, 0x3000, 0x0, 0x16d32604, 0x7fffffff, 0x0, 0x0, 0x81, 0x0, 0xfff, 0x1, 0x80}, {0x2000, 0x116000, 0xf, 0x7fff0000000000, 0xe58, 0x140, 0x2, 0x7fff, 0x81, 0x200, 0x7, 0x20}, {0xf000, 0xd004, 0xd, 0x2, 0x7, 0x2, 0x0, 0xb1, 0x0, 0x3, 0x7}, {0xf002, 0xf003, 0xe, 0x4, 0x177, 0x8001, 0x7, 0x9, 0x6, 0x9, 0x9, 0x5}, {0x4, 0x0, 0x3, 0x0, 0x800, 0x101, 0x7f, 0x7f, 0x1, 0x3, 0x30000, 0x6}, {0x0, 0x6000, 0x8, 0xc17, 0x80000001, 0x8001, 0x0, 0x4, 0x40, 0x100000000, 0x3, 0x7}, {0x5000, 0x3000, 0x0, 0x70, 0x2, 0x6144, 0x1, 0x2, 0xfffffffffffffffe, 0x3, 0x32ac, 0x712e}, {0x5004, 0x1f000, 0x0, 0x5, 0x2, 0x3, 0xfffffffffffffc79, 0x8, 0x8, 0x81}, {0x2}, {0x0, 0x3000}, 0x80000000, 0x0, 0xd000, 0x404008, 0x8, 0x8100, 0x14001, [0x7, 0x4, 0x4, 0x7]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:35:50 executing program 3: r0 = getpgid(0xffffffffffffffff) clock_nanosleep(0x7, 0x0, &(0x7f0000000040), &(0x7f00000001c0)) r1 = inotify_init() fremovexattr(r1, &(0x7f0000000000)=@random={'trusted.', '!em0*bdev\x00'}) r2 = syz_open_procfs(r0, &(0x7f0000000080)='/\x05\f\x1aV\b\xf9\x8aEQ\xc0%\xf4\xcc\x12\xebA\x8e)\xe9mQG\x12\xa6\x0e\x02\xa5`Be\x02_rxQ^j\xbf\x10y[(\xb7\xef\x80u\xf8Ht-MK\x93\xf0\n\xdf4\xfaP?\x1aXzXwU\xe2\x16v\x1e\a\xffW?\xb2,O;A\x94\xc7\xad\xe5\xb4\xe9\x11G\xb8`\x8e\x0fEP\xaesS\xecA\x95S\xea\xe9)\x14\x96\xdf\xf0v\x9cu\xfd\xa1bwJ\xe2\bC\xc4\xb3U\x1f-\x80\x96H{f\xcfc\xee;\x1a\x87oy\x9c\x1f`\xd5\xbc\xb0\xcb!\xc8\x06\xed`\xdf7\xf0D\x15\x1dy\n\xd0\xbf\xe0~ \x80<\x80\xf2\xba\xec\xff\x97Hg\x8c\xce\x9aM1Y\x83Ni(\x02Kp\xee\xd5\x87\xc8\x86\xed\xe5\x8c\xf8\xb9\x18') sendfile(r2, r2, &(0x7f0000000180)=0x74000000, 0x5) 14:35:50 executing program 4: r0 = syz_open_dev$sndseq(&(0x7f0000042000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r0, 0xc058534b, &(0x7f0000000080)={0x800}) 14:35:50 executing program 2: r0 = fcntl$getown(0xffffffffffffff9c, 0x9) syz_open_procfs$namespace(r0, &(0x7f00000000c0)='ns/net\x00') syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/net\x00') 14:35:50 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00'}}}}, 0x68}}, 0x0) [ 2757.777071] binder: 4378:4380 unknown command 0 [ 2757.795543] binder: 4379:4381 transaction failed 29189/-22, size 0-0 line 2896 [ 2757.804205] binder: 4378:4380 ioctl c0306201 20000600 returned -22 [ 2757.812352] binder: 4379:4383 transaction failed 29189/-22, size 0-0 line 2896 14:35:50 executing program 3: r0 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000000280)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000140)) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000200)=0x0) r2 = syz_open_procfs(r1, &(0x7f00000001c0)='mounts\x00') sendfile(r2, r2, &(0x7f0000000180)=0x74000000, 0x5) r3 = gettid() getresuid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000080)=0x0) ioctl$DRM_IOCTL_GET_CLIENT(r2, 0xc0286405, &(0x7f00000000c0)={0x8000, 0x5, r3, 0x0, r4, 0x0, 0x8, 0x7fffffff}) [ 2757.834852] binder: undelivered TRANSACTION_ERROR: 29189 [ 2757.843533] binder: undelivered TRANSACTION_ERROR: 29189 14:35:50 executing program 2: syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/net\x00') r0 = gettid() syz_open_procfs$namespace(r0, &(0x7f0000000040)='ns/net\x00') 14:35:50 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd63000000000000, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:35:50 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\n\x00'}}}}, 0x68}}, 0x0) 14:35:50 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00c@@'], 0x198, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 2757.980591] binder: 4399:4400 unknown command 0 14:35:50 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='mounts\x00') sendfile(r0, r0, &(0x7f0000000180)=0x74000000, 0x5) ioctl$FS_IOC_MEASURE_VERITY(r0, 0xc0046686, &(0x7f0000000240)=ANY=[@ANYBLOB="0200db0094c8b1cbd72c919b69f90a53bc6cb1dbe61ce1e9591db323443cde61cde7187c2832c1871459aa8d039ba4e586a58b38caadf03919c02d3ab0a43d99aa58ada1fbec35c9731ae64fcded8e06872b1efaddacff4c653e51c1301c2961af8f32e59bdb36734b257e3e598ccfa8f17f8ea97c48045afc35a0c683e002d034c0cfce7211ad35a1dd56e1efdcee19e8208f8f960b7a248239d814bf3e112fa8e8a3ab5e2b4d2f923a9c2035727f88ab01acc463f35fa60b2ca17e35ed8c37428f23ca850905b41a38a5849cc074e8ab0594a6366453f3c0455e00000000a5b7e6114f9f0446e3368467a83e6e416b020cb0a589951c943cd01d6ddf8ba794f557c11028da05eee0967f505dcea737d52e7534e1fed250c4d227dd33b77c6a633748f68ef5caeed95855b1a76e91252b8c28295ed64bb3bb8a16b68bc5bed62a4b688efa837d3000e8809dfe461155f0d02145a891c14727308b85aaddff20bb23a4bc6031b176f872dbe2a17c1841579ad4f0e7c0d3a4cb16795f9c11d9b3c9673429f65c4342228430d9031235266e863522ae828a128f202c7d114bf638b4247ab0194c5bf1be048b37f23c935f2bc4e258eeaf4dc32df11e272cca7aae90cc78dad541abaa5766ad24f6ef94aa63eb6605d5a3781abcec0b36e22281f8636f40c60a7929bab4dcae025f529b1e76a17a2bdb471469fa563aac1f588d7da36e623e992f6b3f4a42e4823994cb79af0189aeebd702f720a23701f14b"]) [ 2758.015351] binder: 4399:4400 ioctl c0306201 20000600 returned -22 [ 2758.025207] binder: 4405:4406 ioctl c0306201 20000000 returned -14 14:35:51 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\x9e\x00'}}}}, 0x68}}, 0x0) [ 2758.060081] binder: 4405:4406 got new transaction with bad transaction stack, transaction 8984 has target 4405:0 14:35:51 executing program 2: fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000040)) r0 = getpgid(0x0) syz_open_procfs$namespace(r0, &(0x7f0000000100)='ns/net\x00\x1fr3;H\xf6}\xd7U\x9b\x02\xa9*\x84\xb27\xbe\xcf<\x9dr\xd4\xcbt\x1b{\xc8#8Y\x81\xb9\xe7)2C\xa9\x8e\xf4D\xf8\xc1\xfdH\x16\xfe\x85\xec<\x0f\xf0\x8b,\xbe\x95x\x90P\x86n\x97EQ\xadwFVC(r\x9f3*\x87\x13\x11\xf9N\xc9e\xed\x18v\x97\xd2\x10\x19\xcf\t:}\xc0\xc6[V\x8a\xf3\xc0\x80\x92x\xdd\x053h\xc0\xa8\xfe\xf9\x16\xc8\x01,v\x93\x8e\x92<\xa3\xb3l\xc4Y\xc6\vy#\xb0\v4\x907\xca\x01\xaf\x10h?\xadB\xe8\\\x14\xdf\xddZt') r1 = syz_open_dev$swradio(&(0x7f00000002c0)='/dev/swradio#\x00', 0x0, 0x2) ioctl$UI_SET_LEDBIT(r1, 0x40045569, 0x8) syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/net\x00') r2 = openat$vimc0(0xffffffffffffff9c, &(0x7f0000000080)='/dev/video0\x00', 0x2, 0x0) ioctl$UFFDIO_ZEROPAGE(r1, 0xc020aa04, &(0x7f0000000340)={{&(0x7f0000ffe000/0x1000)=nil, 0x1000}, 0x1}) ioctl$VIDIOC_S_MODULATOR(r2, 0x40445637, &(0x7f00000001c0)={0x68eb891b, "66d0d51f4230d505906777a216b5d8425d24e3643dd4366594f6dc2e7b4a3c66", 0x1008, 0x7f, 0x18, 0x2, 0x3}) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200000, 0x0) socketpair(0xf, 0x5, 0x3b57, &(0x7f0000000300)) syncfs(r2) setsockopt$bt_BT_FLUSHABLE(r3, 0x112, 0x8, &(0x7f0000000280)=0xa6000000000, 0x4) rt_sigprocmask(0x1, &(0x7f00000000c0)={0x9}, 0x0, 0x8) 14:35:51 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40086303, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 2758.113288] binder: 4405:4406 transaction failed 29201/-71, size 0-0 line 2946 14:35:51 executing program 4: r0 = syz_open_dev$sndseq(&(0x7f0000042000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r0, 0xc058534b, &(0x7f0000000000)) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000080)='/dev/rtc0\x00', 0xefc635b4d6a49034, 0x0) getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f00000000c0)={0x0, @in6={{0xa, 0x4e22, 0x5, @mcast1, 0xcd}}, 0x8, 0xc4c, 0x20, 0x2, 0x40}, &(0x7f0000000180)=0x98) getsockopt$inet_sctp6_SCTP_RTOINFO(r1, 0x84, 0x0, &(0x7f00000001c0)={r2, 0x7, 0x6, 0x40}, &(0x7f0000000200)=0x10) 14:35:51 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='mounts\x00') sendfile(r0, r0, &(0x7f0000000040)=0x74000000, 0x5) ioctl$FIGETBSZ(r0, 0x2, &(0x7f0000000000)) setsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r0, 0x84, 0x8, &(0x7f0000000080)=0xffffffff00000000, 0x4) ioctl$EXT4_IOC_ALLOC_DA_BLKS(r0, 0x660c) ioctl$KVM_SET_NESTED_STATE(r0, 0x4080aebf, &(0x7f0000000200)={0x2, 0x0, 0x2080, {0x106002, 0xf001, 0x3}, [], "7966b1a7580417371b83aba59092b5320285d585ab3e97e04908b023b84ab3d49fff31a843dcac102fb18ab705210c12d26ed29b60ff44bb2eb881dc0c43319213ea97c5d5988ab47d8e2b7b2b457c2eecab1fdf8e8f75d1a330c153e7fb98edbf3d0119b82c229b8745809545867f2ab5dd10e83fadb83759cd1cb31e85cee024b19fd300a79a5e2c34655a040b17ff11d64886587cc54a56878d7c3bbd6a0dbaa9227d773fb307ffbf2b8f87cd3b01de02f449f3491282c381048b8e63178f3d4e8e85b72ba83b29edd79ef04f3bc35bfa08fcea7fda145e132d7f1b6ad449581821f4873e09e1601cbdfb4edd48064b6f2585cd0dbaa402bb74220f66fb94dfc7cc1d9ad04c66312a199042c3ab5ba26f309f80b05ac8df8a14d0d01cbade91d8d0894035554e6c0ec6864e03b241cf237c62a82b5d490e76c3e0a8d54252ba64301ac2918bc965e51122b90c63ecb6b8a7f8f6860e83275970ccf74487d4c9c09c06a0623440e71d905e65c1af6254f366f776fb6e4520b71e83a87baceeb0eb00bf6bcabf4858864a2eff15be83049e61b91f5b995863b86b5796976b42c3f42e3735a53ff33b74aeba47b66bfada3284f8bf23e90a6eace4217f1c779eed4408caed6c64ce6fceb7e6ae105c7bff7d1499ffe0e65c18d8ef36f08c6eb265d526e343ffe8d56a99bf4cd7a9e878b7bb56bb24f27d5424459ef6901a57f807d51d105dcf05da463abc666dcadba278eee8b572f5055ebc2a6382bbb67fa01cbb242a13ebd1ffb4f3a372f474eb3de3f1233f74b4b6e565d3674c0d442647616510f39dfcd04a16f9affb6608d30c4b873a2d404c8ffe678cc49d851e21dd52675ffffd0ebe2a06d2fe005ead77895a9e46474538427d49974148a818954f62869ba9d4220b9ef7ab6f23a5b48d7e5c838761beb085ee00da62577130a7d26d9c633651a91017e68e33979c13c657eee3d4bcc6ab76e323fdc896b5dfa32a37db4c3c24e1be7050ee422aa7ff462d7cfd2d4778a6a3bd9c8b82d66c7df0802c9e501441993f13907d32f342088b7f88ad5b7e6009493e5cf816fa0941b6a221da38cefad7fa7c134fd426c4cb1b35fafb1f11596f52c85c4ac54bc9855918f007739fe11b312e4c93c854d2f67ada9b24b70ea9ed002f12e172beddc9be435505e5aa7d7e96160222cfb62a564a72b686eade0157a0d3068b1bbf61629cb2d417a4d4fd8cb3c028811c06603079c34d8307e0b057d69eb41ba3ce1d198c08612b28867d9b86af8b101d8f4c5b5a6472dee844d5316b1a14ba8b17f9e80648e38d9d49f24a7aead412fd1c63d51d5d8a15945abd5f2d3870575b2bdb24e78f188ae9741ffbec5e00b35b2d576542f81d9ed3c2389327df276e72eaa553edf7197dbd981137eefc44e7b981ec2b00f51e8e577070daf2a2cbfcd4c98bae4a4f74b7e491249ffc85b30bb25db1753c90d4a6d2f8f1e3e26829f77054423c6a097a03c60c7dbd3dc1971431745b2500589605a07380c77849063bcab9e040a9dfafc208fb0e92c36ac8d22e4a68c54175ffacc0099dfad2ba5ba11960d0814e5147d39747ae0632e60dc3f189893d0515a0bdcc17ca02eb6fea8b04d7bce0d0967f72ae1acc81568b91588e974308566ff9846a9d3b3381eb82f35d2bd472a2bcca83d28540a67c8113c4b6f220ccf552cf1dbadd968148e17698b0823a84b370c5e91492687c8a340b6f58b9d852ad412e5ed22fac617835f541fc0346edb4a47eb848a7e443311e8a9791189f32d24a7ba0de7b499726efd6a63f2bb293fd6e9282c5a91981f2d930ff9371dc510638324874ab3d9a8320827ba2683d549f746c21e2f7d9af5332576c2218538869e707a74b3eb3217bda4c19eb9ef14ca52df7e719e20cbfdb08c6392f0dc16cc0318c0b40680457d11f62dfcc388c1e686350387abae19777e60a30c7de2becb7494d67e4f0b600ce8e31d30eba0ee356f51c145cae32fb313802b3e0d7ce36ba6cbb37805808ccb0696d04176c61014cab74df2fe71bd24a830e52a987821ee55843b562d3dce179830c2f831855bc7fca6973f2b86a49427063939e11b2b44801f4cccac4e93f1a3f4fae3d75d3645a0f6c56e54fcb3311044513d1485fa052278366fc1dd94f5d46d916ae8b01a57bb5d718ead1c6c381fa01d3c3a201cff0878327dd830847b963308b2a6f95c4e11ec31cbc93a629f883d3dda9f9cd7f4cbc123fe31a8a018f7ba1c956c76b41808365c4405d76a11dbfc2069ad7c9f142c4bb4f578abdfe61a7059b02babb0bbb34e8709d640800dc842b143c7dadc8af3c0923306b9ec4ffa1de7b84091a96f5314d137362aef4c165a263476ae00e3cedfabd87dd76aa443874cc6cc01877156a2ec3328feacb36793b9c4e7f32a2774b5835e8cce2ee8da52528b27908d0702d2cdafc10d90fc88746feb80d555ad22087368bbcbb56b82dfc676b5bf1834ac873a2e796453fcbab97de46817e29d45493d7f321834c1f93f7a23fa5bb015d1caa55ec3dc456d1710a8f08ce58f6f74ad392f680530ea5f892b255fd27b440b67198b946ff937bc4d2894503c14305107d954c69f51e5feec4d0e1efe78224ca755be7c85ebc1f191233e2f5f93e8cfb2443408af49c91f36601314d6ac660d44781f8710bafd892a6990cde0cc144ed7d5c1cdaff8b205f00cd7d79d24c3d1b5dec1a0a1bf1f7570d0093d892847efcd9985227832acf0e7f8e0238b7853b33d414a0949c51b30a71a3d92d2cd8a9a2756f2c37e6bceb985808d4da9d9a06c783d2efca645ad497d6ec06de65bf1abe9411cbb311a89df95a54b9c6f0ac50ef35e4e4bdb8ed8ebbe0dc3e3991abf005fff4fbef62f6a938b0af4aa782cad54933c3be0ff3cdd02ee6a12ac1c4a15aa0d10d29c81e3ed9dea08ea75d8bd7c161bec54b61ca957e088c31c308b270b534823b5ca2861ad3ca7310fe18681c52726763e5179d0623a5029519409039a9a8317278c018bc03f830c1bee39b74f364140e15064d769792c729a4321d5b4ee3fb240401b8c513081dd108a2a2eee0070a3aefc204f80ef43caac74af81e094f5b4107a50baa6d982063c7ff1a1207e3c11af5c8c9a1ea91141965cb2af94af7832b9f5d93fdf8b9a5745e9539e80d921313d43438c34017ad958581a34dd710eab43d8d8e64fcb2125bf620745bf167d2087379a8d30e405da2bf99d52c994bacbdc15b68fc2602874d9d56b1a7151ec93283e6bb9870e4d4fe2e7d4af9162d7e1c90a1fd8073f556981b329234ce877ace1d02d7e6c51fdc589bfdb85df84998498207b882c27a70f78cb48bfc3828d769d1a2e251c66aa9ba917d423c70e64a5b846963bc9a1b47423bd442ed5654fd1daf3d16e92d0e88399016da92bfc7f70b8f6814f36e2a441d27cce75d11c07bb46a04953389e59263d4c9e5a8fe5d9c56a3e4e163e7d3c51e99aecd1de97faa420a65612ac47fcc0359c13da70e2c2701a4e9645a9550934667d0928ace91797b9daa0d6b8f9e52b2526b567dd68aef2feed3c0592241e42a0e58cee06935fc04be597f85bb09b3a53488a5f358ca00242ff7a478e18dce5fdb761f11606d604d515eac1c0798a6617bc92f5a498b8ef56a69a2a631c9eca9d9cc1751c09a006ee6f4fcd21849e15c7780f2adf3639845822fab75e02074951f8ba9084c2d2d7d073af4463da357af311e607b02381dd35933998b8a7619f36213481785a4a9096a783634ea80bc7204ff769d8d286126e6cd7bf0c8cd9d30971bee9bf47e8d426c59fd93fbfb5b0825d93c9c9294fbd857f01e68fefdf6917b3de6381b65c0826d40eb0408e969de5e29e776c51bf1230322216523f4418ae6f436310c223a3c08f25ffcec5c7a3779842ce16ecab67d7d55702074ad705a55f5593785e0c5dff1f2cbcf4e5febab750776d830c47704a9c903ec1edc6d7ba54e9badd619e5f5ecf8998e0af6a6342b05706908e399ffaae45ba4d5ad0c04f7b4b23dec5d9e6229a22de3bddf5e722b7d19ef61ab4e3efc7458f8852aa5d87decdce315c56c0cbf2b02b9b63dc2332ef4b84354f9ebefd870371a49c5f1f405e2c5759acb6ba0b914cc096f5e754870ac0d5e4504c03aaa68f9aa294119d7a49734442408f77f29beb44010a526382e4f79e7e48cc80f4925dcc00e6cf2e8bcb1d575c56afecd7a3942e4d3a7b8870ebd79561e65c145ebd1fd851f502ca4b2a1163dcbc338a1601a0c4f73ac2dd1a1c087f6f8032ecaa41ce5ce26317aa10460e13da1ea7f20811289f906061044243a9e5794213668c3d256b2a2137d855942246057db0781690bf4c76ceadfc63ce2f5aad9fd1a89df50522edf9d3c0e04be903efb825e36aab74feb43275f5f704e3288c8db8c8d35eafc5025a20a6ccaf95e82245eb00c977bfa130138d0d96023df34ae15e99b0463a3e346859c9eaa4e0618b0b4463c4d848c3eb2ef276cbe353d0f0028c0d60a5bbafed35b084e1488fecef84572a62ea63a11f40a9e9058974427a8bc4d79aed4349461843a45c4d858c615120ad04a3e6b1a64651b24061d2dd8aee23d570114c4cc5aec9b1a9b56d4fffac86e2cbe2205e705dcc230a3283ea4662dea1f6fdc0ad41d10ddc4ed905c7b7485469b24a2b0e0c982399f7a40fd74d29cc2d611a07a88f7fc978b810a73babd55a4a4a9afd75e9c0bf1dcae41b9ea7b48ff0aa38b7118bbae75c5bb731302cd1439227b3f4d3f8b59d5b692309ffe08b1ffdc8c1ad8c399b382b455c985b7688dba7d7f01b94aaf104d7f7341d28e479b625ad59a6819ef6eb37527fcd0b54d930ad5949df2aedaedb9c8a31ab70ffb4ab4f020a92961ebbff41e2170732a6c9f8aea79373e78de32cd33cc2d775f7946836e1b869fbf3c99e21b7c347a59ec14c80da5b18dead124b8693a7c1bacbf0002e2408159b4e055592107cc92c7a31a83f66ccd1d342bcf350cc7a8b51a03bb021994b7cc2f281eb467c7d86d63ad5dac13dd231d1a7943490b14667740083d9590c00063be4cbc6af65150b6c3ded06a3d0f53844d2faf83a649fb6191207e9a9076a634f7afc9b0a47ec57f84adb4ea6025afdae5c4e97f178642690b05fbdede3f600d737105fbd916746e40e887d181ee1614decaa9f8a6eff32119d99ff67e50d6b45b5d2d96a7c298a1296a4e1ccb66ca61d504cf35f0581da7a9b3681cea26e7ccd14b17fbbe863358b2915a815ea870956d884b1e646c53f83b06f92dc0d47588631ae89f982d2ab09cbe2a531aea169aa0f80d72433e5c68286ed5b0cc714895d46f6ec262b74095cb60063c4f67ccc00ba407c2175644dc93f064f08d5226ccf190331e4995c576ad5f766130c0cec9c139c6af0cfe0cff161ffbd65be811b77e9fb4890ee36c2d8c53120ddfce2b1bc72368e071137e2964a61c286b51d420df3acbca1efc1efb5c5a8eab58b27c8e39d371fa54cdbd6ae5b197d3593c3084f7f5a2ae6da7e2bede914b960281f041d7f5aba5761a14e840ddab5ee321689e0cda61357ab162aede6e7d449f2d283451674f0945e97b831d726959c057d7e21d837994f0636b1f74bded8b98297327572b21cd8def2532616390360d7980342e210b00732ef10b61c9c177adc28dbf3774686713d9ffb9f737208429b5522f8a0fab839a400e12b6bc79aa446a63f66fc12937667c6f4f911614f75df9902eacca9926e387ca6f49337b4f69c4909faa235e67eb770c25f0f4e3e47db75f8e065b1ce22c417966ec2ae8", "76fb89a3571ec48bfe19ec8d55f54e6127e0fb1d7c89e73ea646cd7e291294396f094baf6fd791c7b138ff175ca83f107fabb75888d9c22c3b2017425eabb07c594bfe3b3fadc2d41f23c71c26db5603e4ae8e9460a2f6c6d0d7c71147e86e37a6b5cdbc5e077e7612f4ce5d090eba46621fe31a17f4870a680030d15cc97e7031bca70602901b33cd7725709bcbcbf937e6985d26fbe3015e661ae9351224238d5ffed819b1ef674f0be400bf40c78376e91d640b102aab7b28244554eceaf316283359459cdbb8e8b8c51ed963d12b36354286bce8bd9ad422e1eb97739fce8efdb7f7e9fd933780057542603c24de4df4ba92c3f6941527a9e31a47fdce9351008613ce602188a9a2d4c1dbb579c4a24a6bf865b9d50520ca7af2caa55c1a21338503df94e02c1a3a36326eb664bb0560997fceb86c563d5f9875788d680ed940e57e0794d7ce2c51401219ba93c234d8eab3c44d912f01ac76da2a06aa821facd2f674d2b675f0357ee33ab239435786ef99867d049d716e4e5d0861c036d59bf355146cc144754eb1c8a5b505aff529b249b47038fdf2ac0971069e4cbb3b0edc44039c15f8ea9f43c54719348dc29a39600d946252152d7a62445f6eefb7c8506d6e50f9a52f999b8d9f1543c2d634abaded36ff47d85c75b2a9718d44528e6064534ad7e3cc36857122a4ec2002bd1ec2f75c2b8442e1cf37b90dfeb29e846922fad6d093cf1ee1039e70b321c2db10329668a1309a5f5e4e6c1f20dcbb110c942fcc364555b1e08ee9279fec49cdfe1e29c31caa9b636db281d87bf55baf84f7e6b92f797b2d547b5af644c89ddf9b026133d65134187c291b95c70abebd7b42d189d88f48ed39cccf7867d2631aca4f7f5c105cbbbdb3a7f6ceeca94ca3365f701744b6d57085ab0548713fe28cf47b2fd698fd648d91107356325ffaf364f2f776445720b9c82f4d5da2316ac9a23de6f963e6cfb2b18baeb550da43905698688c0a7447e38b8370ffa5d00f9be36861f55b61a55f6bf7571d85757e7e3aae3e0969cdbefecc117e746bc42bebeb865f374c3649e71fbb8447c87a7f01953874e7c37b9027e28e778190759bbbe9743224824bbcf36435f08964ca49f63455ce712189e8607e37b23d4b5612fd98c97ced660a67369d770289f52eea00c5e71cbcfa9caf11a6ceeea6b6c8ea154248ed7acf57235f489b79298996c823f3696383bc80f309da57df955a695429b6e1fca78ef95ac2e003722b938905e81daae35f892a97f2ef225e5b8af109e5230417dd6e81166de6fe386e564b80c70bfb1006a5c54fa5a0aaca07186637e5a6293f88a645049793f235f7e0c1dd3cc0170f9d6f531b4e96eb3ee8f9a8613229dc156d297be3954094e531367b6c02f1f8d4233ad0b0572810ad5dcc7a9f31c8ef1e76065b79c86fd3b0cb30a6d2082fee23742f37d58dad66d4b8d48a14b962a3ccd639d8a90a8927ede571483dec2958c42ccab1e45781034a344b3afef5a3228bceb8fae65e1227a83f829ee47262eb1354d03241eda8c01cefaaf8eb09c2bc4447413d7e7e485fdcec58554d53373c1ebd0e9e750462e70c2c4b4c71d85689d205b356df51574777ff72157b61bee6ad32ece3aa3b51ca2b1118dc570307466dff0a248e04a471fbda50e5a18edd0abe4757eaaf6ae840f47d37f32b1cca6c2fe658d9ddcbcebb409212d624b32778b31818ee323d64636a9dc943dca88b40741ffa2a10cff68cb92a91454c97929af35923ffec684146dc57711807607e20cf6d209f5d41689c66dfbcc76e0423bf6662ce271541f7bc3052fd9a6f754516e8865affe986185b1c2592171a6a51ca2fd74b81bc348efa2693b680e420558a4e1f8d70114f4fd821d0a9cab939a3e12bf59c77f8b26f919c1303ad89d0f9c123608b191a60a82c07e56929fa814136a408c2d164610dbfe16c61f41137c86a61a109ca92da39537071f69442a62e25fbf48e9cb65e880a84c2558413132a3bd3133d541a48b25353213f02dc1ceb2303689cb93534d39217b1a33bfae3d6ca848d9e7a49f806616a7d13ff171f862df0ec664be3b823ad509afc6700da94231f411173b01341d68efd26cf2cf9526fa0fd4a911d00f254e7431b9a2b6f9ba97762db396dd3667ab433a2f1e0135c8f2774336f44feeb33a37f45f4ac152d63480ca7d2bea8332db41114dbd6308d55b357da754d7f71564316cef44a4446663759532e16fcc9732b5c0e2283d5182aad88f03dc83960fc35ee4a48fb8128c2583251153f67861f5dccbad6b6b9bf1c35539760a7c7c77de4dc707de35c240e0ddee06bdced88fba552b59ee03a8f8d962c52ee2113de8487bbacf489e5c9baf4b4ee75fbc986314907603af675ff3e90a4467e41c208cf43fe192a0c9ed92f6a44a51a387d94af7f7006f18e3220f588932c147facdf128eb5c985d86da85932a343469c3bff9aacc2b077c8bfc041560c25bcae02dd6ce7a7da7dd33340bf6faa22d995c171ed2f3828bd2908795af1cf4c8ba456135bf7eb26ce0eaa7f8c757f4e113b12b92cc5b55669a7d38de07b61fada10230c9eca7d54f08362700174ad82ea45430c2b81d45b1a8bdcde3ac05b5940975842a5ca9c75168201f6e797cd284e7f30d5c6dcf1b5b84c1f408f24275966573724b7725a662a4cfbcfa7a2905281e7bf23e4a377f48be8342654e6595f9da06ae8af8f5bd299bf36c4dead249c633e71ebff543086652e2dc7f5af902ce6286a5b22454db5ea0bef36229e1bbd60deeaee10b4ac2813ab4ed57d382d16097b463d751be1641728579d8296925dbeefb9ff4f84844a0c2c0793a44dc140f9a52445845d0246c38bf2fa945594603f046055318d26aab699be5643270c64570e6954899fd37323a000d2fee78f4a9683aab87ed90beb3eed95d87078dcca31c95ec00ac6c21c56443bf7ad228cd4abed51f99a9cf14d81ead5d211ffbf3e9feb3798f46f9d6f868a2786569c9b95c613fed2f7d86d8e5529df901d5bcb3d6c4c6a64794621e561ce7a82899bccf9180f8b64d8c886353d5ad95183ff7c06a001591666fa716b3fcf2f9b5eae3987769969dd140c9e7e566fd76072669d62659d9e6d21ee9f7982e657ef1f2700a56b4dae8ab9efff246ba3ca0b6c75367b6428a667d2ed242a0b70d05de25b1899f3f70442e3c8d1804552b8e433aee9807fd2cd3d860b3079d3f2f5c187583b363cc32b568e8bbd3d3d398a318a389b12a1010d30982fa651b65573eec188cc269dd5a318d4f9a5c40255c1f65b9114a3c94263bd4633a391c4ac96ee0a13bb23676cc8f96ccd7739e516047c4eb9474882adcbbde042766e20b42a9442bb2198d4615d24c82d985a998e04817726e927391c2759cae3ff3b9d00a96b069daadc787f06972a2f9c8b8c355b5bfdea96a60a3b1b292f561d77b9a0cbdac63181674be40e84973b558bf61cad695bba07791fcedc0fa8b081b4015766bff8408fece19572654912a358c6a127e614468167fda37165fc14562970677371aefcc8b763244b8a0a49e2b012409724433bbab63a5ddfb3d13f9a6b3f7b169692584b4dbef0becd92b79195a701b9ea701785225fa61f4e9bdc40a8482c70add0a6f6fcf18cef1ee44557bafd042af026ef9fd5a2e3131833b55ebded5af2438cedefd2938242b241ca7dafbdcb3f3a3bcc54b5c88cb14c566f143bc4d81099d2e21a874de303fc4a07ec2d08de0b6ebc4e2079a63db6e6c39ba0bbfa9a610368077080aae3d4a532d5cf3e2932d819e3e367dba5d73f115dec4cf3cfc82c087e8abf41945b35b6c620a39e618e72dcd985702153827d02f335abdc161ea20306f74fce8c1da0d4e8153fd7dee0e8831bc37dfb384cf9ecab6bf804264123b181e140997688084a2d834a948449b8f7712b0368b8bc3bb2857cb5227f42dbf5d27cc3304fa33bf3bf6fbdf0da17db89fd2fbbb0ea5d5edfbb3131137cfef1d91271bdf0700d31d83d9b00ab4b1238dd2206225b2497f3c20c096f622acd610d4b3f8992cca725f6e10535a30fa53e26f1766e6ea560c0c9be714451a1b38dc69377039079f4e240d714ac51744e099bd16df4bc885b149c2bf159a3827bcdcdf78875bd4f49558ae0695fa310bb90bd957dab3ac30da11bd8d56794eabf20e32d9e07cf486ed0acded4253109d4447ac2c6d242ef5f1815f83c8fc3538c22b598fa1e4482b0a7452f8b8f446b1a9f1a29f01e89ebb3776bb7e851dcd7884bef21c59ff67b3fe3231b48f7853a819d219b17884ad591b238a04afa03344f247e28f2934e4dc740d2edda07ac3e2dab37b0daf6e2fe2cb3e4a44124bf4840d6d4c98c1c9c465dc3a8f25e8af7b5a3e4052093d8ba94e1732dec94c57012bf84e6d9ebbe857f7022fe0befb982a3c2f2a44806f5c3f0ac5af7367b70741f263cd07e3dc32d5f632d53805007ec535b9efddd199a623798427e1d18bcf47de5fbd941c76ae648787af8e183ac57a7ad6cf4bc965e17a16262893f3e274cfd02ff1cab844f3ebd05c0e2e65685246029fa5caf8254d05bfabb271bf20fea091a6d175cdc4d2026f25c631de56a98a25efbdf03b874c58238966be0d0478adecd1e08219a70c96dbf58a94086267a0eb0a12fd389a145cdba504110673cc64d668a1bab5b591ca60a48785843e95b91a72cfd049814e6d1cac9340798b71ecae131b22f00a882009f009bf9e318029f31c4f197478855e9404a6e14ea63b039d95466e6612d4e439c2ca1b1362849b9cbb6f511dd547741ba22a77ac01139c47fb8c5210c3645672c9f1a66f46c4b8bfbaf3a0039eead8abd43e985b16483eb4434b06f9a090a70687180191dc30807b6c21edf63228e7d3c3a860251e6d72409bbb73345292bbfc659438f74e237f23c28f19319f3f59e7ece7e542aa726d8edf08ed4b313cdc43d3a933cc743843912b63f845198d67c3a8e87547788ed146f2bf2677875c30fd8c276d5407457456e8ab385ccd533d70eda317fa81a10392f94cfcdda58e9b39e662f163599459b92e14ce17e9d487cbe2040b5e8073ce8b45cc5f822dd9696780ff9c097dd233869fc5ba24d8a9336770ab8834ac0f08aeb20e5b6363d0394cc6465b70b709d32d6faf07e6eac02e0f5d4ccecab3a5d99dd49dee8a52ba13e828d0f82826c506670b6689f17ef35721a10445b8ab3b58c62cf79c71cd6340b4d6635480fa91927d04a544447559eece3965e14de8ed6c78b9c9c0a9de9a2ffa03b4676bcd4899917ae03bd29081ad71abd8fbf00e9025e2e0da72e56475259ccd14ecf5b16fb8176ebcda76e154a6607bb58abf9bcc16935ebf807ee37e14ff632700b00ce2f9a8063e889c6901625716202b5fc8c715a458b3637d50a933897f0c18804cc7a3a348c435221aab3e36ec68121251fa26009a93e292f9fc33bd8223e251f81a99be393607d6de760cf2de4f0ca0721bcf057721df51316f7538f214b3ea9c4cfa12c1af36f577b0bbee50e74cdf3d1be04bdf1a64cd78b520c286e2d0fd507cb04c6db4d77fc8bfd6b07b795a839a037319723e569479aefd472b60928748d52e6515366c04f72c07455bc7a20acc0e2f27c3631b67196983a188547953c2747a17e80ae795e142a5d2147b60787f5990851dcd010f46e7046773424832c4b75fd0e690ee11c04d1109cb6560033df023fb6275a68b17885b3d787d5756f01c3782b53cb5b297db51d897d35c2f1d7f3395638972db3f14fdd7fb5f17797347fad"}) ioctl$SNDRV_TIMER_IOCTL_STOP(r0, 0x54a1) [ 2758.187371] binder_alloc: binder_alloc_mmap_handler: 4405 20001000-20004000 already mapped failed -16 [ 2758.218017] binder: 4421:4423 unknown command 0 [ 2758.230971] binder: BINDER_SET_CONTEXT_MGR already set 14:35:51 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0f\x00'}}}}, 0x68}}, 0x0) [ 2758.245846] binder: 4421:4423 ioctl c0306201 20000600 returned -22 [ 2758.252877] binder: 4405:4406 ioctl 40046207 0 returned -16 [ 2758.285716] binder_alloc: 4405: binder_alloc_buf, no vma 14:35:51 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40046302, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:35:51 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ubi_ctrl\x00', 0x40000, 0x0) getsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000080)={0x0, 0x4d2c81b9}, &(0x7f0000000100)=0x8) setsockopt$inet_sctp_SCTP_RESET_STREAMS(r0, 0x84, 0x77, &(0x7f0000000140)=ANY=[@ANYRES32=r1, @ANYBLOB="ffff0700030049000007010300007d59b1e8"], 0x16) syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/net\x00') syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/net\x00') [ 2758.291908] binder: 4405:4429 transaction failed 29189/-3, size 0-0 line 3035 14:35:51 executing program 3: r0 = syz_open_dev$dmmidi(&(0x7f0000000000)='/dev/dmmidi#\x00', 0xffffffffffffff46, 0x10400) write$uinput_user_dev(r0, &(0x7f00000000c0)={'syz0\x00', {0x2, 0xffff, 0x200, 0x84}, 0x42, [0x8, 0x1, 0x9, 0x42, 0x9, 0x1, 0x71, 0x400, 0x6, 0x101, 0x7, 0x8, 0xbb9f, 0x0, 0x100000001, 0xff, 0x5, 0x80, 0x5, 0x2, 0x7fffffff, 0xfffffffffffffff7, 0x1000, 0xa5, 0x3, 0x6d1, 0x1, 0xf484, 0x400, 0x200, 0x4, 0x1, 0x5, 0x9, 0x2, 0x4, 0xdf, 0xa6bc, 0x47c6, 0x85, 0x7, 0x1, 0x1, 0x9, 0x8000, 0x4, 0x100000000, 0x8, 0x5, 0x401, 0x3, 0x0, 0x3, 0x7, 0x7, 0x9, 0xfffffffffffff9c8, 0x7fffffff, 0x7, 0x101, 0x400, 0x8, 0x7, 0x93f], [0x1, 0x49d, 0x80000000, 0x1b, 0x9, 0xaf, 0x57, 0x2, 0x47, 0xe4d, 0x7, 0x3, 0x3f, 0xe3, 0x8001, 0x6d04da74, 0xc3ec, 0x5271, 0x100, 0x6, 0x1f, 0x6, 0x2, 0xc026, 0x1, 0x84, 0xffff, 0x0, 0x1, 0x3, 0x4, 0x200, 0xfffffffffffffffb, 0x0, 0xfffffffffffffc00, 0x0, 0x7, 0x5, 0x9, 0xfffffffffffffffa, 0xfffffffffffffbe8, 0x1, 0xc0, 0x6, 0x5, 0x4, 0x5, 0x3, 0x28, 0x80, 0x1, 0x20, 0xfffffffffffffffd, 0x92c1, 0x8, 0x4, 0x8, 0x8, 0x1, 0xfffffffffffffc01, 0x9c, 0x7, 0x7eab, 0x20000], [0x1, 0x5, 0x1, 0x2, 0x5, 0x1, 0x7, 0x3, 0x6, 0x81, 0x213, 0x4bfe, 0x7, 0x3, 0xa0d1, 0x101, 0x7, 0x7, 0x4, 0x6, 0x80000001, 0x80000000, 0x80000001, 0x200, 0x5, 0x9, 0x2, 0x6, 0x1, 0x0, 0x6, 0x400, 0x0, 0x80e, 0xffffffffffff0000, 0x7, 0x5, 0x1, 0x4, 0x1ff, 0x7, 0x8, 0x4, 0x4, 0xfff, 0x0, 0x1ff, 0x6, 0x5, 0x3, 0x4, 0x3, 0x81, 0x845, 0x9, 0x800, 0xfff, 0x4, 0x7, 0x0, 0x10001, 0x8, 0x100000001, 0x8], [0x4, 0x7, 0x80000000, 0x2, 0x3, 0xfa62, 0x5, 0x0, 0x2, 0xc77, 0x0, 0x6, 0x1000, 0x7, 0x0, 0x502093de, 0x6, 0x200, 0x3, 0x6, 0xffffffff, 0x1, 0x4, 0xb850, 0x4, 0x200, 0x6, 0x63, 0x10000, 0x2, 0x8, 0xfffffffffffffff8, 0x0, 0x1, 0x4, 0x2, 0xffffffff80000001, 0x8, 0x2, 0x0, 0x5, 0x81, 0x6, 0x80000000, 0x2, 0x7, 0x80000000, 0x1, 0x4, 0x8001, 0x8000, 0xff, 0x7fffffff, 0x3, 0x9, 0x6, 0x400, 0x1, 0x106, 0x80000001, 0x7, 0x2, 0x4, 0xa8]}, 0x45c) r1 = fcntl$getown(0xffffffffffffff9c, 0x9) syz_open_procfs(r1, &(0x7f0000000080)='mounts\x00') [ 2758.341703] binder: send failed reply for transaction 8984 to 4405:4406 [ 2758.350161] binder: 4405:4429 ioctl c0306201 20000000 returned -14 [ 2758.358212] binder: 4431:4434 unknown command 0 [ 2758.363086] binder: 4431:4434 ioctl c0306201 20000600 returned -22 [ 2758.370921] binder: undelivered TRANSACTION_COMPLETE 14:35:51 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x004\x8c\x00'}}}}, 0x68}}, 0x0) [ 2758.434252] binder: undelivered TRANSACTION_ERROR: 29201 [ 2758.439784] binder: undelivered TRANSACTION_ERROR: 29189 14:35:51 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = socket$inet6_udplite(0xa, 0x2, 0x88) getsockopt$SO_TIMESTAMPING(r2, 0x1, 0x25, &(0x7f0000000040), &(0x7f0000000080)=0x4) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000100)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) syz_open_dev$vcsa(&(0x7f0000000180)='/dev/vcsa#\x00', 0x80000001, 0x589000) 14:35:51 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x600000000000000, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:35:51 executing program 2: syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/net\x00') r0 = creat(&(0x7f0000000000)='./file0\x00', 0x10c) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffff9c, 0x84, 0x6f, &(0x7f0000000100)={0x0, 0x68, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x4, @loopback, 0x10001}, @in6={0xa, 0x4e20, 0x9, @ipv4={[], [], @loopback}, 0x1e93}, @in={0x2, 0x4e22, @broadcast}, @in={0x2, 0x4e23, @initdev={0xac, 0x1e, 0x0, 0x0}}, @in={0x2, 0x4e24, @local}]}, &(0x7f0000000140)=0x10) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f0000000180)={r1, 0x4, 0x1f}, 0x8) 14:35:51 executing program 3: r0 = fcntl$dupfd(0xffffffffffffff9c, 0x0, 0xffffffffffffff9c) getsockopt$IP6T_SO_GET_INFO(r0, 0x29, 0x40, &(0x7f0000000000)={'nat\x00'}, &(0x7f0000000080)=0x54) r1 = syz_open_procfs(0x0, &(0x7f00000001c0)='mounts\x00') sendfile(r1, r1, &(0x7f0000000180)=0x74000000, 0x5) [ 2758.490097] binder: undelivered TRANSACTION_ERROR: 29189 14:35:51 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00'}}}}, 0x68}}, 0x0) [ 2758.581608] binder: 4447:4448 got new transaction with bad transaction stack, transaction 8988 has target 4447:0 [ 2758.594379] binder: 4447:4448 transaction failed 29201/-71, size 0-0 line 2946 [ 2758.629534] binder: BINDER_SET_CONTEXT_MGR already set [ 2758.655726] binder: 4447:4451 transaction failed 29189/-3, size 0-0 line 3035 [ 2758.683263] binder: 4447:4448 ioctl 40046207 0 returned -16 [ 2758.683329] binder: 4447:4454 transaction failed 29189/-3, size 0-0 line 3035 14:35:51 executing program 4: r0 = syz_open_dev$sndseq(&(0x7f0000042000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r0, 0xc058534b, &(0x7f0000000000)={0x0, 0x6}) r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x208000, 0x0) bind$inet(r1, &(0x7f00000000c0)={0x2, 0x4e20, @multicast2}, 0x10) [ 2758.708957] binder: release 4447:4448 transaction 8988 out, still active [ 2758.725201] binder: undelivered TRANSACTION_COMPLETE [ 2758.730545] binder: undelivered TRANSACTION_ERROR: 29201 [ 2758.742593] binder: send failed reply for transaction 8988, target dead 14:35:51 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c3c31d8f26eba57da9bf7a000000000000000000"], 0x0, 0x0, 0x0}) [ 2758.879752] binder: 4462:4463 got new transaction with bad transaction stack, transaction 8993 has target 4462:0 [ 2758.884752] binder: 4464:4465 unknown command 0 [ 2758.913522] binder_alloc: binder_alloc_mmap_handler: 4462 20001000-20004000 already mapped failed -16 14:35:51 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x9e\xff\xff\xff\x00'}}}}, 0x68}}, 0x0) [ 2758.925245] binder: BINDER_SET_CONTEXT_MGR already set [ 2758.931439] binder: release 4462:4463 transaction 8993 out, still active [ 2758.940450] binder: 4462:4463 ioctl 40046207 0 returned -16 [ 2758.947144] binder: 4464:4465 ioctl c0306201 20000600 returned -22 [ 2758.959243] binder: undelivered TRANSACTION_COMPLETE [ 2758.968187] binder: send failed reply for transaction 8993, target dead 14:35:51 executing program 2: syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/net\x00') syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/net\x00') 14:35:51 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='mounts\x00') sendfile(r0, r0, &(0x7f0000000180)=0x74000000, 0x5) write$UHID_SET_REPORT_REPLY(r0, &(0x7f0000000040)={0xe, 0x6, 0x7fffffff, 0x10000, 0x9c, "324cd93e12f8ffde7482689501c63083303d8b4613d231dcd605dcff04871dc865cba3e9a1a892896cc4cf03c396089417a906088c7ce84ed88f01c2dcf0aa5cfa9d6d0a5f20520552d78d504cead51335f09d47e3958d17d7773cd908428e3181626aabd65eff1824f7c76ba49294cb0cd373eff79f02cd9596f167142c05297dd15261b77fed471362aebb42ac77b9a417eb29e1b492268dfbca49"}, 0xa8) ioctl$sock_SIOCDELDLCI(r0, 0x8981, &(0x7f0000000000)={'hsr0\x00', 0x8}) getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(r0, 0x84, 0x6d, &(0x7f0000000200)={0x0, 0x92, "a9ea8f2aae863f66dff14700f2d31f282ebc87b8df50be1d2f3f90caadb76a859cf07a8359795c259e235f960813c41eb5146675343cef6d9640f5c0a5f299b17d021610dfd7f5b60d66e2d11143c0909acff6f83db03d9a7200d8b83db105ea0e0a42ccebbe9fb8fa9f5242e74e8611b1540b1449af1d6339775de696fe8ea34420ebb0700de5076a367083fa5127e3d28d"}, &(0x7f0000000100)=0x9a) setsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(r0, 0x84, 0x18, &(0x7f0000000140)={r1, 0x9}, 0x8) [ 2758.976454] binder: 4464:4465 unknown command 0 [ 2758.990451] binder: 4464:4465 ioctl c0306201 20000600 returned -22 14:35:52 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x2) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:35:52 executing program 4: r0 = syz_open_dev$sndseq(&(0x7f0000042000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = syz_open_dev$vcsa(&(0x7f0000000040)='/dev/vcsa#\x00', 0x4804, 0x208002) ioctl$KDSKBMODE(r1, 0x4b45, &(0x7f0000000100)=0x9) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r0, 0xc058534b, &(0x7f0000000080)={0x0, 0x0, 0x1000000000ee5}) ioctl$KDGETMODE(r1, 0x4b3b, &(0x7f0000000000)) 14:35:52 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x630b, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:35:52 executing program 2: r0 = syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/net\x00') getpgid(0x0) r1 = fcntl$getown(r0, 0x9) syz_open_procfs$namespace(r1, &(0x7f0000000000)='ns/net\x00') 14:35:52 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x7f\xff\xff\xff\x00'}}}}, 0x68}}, 0x0) 14:35:52 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_dev$mice(0x0, 0x0, 0x0) write$FUSE_INIT(r1, &(0x7f0000000040)={0x50, 0x0, 0x5, {0x7, 0x1c, 0x0, 0x0, 0x2, 0x0, 0x0, 0x9}}, 0x50) r2 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000380)=0x6) r3 = syz_open_procfs(0x0, &(0x7f00000001c0)='mounts\x00') sendfile(r3, r3, &(0x7f0000000180)=0x74000000, 0x5) [ 2759.139004] binder: 4484:4485 got new transaction with bad transaction stack, transaction 8997 has target 4484:0 [ 2759.151073] binder_thread_write: 13 callbacks suppressed [ 2759.151084] binder: 4488:4489 BC_ACQUIRE_DONE u0000000000000000 no match [ 2759.187681] binder_alloc: binder_alloc_mmap_handler: 4484 20001000-20004000 already mapped failed -16 [ 2759.241802] binder: BINDER_SET_CONTEXT_MGR already set 14:35:52 executing program 2: syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/net\x00') r0 = syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/net\x00') r1 = fcntl$dupfd(r0, 0x406, r0) getsockopt$inet6_IPV6_IPSEC_POLICY(r1, 0x29, 0x22, &(0x7f0000000140)={{{@in6=@loopback, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@initdev}, 0x0, @in=@multicast2}}, &(0x7f0000000240)=0xe8) lstat(&(0x7f0000000280)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) mount$fuse(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='fuse\x00', 0x10, &(0x7f0000000340)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x7000}, 0x2c, {'user_id', 0x3d, r2}, 0x2c, {'group_id', 0x3d, r3}, 0x2c, {[{@default_permissions='default_permissions'}, {@max_read={'max_read', 0x3d, 0x556}}, {@default_permissions='default_permissions'}, {@blksize={'blksize', 0x3d, 0x200}}, {@max_read={'max_read', 0x3d, 0x1}}, {@max_read={'max_read'}}, {@allow_other='allow_other'}, {@allow_other='allow_other'}, {@blksize={'blksize'}}], [{@dont_measure='dont_measure'}, {@subj_type={'subj_type', 0x3d, '#-\xa1'}}, {@obj_role={'obj_role', 0x3d, 'ns/net\x00'}}]}}) setsockopt$inet6_tcp_int(r1, 0x6, 0x19, &(0x7f0000000080)=0x68, 0x4) 14:35:52 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00'}}}}, 0x68}}, 0x0) [ 2759.262389] binder: 4488:4489 unknown command 0 [ 2759.272546] binder: 4488:4489 ioctl c0306201 20000600 returned -22 [ 2759.292082] binder: 4484:4485 ioctl 40046207 0 returned -16 [ 2759.294137] binder_alloc_new_buf_locked: 3 callbacks suppressed [ 2759.294144] binder_alloc: 4484: binder_alloc_buf, no vma 14:35:52 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x263044000000000, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 2759.369342] binder: send failed reply for transaction 8997 to 4484:4485 [ 2759.379513] binder_alloc: 4484: binder_alloc_buf, no vma [ 2759.391386] binder: undelivered TRANSACTION_COMPLETE [ 2759.417045] binder: 4505:4506 BC_ACQUIRE_DONE u0000000000000000 no match [ 2759.442215] binder: 4505:4506 unknown command 0 14:35:52 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x101100, 0x0) getsockopt(r2, 0x6, 0x474, &(0x7f0000000640)=""/4096, &(0x7f0000000080)=0x1000) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='DR@@'], 0x0, 0x0, 0x0}) setsockopt$TIPC_IMPORTANCE(r2, 0x10f, 0x7f, &(0x7f0000000100)=0x40, 0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:35:52 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\x9e\x00'}}}}, 0x68}}, 0x0) [ 2759.462672] binder: 4505:4506 ioctl c0306201 20000600 returned -22 14:35:52 executing program 2: syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/net\x00') r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_opts(r0, 0x0, 0xd, &(0x7f0000000180)="3ffe32e3054f92ce6fc1e3ec3bf7b370c53a0d79296840640d8081ecc230adf5", 0x20) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vga_arbiter\x00', 0x41, 0x0) ioctl$UFFDIO_WAKE(r1, 0x8010aa02, &(0x7f0000000080)={&(0x7f0000ffd000/0x1000)=nil, 0x1000}) syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/net\x00') sched_yield() getsockopt$inet_sctp6_SCTP_AUTO_ASCONF(r1, 0x84, 0x1e, &(0x7f0000000100), &(0x7f0000000140)=0x4) [ 2759.520971] binder: 4514:4515 unknown command 1077957188 14:35:52 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 2759.581390] binder: 4514:4515 ioctl c0306201 20000000 returned -22 [ 2759.634575] binder: 4526:4527 BC_ACQUIRE_DONE u0000000000000000 no match [ 2759.641624] binder: 4526:4527 unknown command 0 [ 2759.659446] binder_alloc: binder_alloc_mmap_handler: 4514 20001000-20004000 already mapped failed -16 [ 2759.673849] binder: 4526:4527 ioctl c0306201 20000600 returned -22 [ 2759.705070] binder: 4514:4522 unknown command 1077957188 14:35:52 executing program 4: r0 = syz_open_dev$sndseq(&(0x7f0000042000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r0, 0xc058534b, &(0x7f0000000000)) r1 = syz_open_dev$usbmon(&(0x7f0000000080)='/dev/usbmon#\x00', 0x7ff, 0x80481) getsockopt$inet6_tcp_int(r1, 0x6, 0x1f, &(0x7f00000000c0), &(0x7f0000000100)=0x4) 14:35:52 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03@\x00'}}}}, 0x68}}, 0x0) 14:35:52 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='mounts\x00') setsockopt$inet6_MRT6_ADD_MFC_PROXY(r0, 0x29, 0xd2, &(0x7f0000000040)={{0xa, 0x4e22, 0x200, @remote, 0x80}, {0xa, 0x4e22, 0x0, @ipv4={[], [], @broadcast}, 0x5}, 0x4, [0x101, 0x2, 0x5, 0x9, 0x10001, 0x6, 0x100000000, 0x1f]}, 0x5c) sendfile(r0, r0, &(0x7f0000000000)=0x74000000, 0x4) 14:35:52 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10630840, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 2759.749290] binder: BINDER_SET_CONTEXT_MGR already set [ 2759.750924] binder: 4514:4522 ioctl c0306201 20000000 returned -22 14:35:52 executing program 2: syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/net\x00') r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/net/ipv4/vs/sync_ports\x00', 0x2, 0x0) ioctl$VIDIOC_ENUMSTD(r0, 0xc0485619, &(0x7f0000000080)={0xffff, 0x3200e0, "aa6e4eea2c9351e0d7d749b648a366b69a9285b1db411df6", {0x400, 0x101}, 0x4}) syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/net\x00') 14:35:52 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='mounts\x00Q\xb5\xef2K\\H\xa4M\xc1_\xb2&\xb5\xd0\x88j\xb0\x9b\xb7kK\xa6\xd7\x9e\n\xd6\x91v\xf08\xbb\xd0\xe0Mln') getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f0000000040)={0x0, 0x1, 0x1}, &(0x7f0000000080)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f00000000c0)={r1, @in={{0x2, 0x4e21, @empty}}, 0x0, 0x200, 0x8, 0x381, 0x80}, 0x98) sendfile(r0, r0, &(0x7f0000000180)=0x74000000, 0x5) [ 2759.828829] binder: 4514:4515 ioctl 40046207 0 returned -16 [ 2759.865334] binder_alloc: 4514: binder_alloc_buf, no vma 14:35:52 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xf0\x00'}}}}, 0x68}}, 0x0) 14:35:52 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400000000000000, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 2759.911107] binder: release 4514:4522 transaction 9002 out, still active [ 2759.936199] binder: undelivered TRANSACTION_COMPLETE [ 2759.941715] binder: send failed reply for transaction 9002, target dead 14:35:52 executing program 0: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dsp\x00', 0x101000, 0x0) write$P9_RFLUSH(r1, &(0x7f00000000c0)={0x7, 0x6d, 0x1}, 0x7) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0xfffffffffffffe67, 0x0, &(0x7f0000000400)=ANY=[@ANYRESOCT=r1, @ANYRES16=0x0, @ANYRES64=r1, @ANYRESHEX=r1, @ANYRESDEC=r1, @ANYRES16=r1, @ANYRESDEC=r0, @ANYPTR=&(0x7f00000002c0)=ANY=[@ANYRES32=r1, @ANYRESDEC=r1, @ANYRES64=r1, @ANYRES16=r1, @ANYRES16=r0, @ANYRES32=r1, @ANYPTR64], @ANYRES64=r1, @ANYRESDEC=r0], 0xfffffffffffffff6, 0x0, 0x0}) 14:35:52 executing program 2: syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/net\x00') sysfs$2(0x2, 0x0, &(0x7f0000000100)=""/228) r0 = getpgrp(0xffffffffffffffff) syz_open_procfs$namespace(r0, &(0x7f0000000000)='ns/net\x00') 14:35:52 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='mounts\x00') ioctl$TIOCGPGRP(r0, 0x540f, &(0x7f0000000000)=0x0) r2 = getuid() ioctl$DRM_IOCTL_GET_CLIENT(r0, 0xc0286405, &(0x7f0000000040)={0x100000001, 0x2, r1, 0x0, r2, 0x0, 0xffff, 0x4}) quotactl(0x8001, &(0x7f0000000080)='./file0\x00', r2, &(0x7f00000000c0)="cb1efdc38c8b3e0b9c1316eaa0cacc08f2dd7658b303a3537d3435702db8d364f51ee049537ddaa029951caeaae45d945959a41f0497e6155dc3d0aaa46df6ddcfd45dcb94503dc66d5187d8a6e6811eb259bfef26064716bf472691f083d1f9ee0f5e72dd6f32609a8e04150e79188252099a234afa8fd4acd54030c5d73b659e54279ca883676c") socket$nl_netfilter(0x10, 0x3, 0xc) sendfile(r0, r0, &(0x7f0000000180)=0x74000000, 0x405) [ 2760.003072] binder: 4559:4560 BC_ACQUIRE_DONE u0000000000000000 no match [ 2760.064497] binder: 4559:4560 unknown command 0 14:35:53 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00'}}}}, 0x68}}, 0x0) 14:35:53 executing program 4: r0 = syz_open_dev$sndseq(&(0x7f0000000080)='/dev/snd/seq\x00', 0x0, 0x4) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r0, 0xc058534b, &(0x7f0000000000)) 14:35:53 executing program 2: syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/net\x00') syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/net\x00') r0 = syz_open_dev$admmidi(&(0x7f0000000040)='/dev/admmidi#\x00', 0x3, 0x40040) write$P9_RSTAT(r0, &(0x7f0000000100)={0x59, 0x7d, 0x2, {0x0, 0x52, 0x9, 0x6, {0x0, 0x1, 0x5}, 0x100000, 0xa3bc, 0x2, 0x7, 0x7, 'ns/net\x00', 0x0, '', 0x1, '&', 0x17, '&^}selftrusted@vboxnet0'}}, 0x59) [ 2760.094941] binder: 4559:4560 ioctl c0306201 20000600 returned -22 [ 2760.130368] binder: 4559:4560 BC_ACQUIRE_DONE u0000000000000000 no match [ 2760.185037] binder: 4559:4560 unknown command 0 [ 2760.189885] binder: 4559:4560 ioctl c0306201 20000600 returned -22 14:35:53 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') sendfile(r0, r0, &(0x7f0000000180)=0x74000000, 0x5) 14:35:53 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="100000"], 0x0, 0x0, 0x0}) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/dev_snmp6\x00') ioctl$TUNSETNOCSUM(r2, 0x400454c8, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:35:53 executing program 2: getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f0000000080)={0x0}, &(0x7f0000000100)=0xc) syz_open_procfs$namespace(r0, &(0x7f0000000040)='ns/net\x00') syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/net\x00') [ 2760.338573] binder: 4588:4589 unknown command 16 14:35:53 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5000000, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:35:53 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='mounts\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) request_key(&(0x7f0000000040)='ceph\x00', &(0x7f00000001c0)={'syz'}, 0x0, 0xfffffffffffffffc) sendfile(r0, r1, &(0x7f0000000180)=0x74000000, 0x1) [ 2760.363907] binder: 4588:4589 ioctl c0306201 20000000 returned -22 [ 2760.394437] binder: send failed reply for transaction 9005 to 4588:4589 [ 2760.405857] binder: 4588:4589 unknown command 16 14:35:53 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x04\x00'}}}}, 0x68}}, 0x0) [ 2760.467891] binder: 4595:4596 BC_ACQUIRE_DONE u0000000000000000 no match [ 2760.497292] binder: 4588:4589 ioctl c0306201 20000000 returned -22 [ 2760.528873] binder: 4595:4596 unknown command 0 14:35:53 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xfc\x00'}}}}, 0x68}}, 0x0) 14:35:53 executing program 2: syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/net\x00') pipe(&(0x7f0000000040)={0xffffffffffffffff}) setsockopt$IPT_SO_SET_ADD_COUNTERS(r0, 0x0, 0x41, &(0x7f0000000100)={'nat\x00', 0x4, [{}, {}, {}, {}]}, 0x68) syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/net\x00') 14:35:53 executing program 4: r0 = syz_open_dev$sndseq(&(0x7f0000042000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = dup3(r0, r0, 0x80000) setsockopt$inet_MCAST_MSFILTER(r1, 0x0, 0x30, &(0x7f0000000080)=ANY=[@ANYBLOB="000400000000000002004e2300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000200000002004e21ac14141b0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002004e207f000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x190) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r0, 0xc058534b, &(0x7f0000000000)) [ 2760.533721] binder: 4595:4596 ioctl c0306201 20000600 returned -22 14:35:53 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r2 = fcntl$getown(r0, 0x9) sched_getattr(r2, &(0x7f0000000040), 0x30, 0x0) r3 = syz_open_dev$vcsn(&(0x7f0000000080)='/dev/vcs#\x00', 0x9, 0x2) ioctl$NBD_CLEAR_SOCK(r3, 0xab04) ioctl$DRM_IOCTL_IRQ_BUSID(r3, 0xc0106403, &(0x7f0000000100)={0xd53, 0x9, 0x80000001, 0x3}) ioctl$EXT4_IOC_PRECACHE_EXTENTS(r3, 0x6612) write$P9_RLERRORu(r3, &(0x7f0000000140)={0xe, 0x7, 0x2, {{0x1, '\xe1'}, 0x7}}, 0xe) 14:35:53 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='mounts\x00') sendfile(r0, r0, &(0x7f0000000180)=0x74000000, 0x5) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f0000000000)=ANY=[@ANYRES32=0x0, @ANYRES32=r0, @ANYRES64=r0, @ANYRES32=r0, @ANYBLOB="00000000010000000000000000000000000000000000000000000000", @ANYRES32=r0, @ANYBLOB="00000000040000000000000000000000000000000000000000000000", @ANYRES32=r0, @ANYPTR, @ANYRES32=r0, @ANYBLOB="00000000020000000000000000000000000000000000000000000000"]) [ 2760.635363] binder: undelivered TRANSACTION_COMPLETE 14:35:53 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40106308, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:35:53 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0f\x00'}}}}, 0x68}}, 0x0) 14:35:53 executing program 2: r0 = syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/net\x00') r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/pfkey\x00', 0x0, 0x0) r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x40000, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r1, 0x89e0, &(0x7f0000000100)={r0, r2}) syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/net\x00') [ 2760.748302] binder: 4616:4617 got new transaction with bad transaction stack, transaction 9009 has target 4616:0 [ 2760.760366] binder: 4618:4619 BC_ACQUIRE_DONE u0000000000000000 no match [ 2760.806449] binder: 4618:4619 unknown command 0 [ 2760.809995] binder_alloc: binder_alloc_mmap_handler: 4616 20001000-20004000 already mapped failed -16 [ 2760.812170] binder: 4618:4619 ioctl c0306201 20000600 returned -22 14:35:53 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0e\x00'}}}}, 0x68}}, 0x0) 14:35:53 executing program 3: r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ppp\x00', 0x200, 0x0) ioctl$NBD_DISCONNECT(r0, 0xab08) r1 = syz_open_procfs(0x0, &(0x7f00000001c0)='mounts\x00') sendfile(r1, r1, &(0x7f0000000180)=0x74000000, 0x5) getsockopt$inet_sctp6_SCTP_NODELAY(r1, 0x84, 0x3, &(0x7f0000000000), &(0x7f0000000080)=0x4) [ 2760.862783] binder: BINDER_SET_CONTEXT_MGR already set [ 2760.874228] binder: 4618:4619 BC_ACQUIRE_DONE u0000000000000000 no match [ 2760.893994] binder: 4616:4617 ioctl 40046207 0 returned -16 14:35:53 executing program 2: syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/net\x00') syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/pid\x00') [ 2760.931288] binder: 4618:4619 unknown command 0 [ 2760.938917] binder_alloc: 4616: binder_alloc_buf, no vma [ 2760.951924] binder: 4618:4619 ioctl c0306201 20000600 returned -22 [ 2760.972739] binder_alloc: 4616: binder_alloc_buf, no vma 14:35:53 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00'}}}}, 0x68}}, 0x0) 14:35:54 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='mounts\x00') sendfile(r0, r0, &(0x7f0000000000)=0x74000000, 0x8) close(r0) [ 2761.034012] binder: send failed reply for transaction 9009 to 4616:4617 [ 2761.041671] binder: undelivered TRANSACTION_COMPLETE 14:35:54 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1063084000000000, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:35:54 executing program 4: syz_open_dev$sndseq(&(0x7f0000042000)='/dev/snd/seq\x00', 0x0, 0x0) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dlm-control\x00', 0x4101, 0x0) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000100)={r0, &(0x7f00000000c0)}, 0x10) flistxattr(r0, &(0x7f0000000140)=""/101, 0x65) ioctl$KDSETLED(r0, 0x4b32, 0x9) 14:35:54 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x200000020011, r0, 0x0) r2 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vfio/vfio\x00', 0x0, 0x0) ioctl$KVM_GET_DEVICE_ATTR(r2, 0x4018aee2, &(0x7f0000000140)={0x0, 0x6, 0x6, &(0x7f0000000100)=0xfffffffffffff38e}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) syz_open_dev$adsp(&(0x7f0000000040)='/dev/adsp#\x00', 0xffffffffffffffff, 0x440000) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:35:54 executing program 2: syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/net\x00') syz_open_dev$usbmon(&(0x7f0000000040)='/dev/usbmon#\x00', 0x0, 0x200) syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/net\x00') [ 2761.169121] binder: 4652:4653 BC_ACQUIRE_DONE u0000000000000000 no match 14:35:54 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xea\x00'}}}}, 0x68}}, 0x0) [ 2761.230699] binder_alloc: 4660: binder_alloc_buf, no vma [ 2761.237726] binder: 4652:4653 unknown command 0 [ 2761.246176] binder: 4652:4653 ioctl c0306201 20000600 returned -22 14:35:54 executing program 3: ioctl$sock_SIOCGPGRP(0xffffffffffffff9c, 0x8904, &(0x7f0000000000)) r0 = fcntl$getown(0xffffffffffffff9c, 0x9) r1 = syz_open_procfs(r0, &(0x7f0000000040)='mounts\x00\xe03\a\xf5\xd2]\xbf\x94\'r\x06\x9a\xe6\x94ZW\xd2\xef\x1b\xcf\x8aLP=\xde\xfd\xc4\aQ\x97\xd7[\xca\xa5\xec\xc8\"\xe6S\x05\xc3i\x82T\xf5\xa66\x8df\xf2F2\x9c0\x952$=3\xb2\xc5\'\xa8\xaaf\x00\x80\x00\x00\x00\x00\x00\x00AB\x8d\x1a\x8e9\xe6\xba\xdeO\xb3\xa9\xa0\xe2\xe8\x8bN\x90\x05$\xff\xab/PA\xd2l\x04\xcd\xa0!\xa0(\x03\xefo$\xed\xff_D\x99\xc7V\xff\x00\x00') sendfile(r1, r1, &(0x7f0000000100)=0x74000000, 0x6) 14:35:54 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) fcntl$getflags(r0, 0x1) syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/net\x00') socket$unix(0x1, 0x3, 0x0) syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/net\x00') [ 2761.312340] binder: BINDER_SET_CONTEXT_MGR already set [ 2761.331153] binder: 4660:4661 ioctl 40046207 0 returned -16 14:35:54 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0e\x00'}}}}, 0x68}}, 0x0) 14:35:54 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4c00000000000000, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:35:54 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='mounts\x00') sendfile(r0, r0, &(0x7f0000000080), 0x25) [ 2761.380321] binder_alloc: 4660: binder_alloc_buf, no vma [ 2761.405469] binder_alloc: 4660: binder_alloc_buf, no vma 14:35:54 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 2761.491793] binder: 4677:4681 BC_ACQUIRE_DONE u0000000000000000 no match [ 2761.521581] binder: 4677:4681 unknown command 0 14:35:54 executing program 2: r0 = syz_open_dev$vbi(&(0x7f0000000040)='/dev/vbi#\x00', 0x3, 0x2) r1 = syz_open_dev$vbi(&(0x7f0000000080)='/dev/vbi#\x00', 0x1, 0x2) ioctl$SCSI_IOCTL_TEST_UNIT_READY(r1, 0x2) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r1, &(0x7f0000000100)={0x4}) syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/net\x00') socket$rds(0x15, 0x5, 0x0) syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/net\x00') 14:35:54 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00'}}}}, 0x68}}, 0x0) [ 2761.552576] binder: 4677:4681 ioctl c0306201 20000600 returned -22 [ 2761.645774] binder: 4686:4687 got new transaction with bad transaction stack, transaction 9018 has target 4686:0 [ 2761.690699] binder_transaction: 13 callbacks suppressed [ 2761.690717] binder: 4686:4687 transaction failed 29201/-71, size 0-0 line 2946 [ 2761.742578] binder_alloc: binder_alloc_mmap_handler: 4686 20001000-20004000 already mapped failed -16 [ 2761.770161] binder: BINDER_SET_CONTEXT_MGR already set [ 2761.785704] binder: 4686:4687 ioctl 40046207 0 returned -16 [ 2761.811255] binder_alloc: 4686: binder_alloc_buf, no vma [ 2761.817945] binder: release 4686:4687 transaction 9018 out, still active [ 2761.826460] binder: undelivered TRANSACTION_COMPLETE [ 2761.832010] binder: 4686:4695 transaction failed 29189/-3, size 0-0 line 3035 [ 2761.839767] binder_alloc: 4686: binder_alloc_buf, no vma [ 2761.844499] binder: send failed reply for transaction 9018, target dead 14:35:54 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='mounts\x00') sendfile(r0, r0, &(0x7f0000000180), 0x5) getsockopt$EBT_SO_GET_INIT_ENTRIES(r0, 0x0, 0x83, &(0x7f0000000500)={'nat\x00', 0x0, 0x4, 0xe4, [], 0x8, &(0x7f0000000380)=[{}, {}, {}, {}, {}, {}, {}, {}], &(0x7f0000000400)=""/228}, &(0x7f0000000580)=0x78) getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF(r0, 0x84, 0x66, &(0x7f0000000140)={0x0, 0xfff}, &(0x7f00000002c0)=0x8) getsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r0, 0x84, 0x76, &(0x7f0000000300)={r1, 0x10000}, &(0x7f0000000340)=0x8) getsockopt$inet_sctp_SCTP_GET_PEER_ADDRS(r0, 0x84, 0x6c, &(0x7f0000000000)={0x0, 0x92, "059a6d8ab903ca3c30f785d821f777650f293ff0cf0e4720ded9727d9fb1d76f5fa67ae24d6fbf94b2f6698e5bd36323acae971c2990454b738cb90ab3b886e1a30845484939dcd41a13cf2645a2d36f4915b7e96f28395e0d0a54a1e6a8db43f87c1b5af89b8e5a04d7cc003a17376c7127c4a9ad494e75eb4cceee134f92d4ff7cc1a178826c368588bbe129f0d23a50ef"}, &(0x7f00000000c0)=0x9a) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f0000000200)={r2, @in6={{0xa, 0x4e23, 0x80, @empty, 0x80}}, 0x3f, 0x100000000, 0x8, 0x7fffffff, 0x10001}, &(0x7f0000000100)=0x98) fcntl$setsig(r0, 0xa, 0x25) setsockopt$inet_sctp6_SCTP_CONTEXT(r0, 0x84, 0x11, &(0x7f0000000600)={r2, 0x8}, 0x8) ioperm(0x200, 0x0, 0x8000) 14:35:54 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40106309, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:35:54 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00'}}}}, 0x68}}, 0x0) 14:35:54 executing program 2: syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/net\x00') syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/net\x00') r0 = syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x1, 0x45aa00) lstat(&(0x7f0000000080)='./file0\x00', &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$TUNSETGROUP(r0, 0x400454ce, r1) write$P9_RSYMLINK(r0, &(0x7f0000000180)={0x14, 0x11, 0x2, {0x40, 0x4, 0x2}}, 0x14) sendmsg$key(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000001c0)={0x2, 0x6, 0x7fff, 0x2, 0xb, 0x0, 0x70bd25, 0x25dfdbfb, [@sadb_x_policy={0x8, 0x12, 0x3, 0x6, 0x0, 0x6e6bb8, 0xda, {0x6, 0x7f, 0x6, 0x0, 0x0, 0xec, 0x0, @in=@multicast2, @in=@local}}, @sadb_x_nat_t_port={0x1, 0x15, 0x4e22}]}, 0x58}}, 0x20000000) [ 2761.856269] binder: 4686:4699 transaction failed 29189/-3, size 0-0 line 3035 14:35:54 executing program 4: r0 = syz_open_dev$sndseq(&(0x7f0000042000)='/dev/snd/seq\x00', 0x0, 0x8000000000000000) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r0, 0xc058534b, &(0x7f0000000000)) [ 2761.898324] binder: 4701:4703 unknown command 0 [ 2761.903177] binder: 4701:4703 ioctl c0306201 20000600 returned -22 14:35:54 executing program 2: r0 = syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/net\x00') ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000080)) fcntl$getownex(r0, 0x10, &(0x7f0000000100)) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000200)) fcntl$getown(r0, 0x9) getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f0000000300), &(0x7f0000000340)=0xc) ioctl$sock_SIOCGPGRP(0xffffffffffffff9c, 0x8904, &(0x7f0000000380)=0x0) syz_open_procfs$namespace(r1, &(0x7f00000002c0)='ns/cgroup\x00') [ 2761.945222] binder_release_work: 19 callbacks suppressed [ 2761.945229] binder: undelivered TRANSACTION_ERROR: 29189 [ 2761.979403] binder: undelivered TRANSACTION_ERROR: 29189 14:35:54 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\n\x00'}}}}, 0x68}}, 0x0) 14:35:54 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1163484000000000, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:35:55 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000040)='/dev/media#\x00', 0x2, 0x2200) ioctl$VHOST_SET_LOG_FD(r0, 0x4004af07, &(0x7f0000000080)) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0x0, 0x2) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="b8f2cd2a"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:35:55 executing program 3: r0 = openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x10000, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f0000000080)={{{@in6, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@loopback}, 0x0, @in6=@local}}, &(0x7f0000000200)=0xe8) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f0000000240)=r1) ioctl$KVM_SET_VCPU_EVENTS(r0, 0x4040aea0, &(0x7f0000000040)={0x5, 0x7, 0x8, 0x0, 0x1, 0x0, 0x1f, 0x36940f88, 0x20, 0x401, 0x8, 0x8, 0x0, 0x9, 0x1, 0x100, 0x200, 0x100000001, 0x3}) r2 = syz_open_procfs(0x0, &(0x7f00000001c0)='mounts\x00') sendfile(r2, r2, &(0x7f0000000180)=0x20000074000000, 0x400) 14:35:55 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00'}}}}, 0x68}}, 0x0) [ 2762.139253] binder: 4721:4725 unknown command 0 14:35:55 executing program 2: r0 = syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/net\x00') r1 = syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/net\x00') r2 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000280)='/dev/sequencer\x00', 0x101000, 0x0) ioctl$SIOCGSTAMP(r2, 0x8906, &(0x7f0000000240)) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffff9c, 0x0, 0x7, &(0x7f0000000080)='ns/net\x00', 0xffffffffffffffff}, 0x30) fcntl$lock(r0, 0x25, &(0x7f0000000140)={0x2, 0x4, 0x9, 0x400, r3}) r4 = getpgrp(0x0) r5 = dup2(r1, r0) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000001c0)={r5, 0x1, 0x1, 0x5, &(0x7f0000000180)=[0x0, 0x0, 0x0, 0x0], 0x4}, 0x20) syz_open_procfs$namespace(r4, &(0x7f0000000040)='ns/pid_for_children\x00') ioctl$VIDIOC_TRY_DECODER_CMD(r2, 0xc0485661, &(0x7f00000002c0)={0x3, 0x2, @start={0x4}}) ioctl$EVIOCSABS2F(r2, 0x401845ef, &(0x7f0000000200)={0x800, 0x1, 0x0, 0x4, 0x8, 0x7}) 14:35:55 executing program 3: r0 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x563100, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000001c0)='mounts\x00') ioctl$KVM_GET_PIT(r0, 0xc048ae65, &(0x7f0000000100)) sendfile(r1, r1, &(0x7f0000000040)=0x74000000, 0x5) 14:35:55 executing program 4: r0 = syz_open_dev$sndseq(&(0x7f0000042000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r0, 0xc058534b, &(0x7f0000000000)) ioctl$EXT4_IOC_MIGRATE(r0, 0x6609) [ 2762.204402] binder: 4721:4725 ioctl c0306201 20000600 returned -22 [ 2762.212014] binder: 4727:4728 unknown command 718140088 [ 2762.224409] binder: 4727:4728 ioctl c0306201 20000000 returned -22 14:35:55 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6000000000000000, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:35:55 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00`\x00'}}}}, 0x68}}, 0x0) [ 2762.279607] binder_alloc: binder_alloc_mmap_handler: 4727 20001000-20004000 already mapped failed -16 [ 2762.347868] binder: 4727:4728 unknown command 718140088 14:35:55 executing program 3: r0 = getpgrp(0x0) r1 = syz_open_procfs(r0, &(0x7f00000001c0)='mounts\x00') sendfile(r1, r1, &(0x7f0000000180)=0x74000000, 0x5) 14:35:55 executing program 2: r0 = fcntl$getown(0xffffffffffffff9c, 0x9) getpgid(r0) getpid() r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cachefiles\x00', 0x1, 0x0) ioctl$VIDIOC_ENUM_FRAMEINTERVALS(r1, 0xc034564b, &(0x7f00000000c0)={0x9, 0x32435750, 0x10000, 0x0, 0x3, @discrete={0x4, 0x9}}) r2 = gettid() syz_open_procfs$namespace(r2, &(0x7f0000000040)='\x00\x00\x00\x00\x00\x00\x03') syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/net\x00') [ 2762.390928] binder: 4727:4728 ioctl c0306201 20000000 returned -22 [ 2762.405148] binder: 4746:4748 unknown command 0 [ 2762.409917] binder: 4746:4748 ioctl c0306201 20000600 returned -22 [ 2762.414936] binder: release 4727:4728 transaction 9023 out, still active [ 2762.424691] binder: undelivered TRANSACTION_COMPLETE 14:35:55 executing program 4: r0 = syz_open_dev$sndseq(&(0x7f0000042000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r0, 0xc058534b, &(0x7f0000000000)) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000080)='/dev/snapshot\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000100)=0x4) [ 2762.474247] binder: send failed reply for transaction 9023, target dead 14:35:55 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x74000000, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:35:55 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x0) r2 = syz_open_dev$vcsn(&(0x7f0000000040)='/dev/vcs#\x00', 0x8001, 0x800) ioctl$LOOP_SET_FD(r2, 0x4c00, r1) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x110, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000040)=ANY=[], 0x0, 0x0, 0x0}) 14:35:55 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000200)='mounts\x00') getsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r0, 0x84, 0xa, &(0x7f0000000000)={0x376, 0x4, 0x20c, 0xffffffff7fffffff, 0x100000001, 0x3, 0x1, 0x3ff, 0x0}, &(0x7f0000000040)=0x20) getsockopt$inet_sctp_SCTP_MAXSEG(r0, 0x84, 0xd, &(0x7f00000000c0)=@assoc_value={r1, 0x17e9}, &(0x7f0000000100)=0x8) sendfile(r0, r0, &(0x7f0000000180)=0x74000000, 0x5) pipe(&(0x7f0000000080)) 14:35:55 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0f\x00'}}}}, 0x68}}, 0x0) [ 2762.577628] binder: 4762:4763 unknown command 0 [ 2762.582417] binder: 4762:4763 ioctl c0306201 20000600 returned -22 [ 2762.616471] binder: 4764:4765 transaction failed 29189/-3, size 0-0 line 3035 14:35:55 executing program 2: bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x7, &(0x7f00000000c0)='ns/net\x00', 0xffffffffffffffff}, 0x30) r1 = syz_open_procfs$namespace(r0, &(0x7f0000000080)='n@/neE\x85') r2 = socket$can_bcm(0x1d, 0x2, 0x2) write$FUSE_NOTIFY_RETRIEVE(r1, &(0x7f0000000140)={0x30, 0x5, 0x0, {0x0, 0x1, 0x5, 0x5}}, 0x30) ioctl$sock_FIOGETOWN(r2, 0x8903, &(0x7f0000000180)) syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/net\x00') 14:35:55 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a000000, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:35:55 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00'}}}}, 0x68}}, 0x0) 14:35:55 executing program 4: r0 = syz_open_dev$sndseq(&(0x7f0000042000)='/dev/snd/seq\x00', 0x0, 0x0) preadv(r0, &(0x7f0000000140)=[{&(0x7f0000000080)=""/172, 0xac}, {0x0}], 0x2, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r0, 0xc058534b, &(0x7f0000000000)) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r0, 0xc08c5332, &(0x7f0000000180)={0x8, 0x7, 0xffff, 'queue0\x00', 0x7}) [ 2762.732582] binder: BINDER_SET_CONTEXT_MGR already set [ 2762.762626] binder: 4778:4779 unknown command 0 [ 2762.764190] binder: 4764:4765 ioctl 40046207 0 returned -16 [ 2762.767632] binder: 4764:4772 transaction failed 29189/-3, size 0-0 line 3035 14:35:55 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000200)='mounts\x00') setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f0000000100)={&(0x7f0000000000)=""/210, 0x22000, 0x800, 0x1cd}, 0x18) sendfile(r0, r0, &(0x7f0000000180)=0x74000000, 0x5) [ 2762.803095] binder: undelivered TRANSACTION_ERROR: 29189 [ 2762.839141] binder: 4778:4779 ioctl c0306201 20000600 returned -22 14:35:55 executing program 2: ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000001bc0)) r0 = syz_open_dev$sndpcmp(&(0x7f0000001b40)='/dev/snd/pcmC#D#p\x00', 0x800, 0x400) ioctl$TIOCGPGRP(r0, 0x540f, &(0x7f0000001c00)=0x0) r2 = syz_open_procfs$namespace(r1, &(0x7f0000001c40)='fs\x17ngt\x00') accept4$inet(r0, &(0x7f0000001e00)={0x2, 0x0, @dev}, &(0x7f0000001e40)=0x10, 0x800) r3 = socket$inet_smc(0x2b, 0x1, 0x0) sendmsg(r3, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000000640)=[{&(0x7f0000000140)="01b613e45672f94eb2c78ea065c0be51f95d54b6d40e3c4620c41b1d074d26d1a1bfc637707aec89de09ea2a1dd811b6c5b6c8", 0x33}, {&(0x7f0000000180)="3ba017fd4ea29649a59d058be06b71cbb6d21e9f7ec80e85cccf4bf87e625eed4ce1a4599439df0e8f03411d4a7b9e8a887ace65f5d1c1858c4a82df08a3f209ff65d07bfbadaecb3a8b1779cb216eb517effc6e3dc40b18aad5344c1d6a44e6b0b849e9ed558d2cb7b50a3b342bf89c2abdc4cabfa768cffa7902f33a4d727b6998847189c9cb60199becd36bfd48849337c418dfdde00c1841fd4e241de9e5135b5bb1981bb313f8425b116312c1c0955057f5050d2548fdb382485f593b275e99baf068e5a92e2a8fc183e3374a763a345b49ba6f750cec10fdf01424ad821d28b6bfbd10b991ab75f3cbbca9230f00f33fe3c613", 0xf6}, {&(0x7f0000000280)="136560e717433703bd71735a84855011b01ace", 0x13}, {&(0x7f00000002c0)="28a4ffb3a022a792713a5085d58db9cdf0c2433d0fdc798335b30fc8eb9f6f030999a1f4f06dee3e736e8a578f2798ca2766c3b454582b38a5f42c196bea", 0x3e}, {&(0x7f0000000300)="3cc544b00bb3d94df820ab86968bf918a4c785d9846df11c8dae0ab6ddd0398ba54f34b79e4a6e4b7034fa0815f3be6757cc9ca81d28af85507ef8236ebb3f5ab0a9a7c82ddd443455668f5cb121d68d80711bbfab3002c16b9fb56d11d721bbca1747ac974fef4c5c5c53c423d9bfb4e9ea265594881757edf0ab81ecc9af23c0598c85cc02a278d8c88b0f760dbb587bf8bcfbb84f26e0634c494437ee856be9e87139073221eab65dc93e4a29927c73a80beb13244c8322ada8b1b6e60098c0b806ec8fbbb403d9cc71a5da1c61aa418f49c334e98443a4", 0xd9}, {&(0x7f0000000400)="bae42bc63f750acbaf41394186ad6c1ca2737d4050b9650f0e743c644510491ec69713b6b145cc9e7f76034a5bbae2e206c4cc947954c39252a1fc7eeafeac8bf20757b0ebc26704a193f3beecd8a689183cbe856c4aa8c9f07e59fe4eb2524484b37d47e126329279deae3ccfd25e00c661c43fbf8024a276dca97ebf6de05b7e20d6ee7c7cdf5883b748ac969fecd2d756bed174140035", 0x98}, {&(0x7f00000004c0)="a702669887f01b75e971aeb5e5fdfd5712d0f0e4e6cf5f4419bb45ca154f9763bc13c49bf70cbf924f903f119bd9985b3f22609b6d6220d499c745990a55bb451a2c116f2d510cea27ccca9d10f8396d4936a5f5080bf10d5f317ba96fd139eadf939b4f54dc25929cde9cd90332aaf57054a22d1abd686649eff6", 0x7b}, {&(0x7f0000000540)="69d2e5b67a7829c5c5827d348f9c2b23a4184f78ab70303609ce177422b9262304c615fa7689779444ed71942cf4e53ae51337cf70d33a44bff819f428d2437d25c8a6cdb4c445f81c465726613b15b82ef2c788a64179dd4edbe30a957a8bbdb284a368e93d49d61f3b010403302f564f29a29f6af476e678397bb6025564c674d3d55ba155caa310e16321a9cb9f80706fecdcfc6fad7aae82cdb50e57d20eac82a891c91353a10eb9f5c2630df7f393ccb923a3214d18e34c12c0acfebdccdb59c6ded7ceac4584db9eb10ff230594407a17680d6920610c0d412", 0xdc}], 0x8, &(0x7f00000006c0)=ANY=[@ANYBLOB="e8000000000000001100000007000000bb15ceb8bd01757274b1c2a71faac562987e0e959b989153598b59bd9de6640943d35031612f3cfbfd54884380b9c2535741f5263f7bb05070273afc215d261736a18fcf7b0e48e2d8089fe16c1b6393f6ef2e01def029cfbe28b873d6098d1e7086378ffff48285b7664f5339d066b9755d96118c71498af49338d8d2c40710f0058c28d633f901c1fde05d4bcb440da3b4b455c89683d152ce13a04bf6e67d3e28243d1d07f7f7b932bfae012a6e0661964eaec972bc1dd96ebe9e2e41f360f7f563f3e8a0d0b1bde9527befc9d9b4650000000000000018000000000000001f01000000000000fea06d0000000000e0000000000000001701000006000000aaa50203564fb2b145f455d5ec0a080e07c6ad7cf93182c7d81d30f123614b1fc8f64116d4d11382d3500dd531c5874316b784f4e70f4ea736722aaf98adba590b4984dddd9b95cb6c84f74017819ab2ad0ace3e7f0ec0c45074e9beb95ee0f22968182496d30b78eae082ccb79b3a30c0f8892693cecbdae223d4c52e7d5aa1f1c6f585b9762ec3c7d0eb589c1dc9cc63962c3bf39126adb894eda2440be34803fa11df077aaee1fc56fec7d6f756e6c26089fa1449e049aed168e4899d8374863aa675581d4d1060841c000000000010000000000000008400000008000000780000000000000000000000ff000000e0a81e423cdb00f86d735e833560513bb938a0f9ef66527ca6165cd2fc3fb1f61a79e518a66a88cce403caf748eae492bc954db6e46777f97d51c565c5c1c80678bc82743049af40d99ae7c9b299b42b5e726904fb0b9734217ac7e3d98f5468a8902f9a0000000098000000000000000901000007000000767784880550ce607b8eab87fcc6c9ffe28e017044b41b8f129101e0f7e9847a19f44007d4fb242ef24f900dee5c54348f5ebae5f6239007342869646c357c5f1eeb1a4005fa0ac9d5ebd85dffc3ce40e1df9d838fb6ed6e3119d0a15e080415dc402d416f1a31b36fd7f5bd2adf2e0667b764724a555678291527d1737d8f919cfd7400000000001010000000000000020100000900000092e53b8210b33944d90099e8e3ca4921336a1e7e4879c929e7b80f48c804d62c67751f8016be9d06fd4644aea4bc1a132ae8aea00fdffdec01f72341cba8a6d3dbfb842a0799e5bd2b9caf4d3315416b396f9ed48360f6476b1d7a6a933d97e0aa4ba5b30514a4f53827ce5274817e3aa44d64f565b5576748fd1e6d9a9448bfcfd817d774dd422e2e085324b02e40f07c519bb509eb9d0936f13114c19459dafd27daa7dc651308fd1611f8ff06d1645dfb3286f916a1d19c7b17781782cf9fd696e5150cd944258a8ad8e7656ab644e1f703e6c17b924b8d5ef46c7df2dd211547c7be74bd3357aa873ec7867b50e09dadabe5a2a1e8256ad37ce946f4f009f44742be0ef69e6553f72964a3dbaae4137e3ed8a0d9809cda063c8c7a0a7802b6210c628a2cc1cc23f99817c277e6d382653cf6786ca55f66864158f78505c9e492cc383e93538327a76d7b5e18b90658f7bce42a7b0c2de0b6e9680ae3ff2195247f3fcbe8409e66ae59556a8cab0b3f2e81060540cddd95321735a5f1289597774aa3a65bd0d04c61a489f667784b8ac62002bb0699d87ce5edba9ba9ab91b6e1165d7d10635a8bab217bc3016ef3c2c7da745c07c4867102121d9034274c2b41d5c1da62bf3200374c1d20d2cf33a2241a5c8d91614a7658ea547510f2b20aaaf6e675c2ebd600a8ed06fe7ed2d50a9ac1e0b3b4c40852ceb6311617883e3df2e13b445d87df48fbdbb012af585c3f71a661aa2937a4605dc1ff4f7b39aaa7e1be1fb83e5c0f53c8756ea64babd60abb36e9a3b76d30e655ac07eeb83511b2b16ca3addcdfefb5bdfe6a6e1f56784674236936b2205528d2d41a627a5a4bec937acc9864bfe62e799fcd335405328bb4a3c8b99411285775f6225941b912805fae97c4a246cb23dae0bbf1c005527d45185a83a448d1c770a26f329c3a53470ff0289ba1c3c4752b3220d0dc14e50054b59abd7457cf770516b5b85be2193e677adf8800fcfdad4055869e0e6fcc9990363a7731ca08301fa4e7b268929e0cbafb8e39d0bf9053c97d9a82b5016e04a56000d212cb22c831bdae9b5759d0fce5429d46c6bcc11f64c7b637e87be63a6f78db51e62e235a5f74f233e14f2ef32586b33aef4fc22e3845276a06bf1aa1abc87f9a4a89ea6d4834f260846cc11dd279aba6d70e17b8251c33833e98d2be5e970f45960149c331a6455f5f294ac089323260d418744d523778f60d5f6dca2b6c1aa618019aec6a0619d7ab56bb5397172df47a603521f08cb99940143c78bd5527036a02ad516433d840f789eae5497e57edd727707934eb0088eca3924b03f31aa3a7cea37b5f943c04cffeaa0a80948183fe13be7dd15b804264672147bf6d7f1f56dd922fc476fa78c7a40643e333dd9648021669d4a99a4e2bb41d652dbcb794d2a93b75418418432e47b7501b03dd10366c57ceeaac81af0a4a1b98d6599ea50a4c2ec4318157eb5e35a7271031533e11182f5aa77d95c50215f2530d8114449c3ac51b198cba385cb9cac598923d42862089935a4e33713359775bdfb32c5f6adf61e56f56334a0b7dd5c5a099db6ccc7649459ee2b8f4b7bc69bb67ebdc5b987978d20f5187f32fb7074f884a24580327546262d8ac64838161778a80bbe561ab478acef87b71ce51c7ede5610303e259b86a50cfa1f79770cf5e08b3b4090e2d4f424e4f4e7be2379026c5d08c7f638dfc1c1a2cc7910901895ead484d1594266a3474f3b5c2fb76e880f65632226621016c108067ba7d19214c5c3db781df1aca870b44dc36897ffc2c5555575858961e67a86254f55813480c05b5c0526805e45de49f65dd9223898213b5e29fa107fa6e19b820665a2ace375e4aa985081a484fff8e2ffd57a122ac4f9cbae4042c8d8e98b30e7039cbbe70259964500da9e9bb5009ea8acb03555c9d7df9f31c2cfec5ac258e1cc6f1b8453e7cebc19befd0a9ba91159a44e6af8e421a25cbaa5aa8b01737bb8db34a59b21708e46fe1ed949c97553831d1449f33f0352692f479646ca7027bba09a10f2684f4a699052c1dea11952e0121e13159903b138921827ba179c6465bdb5002bb92df76a480fd7a6722340472e7c5552076db3dc876ca485bc12d8df5d737efa5d61d5a9c241373669fe9c05f4367fe6bcab32b8ea94f93ff730cccc8da1bca002070f9fe27fb117dfbe56623f3021dc8a08639be652683b5b864e2c944b46b49f093d5397c3337bee41330e70a616eb26b3ce1f1871f831df89add5bb275064f6806318c8d40a2cf13b1f73cb7f11bd97303aa9abd6477d368d1b9f5d5e69c2cb63c2204404bf02f470410ec516e19c87691bbfdd9cb4a77264f5618b0363abd0f565fc2056f75c13dd26f18477d10f245554a6b906b80efebcac76b8a48a07fe61d959172555ed3c3db4d8637de67b0c05f6172104f72bbccc98ae6bd8a9d98446d96ab0299548af301b97613e29f8a05b73779ccd460dc3fcf9988f4483cdfa132c09e73be5417533c9e5c469e25d406d9213df6dd7ec43541e157d013c6071e7ebd39bbf992e14fc188af006a418fd0acef5c8c24182caac27670257d61ca11ee9ccde5d05af8a86d27dd402c3562a022b53b5b7ea0483e4cceae002baecaf022bec00b52a68f61d4d166daaea15ca5bf5f8923aca74a3167a64f5000fd218f345512a0a1c15b73cdae4b195e69afe298dbc40c3aba0ae8676a6b1720a678131f16c317221a4906564daeb9d2e28959c93b64ee93fe0d754c42a8e305ee368ca9a557147926d1f8d655926fe0a43dfce011b2bd711b0bf951f71478f023a62cac21fd62e0f92c4de264cfcd6c18e0b26a394106ab4a6bc1ae8e6dc16d94b792e92719666171f73278006acc937c2d15c7c5b417d72afc19cef6a8fd55c5a9c9ad73276a13c78f5a64420239016c57423208debc369a0ca7951d63ff0225d46f46516f5a068b3a60af355d357a9dd8a54eb613982d2b1b253563fe152fd20b80fbbfda4fcee44031ffac1216ff97787e1bb167109e521a9c2d9dab82a5aec2cc9ebe86843429a22f978b9a526ec89da8c8f3bb3923567ac05597f3ff84a85943b7d158f743f99e1e194f75cd85d212b5f4119ee39b3f12e4e4b2ff23c0224b908a56c9a4916211be6d89fa99ffde6139364462bc8b4c8ea3b1cb2b780c0c5b7a1ee452fdaea0620f0a3d498392b89a38e7a9fac8ad58207ca4fa1405082a2836122c3fb17b6d883d30c6d6ebd15fda0cdd55b785e7515cc2f9e38bb26c13624baa58370a76abedd767552e86650685092a208377ddcf9459e44bff8cd799b1c4d9de0b7810c18d0d610c30459f8c2a8ca7bf1d44bbe3cb0afa3729a6725a3e0a66ed29d1ed457e58c491a99d3a04d9e4a238b5b7cd921a8112577c25dc07b5f73b556c60a280a1db24dd9d15c4357f6ebcfb4aaa9c61d465a507b017b338da8b4596d88c941cffe8e733d72034e6487cf9f32cd7988b38ebecc750a07b50c33473b51cf18a2ba0e7b54a8caec51cc70bef1479754cdb937965bdd9fa97206e958f49e5037ee6bf5c52fde48ae2bbeff356e2f08db7b889ca7a755569290accba4eabc01ce2f75f77c953b4e7e89183f172761bd3af89e3d480d9a9dbd907eb83b1346930acb94932188b536b57aa0f435d5d16a82581a43fcf7bcd1faa0b32312a27836470091c76beb3196ca5b74c1bfe1ae4b6c37c833c9ccfcd9dda561f14b3c0267fb5b215430a6404bd22a06f06cf1b0501fce95f4d4f6c8fff62e4cd8658c9a3c87f5dec7ec314907e923349e8001a12a3fbae2837f987dc9f3a98a4c5bf2c565136d7c2839a033d2bb58bde2942582e06b7b041344be54807f23f67433bd342fbbbd8bd3798fede4f38f4cedfe5dbc5bb43a4c7ce8460cd315d87e965c97598ae9fee0b2b04000f47c335c836894b82095af9a715f345fc69323bffa6c5afda348656d6a21aef42da3c3bbfc0cbed8e5c5cf5db4329c877750933210e483c1bac35c148505d7b73a8ba3b4122c813f1f57d3b5cfbfd44045f78b3252e27af5ac4498891ae7d19fe5fd845431ada25f030bc9086c171d3b92196cdee5f473dcc60234bbab40272ba9efdb463fc696a460ed012750e27951770d085eb1a5f06257badeac1c6a27df3f505e7edf8a6db40809713b7d1c9c3a1681844f823c60b92226589bb8a4329cd7c2c65254c85dd70113401e2bcbac3a9b086f39545166b2a1b4b360806c6f582820bcb24097cf08b108ed559cf8e1524bb56edeb0a35523b673ce480ecab21759167dcf6a5611420350f7353b033b517c2809ec10ecc61d7172559e18e48cb65314f7ab8f89af28673bfbe42c36a6a90be2b00703375e7de1987fcdd908eb5773c91d03e1122c2b26787c93aae0e37760ac928d1d16bad1770dc3c97aef8e2cee61b67a67b11173c127dd2530b24d283286aa4ff92c59b42d3281b074f1426baa1b31abf60d663117be907203b8eac4d93a6e9381431d39bf2c71a458e9a7a016f1be0c8487775af4bfd51299041709d9e0138181820293fb18ab38a7585e32f461f645ff73eabc1569fe8c5575910c7a7d24b7ad80cab5d26c34a45ec21bf80cc50f5fa65601c6d2605ab83587256f4e467d9527cd21fb80a6e7b531de41f93b7efa0d6eb2447f63716641c797488c1b0290ba2b6d2b765570dd1f7edb370e1cc4e5fc70366fb688fc7668d2d7390d25871b7bef3cbddee414b7cf6dac148bac8b2f9df560e3aa322bd4eca62f05be7d4c47a360886bb70515692f53fae1d7f3a40925e5a1ceeb6710900000000000000221a0e6c2bec4bc36853756efa67adbf632a64cb8054f79ec9035e30188b9bc3d5d528079df10f473d32577db6015507cfe70b012823c9182d241543d29eda7a22400eeff8d239f8d48e00a6a940d075e34552f33e1059fc421074fc483f04c5130dc4a7350a0be5a2599dc8c913afc55c3548e44353b92d3939596c82392f51513b10596c86971a10c67126d6654bfacc54d2f85813a04f1e254c1de08588acfbe7c49cf7b76a5bc0d1ef5fa24104ed154e57279443c89a59ef8eb2b15d2167c0e4a5de6e9016b4c5d06c5422f513de2495c03ae357ed7c17a54c85efe60411b69e0414a94aa2df063e3a768466ec4eb1ba20971ca7f180c5a94328f4c5e0ffd801a02bbcf305dbca4a119a555a269b7cda12a95fb15f0b82ab16dfd88b25d8c0d45edab35f6e7e9ba694ede68fc72d9414e64bc94f59971078e065b52d0c1e2fa0b877ae3f93a555c4d30d25a085f5e2c9bc1f0734e4b6cb289924782d683a19e3d7188f80e482184960882302e0b7dfd26e9a0a4686f4ecc2942b7417a755ae944a7ab7de4581477ec7f3e783a94b31198487ce1bd2956b3a57b39673044d32e46df22198c52b03a99bd20010cca7115bdf0247b80d0944862948706ae9d738902764d2f1698ce49edcaf713229715cba4905fadcb71b5f4929dfab16da7ab87612925a9c625cf76ac330a5839ef3b28c8a285c9f81b84423b7aefe4517165a5371f24e82fefe52bc97f799d5922e5fa00406272483cd425877852b28b397523acede864df3ab887985d8289253d7d29f2a6c1456812ccd65098548ce648ca7ca1c6d063aa0af2906b78e8334674cb08efbd46565b1fc28a74fc70270a1a80ff036e70c53f84d0a4196948c25eccc657dae586d861fad85767a7814bec6b68c08da0b8b198dc327443f4b2dca1f763dba96729d80f673a55dc19992c1fecb8c3f097c590814a7236ce001f466e8e79285e8000000000000000901000048000000dfb5d503140d529eaf63e24ef35c202f450c81746ab88c1fa2c53d0a5ee8a1837aad6d14b58c92f6c8e2d170ff45f611a6cf8a6e6ba6faec80814488a4b62d2f9adb762881dfc6fb428a33825af002322d65b27a0535171c58eee16e4954ba3d5213047e73973ed9489eafad9a7b3e07d72d1274b23573ca0a51d5fe75bf2ca30976d6b4d3b7b736886a07dc8deb341d1647c8623814f7bb66596d2eac536334404d51bab7c86b417b473a41a522280b1d83229995996c5e7af821206f20b1feaca0c45862b7db05ba541a636108dcec5bca7253a45a0000"], 0x13f8}, 0x40000) r4 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/snapshot\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_SETCRTC(r0, 0xc06864a2, &(0x7f0000001d80)={&(0x7f0000001d40)=[0x40, 0xbac3, 0x375f], 0x3, 0x1, 0xd, 0xffffffff, 0x9, 0xc55a, {0x5, 0x8, 0x400, 0x7ff, 0x25a, 0x81, 0x7, 0xe0, 0x63, 0x8, 0x0, 0x5b32, 0x8a, 0x0, "7ab29970ca98ac3f70b3c4e227c3b3e05d78f59dae4eebe5074bcee33a786c5a"}}) ioctl$RTC_AIE_OFF(r4, 0x7002) r5 = syz_open_dev$dmmidi(&(0x7f0000000040)='/dev/dmmidi#\x00', 0x1, 0x400000) write$9p(r5, &(0x7f0000000080)="a5f3f8fea36955e899faf2cadb99bdcea99efc4df229830d04be88a06e95b76a5760384746da61be67ca48824874113124b1", 0x32) mq_notify(r5, &(0x7f0000000100)={0x0, 0x13, 0x0, @tid=0xffffffffffffffff}) ioctl$KDGETLED(r5, 0x4b31, &(0x7f0000001b00)) sendmsg$nl_route(r4, &(0x7f0000001d00)={&(0x7f0000001b80)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000001cc0)={&(0x7f0000001c80)=@RTM_NEWNSID={0x3c, 0x58, 0x408, 0x70bd2a, 0x25dfdbfe, {}, [@NETNSA_NSID={0x8, 0x1, 0x1}, @NETNSA_NSID={0x8, 0x1, 0x2}, @NETNSA_FD={0x8, 0x3, r0}, @NETNSA_FD={0x8, 0x3, r2}, @NETNSA_NSID={0x8, 0x1, 0x2}]}, 0x3c}, 0x1, 0x0, 0x0, 0x80}, 0x4000) syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/net\x00') [ 2762.882168] binder: undelivered TRANSACTION_ERROR: 29189 14:35:55 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xa1\xff\xff\xff\x00'}}}}, 0x68}}, 0x0) 14:35:55 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x74, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:35:55 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r2 = syz_open_dev$swradio(&(0x7f0000000140)='/dev/swradio#\x00', 0x1, 0x2) ioctl$KDGKBDIACR(r2, 0x4b4a, &(0x7f0000000180)=""/244) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r3 = syz_open_dev$dmmidi(&(0x7f0000000040)='/dev/dmmidi#\x00', 0x9, 0x509100) epoll_pwait(r3, &(0x7f0000000080)=[{}], 0x1, 0x0, &(0x7f0000000100)={0xffff}, 0x8) 14:35:55 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000040)='loginuid\x00') sendfile(r0, r0, &(0x7f0000000180)=0x74000004, 0x5) fcntl$setflags(r0, 0x2, 0xd71a722c425b7e6b) write$FUSE_NOTIFY_POLL(r0, &(0x7f0000000000)={0x18, 0x1, 0x0, {0x7830}}, 0x18) [ 2763.056858] binder: 4794:4795 unknown command 0 [ 2763.060155] binder: 4801:4802 got new transaction with bad transaction stack, transaction 9028 has target 4801:0 [ 2763.075012] binder: 4794:4795 ioctl c0306201 20000600 returned -22 14:35:56 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xf0\xff\xff\xff\x00'}}}}, 0x68}}, 0x0) 14:35:56 executing program 3: getpid() r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='mounts\x00') sendfile(r0, r0, &(0x7f0000000180)=0x74000000, 0x5) 14:35:56 executing program 2: syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/net\x00') r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x20000, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x3f, &(0x7f0000000080)=0x3ea, 0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/net\x00') [ 2763.138728] binder: 4801:4802 transaction failed 29201/-71, size 0-0 line 2946 14:35:56 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 2763.210236] binder_alloc: binder_alloc_mmap_handler: 4801 20001000-20004000 already mapped failed -16 [ 2763.250938] binder: 4811:4814 unknown command 0 14:35:56 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xf0\x00'}}}}, 0x68}}, 0x0) [ 2763.271588] binder: 4811:4814 ioctl c0306201 20000600 returned -22 [ 2763.275572] binder: BINDER_SET_CONTEXT_MGR already set [ 2763.316176] binder: 4801:4822 ioctl 40046207 0 returned -16 [ 2763.372451] binder: 4801:4802 transaction failed 29189/-3, size 0-0 line 3035 [ 2763.414892] binder: release 4801:4802 transaction 9028 out, still active [ 2763.421959] binder: undelivered TRANSACTION_COMPLETE [ 2763.431312] binder: 4801:4823 transaction failed 29189/-3, size 0-0 line 3035 [ 2763.455874] binder: undelivered TRANSACTION_ERROR: 29201 [ 2763.474841] binder: undelivered TRANSACTION_ERROR: 29189 [ 2763.480433] binder: undelivered TRANSACTION_ERROR: 29189 14:35:56 executing program 4: r0 = syz_open_dev$sndseq(&(0x7f0000042000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = syz_open_dev$vbi(&(0x7f0000000080)='/dev/vbi#\x00', 0x2, 0x2) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x23, &(0x7f00000000c0)={@broadcast, @broadcast, 0x0}, &(0x7f0000000100)=0xc) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000000140)={'team0\x00', r2}) socket$rds(0x15, 0x5, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r0, 0xc058534b, &(0x7f0000000000)) 14:35:56 executing program 3: socket$bt_cmtp(0x1f, 0x3, 0x5) r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='mounts\x00') sendfile(r0, r0, &(0x7f0000000180)=0x74000000, 0x80000000005) 14:35:56 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:35:56 executing program 2: syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/net\x00') r0 = syz_open_dev$audion(&(0x7f0000000040)='/dev/audio#\x00', 0x4, 0x200000) ioctl$TIOCGSID(r0, 0x5429, &(0x7f0000000080)) ioctl$TIOCGSID(r0, 0x5429, &(0x7f0000000100)=0x0) syz_open_procfs$namespace(r1, &(0x7f0000000000)='\xbc\x96H\xc5et\x00') 14:35:56 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c4\x00'}}}}, 0x68}}, 0x0) 14:35:56 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 2763.514441] binder: send failed reply for transaction 9028, target dead [ 2763.573034] binder: 4830:4831 unknown command 0 [ 2763.616250] binder: 4840:4842 unknown command 0 [ 2763.620908] binder: 4830:4831 ioctl c0306201 20000600 returned -22 [ 2763.646730] binder: 4840:4842 ioctl c0306201 20000000 returned -22 14:35:56 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00'}}}}, 0x68}}, 0x0) 14:35:56 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa000000, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:35:56 executing program 3: r0 = accept4$alg(0xffffffffffffff9c, 0x0, 0x0, 0x800) r1 = getpgrp(0xffffffffffffffff) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000040)={{{@in6, @in=@initdev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast1}, 0x0, @in=@empty}}, &(0x7f0000000140)=0xe8) r3 = getegid() open(&(0x7f0000000240)='./file0\x00', 0x20000, 0x60) setsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00000001c0)={r1, r2, r3}, 0xc) fcntl$F_GET_FILE_RW_HINT(r0, 0x40d, &(0x7f0000000200)) r4 = syz_open_procfs(0x0, &(0x7f0000000000)='mounts\x00') sendfile(r4, r4, &(0x7f0000000180)=0x74000000, 0x5) [ 2763.679596] binder_alloc: binder_alloc_mmap_handler: 4840 20001000-20004000 already mapped failed -16 14:35:56 executing program 2: bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffff9c, 0x0, 0x7, &(0x7f0000000040)='ns/net\x00', 0xffffffffffffffff}, 0x30) syz_open_procfs$namespace(r0, &(0x7f00000000c0)='n\x00\x00\xe4\x00\x00\x00') syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/net\x00') [ 2763.775593] binder: 4851:4854 unknown command 0 [ 2763.780338] binder: 4851:4854 ioctl c0306201 20000600 returned -22 [ 2763.784748] binder: 4840:4842 unknown command 0 [ 2763.796971] binder: 4840:4842 ioctl c0306201 20000000 returned -22 [ 2763.816014] binder: BINDER_SET_CONTEXT_MGR already set 14:35:56 executing program 2: r0 = getpgid(0x0) syz_open_procfs$namespace(r0, &(0x7f00000000c0)='ns/net\x00') openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x2000, 0x0) syz_open_procfs$namespace(r0, &(0x7f0000000040)='ns/net\x00') [ 2763.836547] binder: release 4840:4845 transaction 9033 out, still active [ 2763.844588] binder: 4840:4855 ioctl 40046207 0 returned -16 [ 2763.853300] binder: undelivered TRANSACTION_COMPLETE [ 2763.864819] binder: 4851:4854 unknown command 0 14:35:56 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='mounts\x00') sendfile(r0, r0, &(0x7f0000000180)=0x74000000, 0x5) ioctl$NBD_SET_SOCK(r0, 0xab00, r0) [ 2763.881046] binder: send failed reply for transaction 9033, target dead [ 2763.888727] binder: 4851:4854 ioctl c0306201 20000600 returned -22 14:35:56 executing program 4: r0 = syz_open_dev$sndseq(&(0x7f0000042000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000000080)={{0xaf, 0xc1}, 'port0\x00', 0x20, 0xa0000, 0x9, 0x800, 0x54f, 0x2, 0x0, 0x0, 0x1, 0x3}) accept4$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000240)=0xfffffd77, 0x0) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x2040) r1 = getpid() rt_tgsigqueueinfo(r1, r1, 0x16, &(0x7f0000000100)) ptrace(0x10, r1) ptrace$getregset(0x4205, r1, 0x202, &(0x7f0000000080)={&(0x7f0000000040)=""/61, 0xffffff78}) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r0, 0xc058534b, &(0x7f00000001c0)) 14:35:56 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xf0\x00'}}}}, 0x68}}, 0x0) 14:35:56 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6800, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:35:56 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x3) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:35:56 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xff\xff\xff\xf0\x00'}}}}, 0x68}}, 0x0) [ 2764.054266] binder: 4874:4875 unknown command 0 14:35:57 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000200)='mou\\Ts\x00+\xb9\ac\xb9\xc3\x86\x8fqw\x89\b]\"fm0\xb1\xe7ieD\x18\xc2q\xed{wK\xac\xe4E\xbe\x9b\xf0\xdey\b\xcf\xd6\xfbf\xce\'\x92\xe8\xd77#m\xc3\x95pl\a\xd0\x88\xb2veIJ\xeb\x1c\x1a\x7f0\x12\xe1\xaf\xedhL\x93>\xa0-\x18b\xd9w\xcb\x8e\xb2\x13\x02\xa3\x9e\xe60\x88I\xb3\xce\xf1$\xd9\x9c\v\xe5\x96b\xa3\xad\xddk\xa8n\x10&\xdd\xa9\xe8\t\xa1\x15\xcfl\xd5\xf9C\x87cJ\x9a\xaa\xcb\x1f?\x19;\x0faY\xab\xe3\x18\x16\x99b\xed\xc6\xc1\x05\xd9\xe57P\xeb\x83\x04%\x05\xa0\x83R\xa1\x01\x00\x00\x00\xbf\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00') ioctl$EVIOCGUNIQ(r0, 0x80404508, &(0x7f0000000000)=""/209) sendfile(r0, r0, &(0x7f0000000180)=0x74000000, 0x5) connect$inet(r0, &(0x7f0000000340)={0x2, 0x4e23, @empty}, 0x10) r1 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000140)='IPVS\x00') sendmsg$IPVS_CMD_DEL_DAEMON(r0, &(0x7f0000000300)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000002c0)={&(0x7f00000001c0)={0x3c, r1, 0x4, 0x70bd28, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x9}, @IPVS_CMD_ATTR_SERVICE={0x20, 0x1, [@IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x1, 0x1}}, @IPVS_SVC_ATTR_FWMARK={0x8}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x800}]}]}, 0x3c}, 0x1, 0x0, 0x0, 0x80}, 0x4) 14:35:57 executing program 2: syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/net\x00') r0 = syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/net\x00') ioctl$RTC_WKALM_SET(r0, 0x4028700f, &(0x7f0000000040)={0x0, 0x1, {0x11, 0x0, 0xf, 0x15, 0x9, 0x1000, 0x0, 0x154}}) r1 = dup2(r0, r0) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000080)={0x6, 0x0, 0x0, 0x3}) ioctl$DRM_IOCTL_AGP_FREE(r1, 0x40206435, &(0x7f0000000100)={0x0, r2, 0x10001, 0x1ff}) [ 2764.099016] binder: 4874:4875 ioctl c0306201 20000600 returned -22 [ 2764.119764] binder: 4877:4878 transaction failed 29189/-3, size 0-0 line 3035 [ 2764.132889] binder: 4874:4875 unknown command 0 14:35:57 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 2764.154752] binder: 4874:4875 ioctl c0306201 20000600 returned -22 [ 2764.179987] binder: 4877:4885 transaction failed 29189/-3, size 0-0 line 3035 14:35:57 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xa1\x00'}}}}, 0x68}}, 0x0) [ 2764.225322] binder: BINDER_SET_CONTEXT_MGR already set [ 2764.230668] binder: 4877:4885 ioctl 40046207 0 returned -16 [ 2764.246992] binder: undelivered TRANSACTION_ERROR: 29189 [ 2764.258860] binder: undelivered TRANSACTION_ERROR: 29189 14:35:57 executing program 2: r0 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000180)='/dev/cachefiles\x00', 0x4003, 0x0) setsockopt$inet6_MRT6_ADD_MFC_PROXY(r0, 0x29, 0xd2, &(0x7f0000000100)={{0xa, 0x4e22, 0xe5, @remote, 0x7f}, {0xa, 0x4e21, 0x5, @mcast1, 0x10000}, 0x4, [0x2, 0x1ff, 0x2, 0x10000, 0x47, 0x5, 0x1711, 0x8000]}, 0x5c) syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='\xa4n\x03\xb1\xf0\xc6&') sendmsg(r0, &(0x7f0000000440)={&(0x7f00000001c0)=@x25={0x9, @null=' \x00'}, 0x80, &(0x7f0000000340)=[{&(0x7f0000000080)="c16d6b68dd573b6c6b08800a7e3e9a41461e33a6ec69e6a92bbb4af0cafe7f76feb00776934e69d0ebad465a472a5292106e", 0x32}, {&(0x7f0000000240)="a0317fe783cbf29369d8d05b55023436a09d5c1e32110ccad3d41763d7faf2b431896068163ae45a57b6f82a669628cc8ceddeb8d861668de5b5750b367e68150f91c7d28183e7819d8d179a1038b4c1bedbf1d2250901b2732d981518661ee208ca8a5fec33995b7415a4348b844dd1e643311f981f1ef3ee596609f69e017d6459f41435e468847262a02231c814ab0d0964b67a90bfabe761fcfc27f53a2dbbd1fbef6f06664cc068acb45ecf328338dc19fc21bb99d52e9b5f2814cf4d3a4bc9e0b3527b5cac65e52bf0bc306f929b375010d36860099504efad6829e1df56e9e438208548dd0ae7c67010800e10ad5ca7fed91bd69a", 0xf8}], 0x2, &(0x7f0000000380)=[{0x78, 0x117, 0x1, "8cee51fba855606238b5e004eface5fdf67902003608debd099adb437c72dff44737cb8856e3055f68be965c6dfb311802712b8733a0b3bbd213b3a406871956b827239392a4bd0f7ffd460d023c4f8d2fe13b41bb52b96b31ac173305da996d8ad5dc18"}, {0x48, 0x0, 0x9, "0172134a9bb5660e9514b265e17047bbeaed8262fad628a0e3b69779775999254806fceddef731faef564071fb717cef559808546b3fa997"}], 0xc0}, 0x10) openat$full(0xffffffffffffff9c, &(0x7f0000000040)='/dev/full\x00', 0x2000, 0x0) syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/net\x00') 14:35:57 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='mounts\x00') sendfile(r0, r0, &(0x7f0000000180)=0x74000000, 0x5) ioctl$VIDIOC_G_STD(r0, 0x80085617, &(0x7f0000000240)=0x0) io_setup(0x0, &(0x7f0000000040)=0x0) setsockopt$MISDN_TIME_STAMP(r0, 0x0, 0x1, &(0x7f0000000080), 0x4) io_cancel(r2, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x5, 0x81, r0, &(0x7f00000002c0)="808a656cada8fd9afd1131d5c4168300a349dd562ca59f8c86a1284131c05db7fe459b564cac3cc1ca96aacaeee762d82ba99a167e085f84062b10ca45d1b68ba5d5cadaacd25f5834e1dd2b06ed9f12710bc682d9de06414cd52462a49596430df96963a4", 0x65, 0x8}, &(0x7f0000000380)) ioctl$VIDIOC_S_STD(r0, 0x40085618, &(0x7f0000000280)=r1) sendmsg$IPVS_CMD_ZERO(r0, &(0x7f0000000200)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000480)=ANY=[@ANYBLOB="c0000000", @ANYRES16, @ANYBLOB="04032abd7000fcdbdf250e1e8349e219931beb51100000000c00010008000800090000005c000100080009000b0000000800020087000000080004000100000008000500040000000c0007000400000004000000080008000b4d0000080009006e00000008000b00736970000c0007001100000025000000080002003a0000000800050006000000080006002000eff2e46bfddcfc1700000800060006000000140001000800010002000000080004004e200000080004000300000008000500ff0000007d43d551f272026b1c910d4dd6a0a8e6f31830e747f91d2a4e40a4cb5eecb24d9e363a9668"], 0xc0}, 0x1, 0x0, 0x0, 0x8080}, 0x4040) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x5, 0xf, 0x16, 0x1d, "2569627aa04a2a2139c931881b3fa9e05a2c71bb3c976b2aa657212edae69443a6f38c2136097bbe2a420442353b917efebd438f2c5ff9d59a0eccc6e7aa52de", "408f227de89bf86c49db27d1175134b87156a19c8b91451457daef76b35b7765", [0x9dc, 0x80000000]}) 14:35:57 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) munlock(&(0x7f0000002000/0x3000)=nil, 0x3000) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 2764.282010] binder: undelivered TRANSACTION_ERROR: 29189 [ 2764.304819] binder_thread_write: 12 callbacks suppressed [ 2764.304831] binder: 4892:4895 BC_ACQUIRE_DONE u0000000000000000 no match [ 2764.424110] binder: 4892:4895 unknown command 0 [ 2764.429979] binder: 4892:4895 ioctl c0306201 20000600 returned -22 [ 2764.454933] binder: 4905:4906 got new transaction with bad transaction stack, transaction 9039 has target 4905:0 [ 2764.487565] binder_alloc: binder_alloc_mmap_handler: 4905 20001000-20004000 already mapped failed -16 14:35:57 executing program 4: r0 = syz_open_dev$sndseq(&(0x7f0000042000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r0, 0xc058534b, &(0x7f0000000000)) r1 = gettid() r2 = openat$dir(0xffffffffffffff9c, &(0x7f0000001600)='./file0\x00', 0x80000, 0x40) process_vm_readv(r1, &(0x7f00000014c0)=[{&(0x7f0000000080)=""/4096, 0x1000}, {&(0x7f0000001080)=""/251, 0xfb}, {&(0x7f0000001180)=""/221, 0xdd}, {&(0x7f0000001280)=""/152, 0x98}, {&(0x7f0000001340)=""/218, 0xda}, {&(0x7f0000001440)=""/85, 0x55}], 0x6, &(0x7f00000015c0)=[{&(0x7f0000001540)=""/105, 0x69}], 0x1, 0x0) r3 = fcntl$dupfd(r2, 0x406, r0) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000001700)={r2, 0x50, &(0x7f0000001680)={0x0, 0x0}}, 0x10) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000001740)={r1, r3, 0x0, 0x8, &(0x7f0000001640)='selinux\x00', r4}, 0x30) 14:35:57 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xf0\xff\xff\x00'}}}}, 0x68}}, 0x0) 14:35:57 executing program 2: syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/net\x00') r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20\x00', 0x4000, 0x0) getsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000000040)={0x0, 0x10000000000, 0x9, 0xad}, &(0x7f0000000100)=0x10) getsockopt$inet_sctp6_SCTP_RTOINFO(r0, 0x84, 0x0, &(0x7f0000000140)={r1, 0x101, 0x3, 0x3}, &(0x7f0000000180)=0x10) chmod(&(0x7f00000001c0)='./file0\x00', 0x2) syz_open_procfs$namespace(0x0, &(0x7f0000000080)='ns?net\x00') 14:35:57 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400c630e, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:35:57 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='mounts\x00') sendfile(r0, r0, &(0x7f0000000180)=0x74000000, 0x5) lstat(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0}) stat(&(0x7f0000000200)='./file0\x00', &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000002c0)={{{@in=@dev, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@remote}, 0x0, @in6=@initdev}}, &(0x7f00000003c0)=0xe8) mount$fuseblk(&(0x7f0000000000)='/dev/loop0\x00', &(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='fuseblk\x00', 0x4000, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x1000}, 0x2c, {'user_id', 0x3d, r1}, 0x2c, {'group_id', 0x3d, r2}, 0x2c, {[{@blksize={'blksize', 0x3d, 0x1a00}}], [{@fowner_lt={'fowner<', r3}}, {@smackfsdef={'smackfsdef', 0x3d, ']systemem0ppp0+security-proc-!vmnet1md5sum'}}, {@mask={'mask', 0x3d, '^MAY_READ'}}, {@subj_type={'subj_type', 0x3d, 'mounts\x00'}}]}}) [ 2764.545653] binder_alloc_new_buf_locked: 7 callbacks suppressed [ 2764.545662] binder_alloc: 4905: binder_alloc_buf, no vma [ 2764.612140] binder: 4918:4919 BC_ACQUIRE_DONE u0000000000000000 no match [ 2764.651333] binder: BINDER_SET_CONTEXT_MGR already set 14:35:57 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00'}}}}, 0x68}}, 0x0) [ 2764.658623] binder: 4918:4919 unknown command 0 [ 2764.676939] binder: 4905:4906 ioctl 40046207 0 returned -16 14:35:57 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='mounts\x00') ioctl$FS_IOC_MEASURE_VERITY(r0, 0xc0046686, &(0x7f0000000000)={0x0, 0xe5, "62c14a929d0657b9466cfdce11707871d78ccc65abdb7f748e6fd4a07597d707013f905ee252b7f306d913ce7b0255f1a19246dc0e2eeceb2bcbeed951efa893930956bad9a1f095c52d2826731126c71bd0c47cee422639944d9cbd5ba0772ac629b61c1e47f44a69e001d4e5cdc59c6c7da75cadd28620e1bb2ed366afdbbb1ea1e5611e4739ca1840f0d1862d1f3b5e1da575aaccbe9228a041698b9864725d07f5c1f733902d14028ab087aa07fc54bd67dd57b36cd8c055cb4bf2549281bec2de9237ae172c97e5bf9e4ca4d629c3b09d888447188ac2c66dfd214d4768590e8eb7bb"}) sendfile(r0, r0, &(0x7f0000000180)=0x74000000, 0x5) 14:35:57 executing program 2: syz_open_dev$amidi(&(0x7f0000000040)='/dev/amidi#\x00', 0x10000, 0x2) syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/net\x00') syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/net\x00') r0 = socket$packet(0x11, 0x3, 0x300) fcntl$getown(r0, 0x9) [ 2764.714020] binder: 4918:4919 ioctl c0306201 20000600 returned -22 [ 2764.720834] binder_alloc: 4905: binder_alloc_buf, no vma [ 2764.732695] binder: 4918:4919 BC_ACQUIRE_DONE u0000000000000000 no match [ 2764.745428] binder: release 4905:4906 transaction 9039 out, still active [ 2764.752310] binder: undelivered TRANSACTION_COMPLETE 14:35:57 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xfc\x00'}}}}, 0x68}}, 0x0) 14:35:57 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$midi(&(0x7f0000000040)='/dev/midi#\x00', 0x7, 0x40400) getsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(0xffffffffffffff9c, 0x84, 0x22, &(0x7f0000000080)={0x8, 0x1, 0x7fffffff, 0x3, 0x0}, &(0x7f0000000100)=0x10) getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(0xffffffffffffff9c, 0x84, 0x73, &(0x7f0000000140)={0x0, 0x1000, 0x20, 0x28000000000000, 0x4}, &(0x7f0000000180)=0x18) getsockopt$inet_sctp6_SCTP_STATUS(r2, 0x84, 0xe, &(0x7f00000001c0)={r3, 0x6, 0x3f6, 0x1f, 0x1, 0x800, 0x80, 0x4000000000000, {r4, @in={{0x2, 0x4e24, @broadcast}}, 0xfffffffffffffffd, 0x4, 0x100000000, 0x4, 0x2}}, &(0x7f0000000280)=0xb0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="326340403a2992025d57c81625986937ecdfa42a8cf66b77b06a78460d3bdf296680ad9afe83d0f505dbe8d9c3f7c50dbdf177b4881026301baaeda97d5dfa6aa5"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="0063404023da00000000000000000000000000000000000000000000000000000000000000bc8d9f6137333de0000000000000000000000000000000000028ebd222eeda41b8fa6bab54f3e5df0000"], 0x0, 0x0, 0x0}) [ 2764.803942] binder: send failed reply for transaction 9039, target dead [ 2764.827698] binder: 4918:4919 unknown command 0 [ 2764.832537] binder: 4918:4919 ioctl c0306201 20000600 returned -22 14:35:57 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='mounts\x00') sendfile(r0, r0, &(0x7f0000000000)=0x73fffffc, 0x4) 14:35:57 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd630000, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 2764.959692] binder: 4947:4948 unknown command 1077961522 [ 2765.009701] binder: 4947:4948 ioctl c0306201 20000000 returned -22 [ 2765.025215] binder: 4952:4954 BC_ACQUIRE_DONE u0000000000000000 no match [ 2765.047536] binder: 4947:4953 got transaction to invalid handle [ 2765.063947] binder: 4952:4954 unknown command 0 [ 2765.078579] binder_alloc: binder_alloc_mmap_handler: 4947 20001000-20004000 already mapped failed -16 [ 2765.089191] binder: 4952:4954 ioctl c0306201 20000600 returned -22 [ 2765.102756] binder: BINDER_SET_CONTEXT_MGR already set 14:35:58 executing program 4: r0 = syz_open_dev$sndseq(&(0x7f0000042000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000080)='/dev/autofs\x00', 0x1, 0x0) setsockopt$inet_sctp6_SCTP_HMAC_IDENT(r1, 0x84, 0x16, &(0x7f0000000240)={0x3, [0x9, 0x9, 0x100]}, 0xa) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f00000000c0)={{{@in=@broadcast, @in6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in6=@mcast2}}, &(0x7f00000002c0)=0xe8) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000200)={'vcan0\x00', r2}) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r0, 0xc058534b, &(0x7f0000000000)) 14:35:58 executing program 2: accept4$tipc(0xffffffffffffffff, &(0x7f00000001c0)=@name, &(0x7f0000000300)=0x10, 0x800) syz_open_dev$audion(&(0x7f0000000340)='/dev/audio#\x00', 0x3, 0x14002) pipe2(&(0x7f0000000380), 0x800) r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000600)='/proc/self/net/pfkey\x00', 0x141000, 0x0) getsockopt$IP_VS_SO_GET_TIMEOUT(r0, 0x0, 0x486, &(0x7f0000000640), &(0x7f0000000680)=0xc) ioctl$VIDIOC_EXPBUF(0xffffffffffffff9c, 0xc0405610, &(0x7f00000003c0)={0xe, 0xffffffff00000001, 0x2, 0x800}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000440)='/dev/kvm\x00', 0x400000, 0x0) r1 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/qat_adf_ctl\x00', 0x0, 0x0) getsockopt$inet_sctp6_SCTP_PR_STREAM_STATUS(r0, 0x84, 0x74, &(0x7f00000004c0)=""/14, &(0x7f0000000500)=0xe) r2 = fcntl$getown(r1, 0x9) syz_open_procfs$namespace(r2, &(0x7f0000000400)='Z\xce/net\x00') syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/net\x00') lgetxattr(&(0x7f0000000480)='./file0\x00', &(0x7f0000000200)=@random={'user.', '{\x00'}, &(0x7f0000000540)=""/109, 0x6d) lsetxattr$trusted_overlay_origin(&(0x7f0000000040)='./file0\x00', &(0x7f0000000140)='trusted.overlay.origin\x00', &(0x7f0000000180)='y\x00', 0xffffffffffffff4c, 0x3) r3 = openat$dlm_control(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/dlm-control\x00', 0x40000, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0) mknodat(r3, &(0x7f00000000c0)='./file0\x00', 0x100, 0xc) 14:35:58 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='mounts\x00') r1 = syz_open_dev$vbi(&(0x7f0000000000)='/dev/vbi#\x00', 0x1, 0x2) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f0000000040), &(0x7f0000000080)=0x14) sendfile(r0, r0, &(0x7f0000000180)=0x74000000, 0x5) 14:35:58 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0e\x00'}}}}, 0x68}}, 0x0) 14:35:58 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x463044000000000, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 2765.131201] binder: 4947:4948 ioctl 40046207 0 returned -16 [ 2765.165644] binder: 4947:4960 unknown command 1077961522 [ 2765.171264] binder: 4947:4960 ioctl c0306201 20000000 returned -22 [ 2765.223893] binder: 4947:4948 got transaction to invalid handle [ 2765.235570] binder: 4967:4968 BC_ACQUIRE_DONE u0000000000000000 no match 14:35:58 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xea\xff\xff\xff\x00'}}}}, 0x68}}, 0x0) 14:35:58 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) read(r0, &(0x7f0000000300)=""/11, 0xb) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000200)) r1 = eventfd(0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000040)=0x400100000001, 0x2fa) connect$inet6(r2, &(0x7f0000000080), 0x1c) r3 = dup2(r2, r2) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r3, 0x6, 0x16, &(0x7f0000000440), 0x131f64) syz_execute_func(&(0x7f0000000240)="3666440f50f564ff0941c3c4e2c9975842c4c27d794e00c42221b888010000003e0f1110c442019dccd3196f") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) connect$inet6(r3, 0x0, 0x0) r4 = dup2(r0, r1) ioctl$sock_SIOCGIFCONF(r4, 0x8912, 0x0) [ 2765.284257] binder: 4967:4968 unknown command 0 [ 2765.289043] binder: 4967:4968 ioctl c0306201 20000600 returned -22 14:35:58 executing program 2: syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/net\x00') socket$pppoe(0x18, 0x1, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) accept$inet(0xffffffffffffff9c, &(0x7f00000004c0)={0x2, 0x0, @local}, &(0x7f0000000500)=0x10) r0 = socket$caif_stream(0x25, 0x1, 0x1) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000000540)=0x0) syz_open_procfs$namespace(r1, &(0x7f0000000340)='ns/net\x00') r2 = creat(&(0x7f0000000040)='./file0\x00', 0x41) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffff9c, 0x84, 0x1a, &(0x7f0000000100)={0x0, 0x56, "91d03cbd64f40f28bbfbb90ff076994ce49159159adcc75d5a7ea745a84d877837c4447a70621546e440766353feb5ee863da92a071243a58a9a42a193d00cc8fa81f65ec2a367e2419a26b351156a47ba49055775fc"}, &(0x7f0000000080)=0x5e) setsockopt$IP_VS_SO_SET_ADDDEST(r2, 0x0, 0x487, &(0x7f00000003c0)={{0x7f, @broadcast, 0x4e22, 0x0, 'sh\x00', 0x1, 0x6, 0x17}, {@empty, 0x4e23, 0x4, 0x7fffffff, 0x3f, 0x6}}, 0x44) sendmsg$nl_route(r2, &(0x7f00000002c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)=@ipv4_delrule={0x38, 0x21, 0x400, 0x70bd2b, 0x25dfdbfd, {0x2, 0x30, 0x0, 0xc7, 0x98da, 0x0, 0x0, 0x8, 0x4}, [@FRA_SRC={0x8, 0x2, @empty}, @FRA_GENERIC_POLICY=@FRA_PROTOCOL={0x8, 0x15, 0x4}, @FRA_GENERIC_POLICY=@FRA_TABLE={0x8, 0xf, 0xffffffff}]}, 0x38}, 0x1, 0x0, 0x0, 0x400c004}, 0x4000) getsockopt$inet_sctp_SCTP_RESET_STREAMS(r2, 0x84, 0x77, &(0x7f0000000180)=ANY=[@ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00'], &(0x7f00000001c0)=0xe) 14:35:58 executing program 0: r0 = syz_open_dev$vcsn(&(0x7f0000000040)='/dev/vcs#\x00', 0xc5b8, 0x200000) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffff9c, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080)={0xffffffffffffffff}, 0x106, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_NOTIFY(r0, &(0x7f0000000140)={0xf, 0x8, 0xfa00, {r1, 0xd}}, 0x10) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:35:58 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1200000000000000, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 2765.412706] binder: 4977:4978 got new transaction with bad transaction stack, transaction 9047 has target 4977:0 14:35:58 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0f\x00'}}}}, 0x68}}, 0x0) [ 2765.477184] binder: 4988:4990 BC_ACQUIRE_DONE u0000000000000000 no match [ 2765.502010] binder_alloc: binder_alloc_mmap_handler: 4977 20001000-20004000 already mapped failed -16 14:35:58 executing program 4: r0 = syz_open_dev$sndseq(&(0x7f0000042000)='/dev/snd/seq\x00', 0x0, 0x200000) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r0, 0xc058534b, &(0x7f0000000000)) r1 = dup2(r0, r0) ioctl$VT_GETSTATE(r1, 0x5603, &(0x7f0000000080)={0x7, 0x7, 0x400}) [ 2765.524313] binder: 4988:4990 unknown command 0 14:35:58 executing program 2: r0 = getpgrp(0xffffffffffffffff) syz_open_procfs$namespace(r0, &(0x7f00000000c0)='ns/pid\x00') r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='cpu.stat\x00', 0x0, 0x0) getsockopt$inet_sctp6_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000000080)={0x0, 0x3, 0x7ff00000, 0xfffffffffffffffa}, &(0x7f0000000100)=0x10) ioctl$FICLONERANGE(r1, 0x4020940d, &(0x7f0000000180)={r1, 0x0, 0x3, 0x2, 0x2}) setsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r1, 0x84, 0x72, &(0x7f0000000140)={r2, 0x401, 0x30}, 0xc) syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/net\x00') 14:35:58 executing program 3: [ 2765.548429] binder: 4988:4990 ioctl c0306201 20000600 returned -22 [ 2765.576888] binder: BINDER_SET_CONTEXT_MGR already set [ 2765.606338] binder_alloc: 4977: binder_alloc_buf, no vma [ 2765.643519] binder: 4977:4992 ioctl 40046207 0 returned -16 14:35:58 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc630000, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:35:58 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00'}}}}, 0x68}}, 0x0) [ 2765.695513] binder_alloc: 4977: binder_alloc_buf, no vma 14:35:58 executing program 2: syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/net\x00') syz_open_dev$vcsa(&(0x7f0000000040)='/dev/vcsa#\x00', 0x3, 0xa000) syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/net\x00') 14:35:58 executing program 3: [ 2765.780908] binder: send failed reply for transaction 9047 to 4977:4978 [ 2765.804869] binder: 5009:5010 BC_ACQUIRE_DONE u0000000000000000 no match [ 2765.813961] binder: undelivered TRANSACTION_COMPLETE 14:35:58 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x7, 0x100) ioctl$KVM_X86_SET_MCE(r2, 0x4040ae9e, &(0x7f0000000080)={0x100000000000000, 0x1, 0x9, 0x5, 0x7}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 2765.843951] binder: 5009:5010 unknown command 0 [ 2765.848769] binder: 5009:5010 ioctl c0306201 20000600 returned -22 14:35:58 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00'}}}}, 0x68}}, 0x0) [ 2765.920480] binder: 5009:5010 BC_ACQUIRE_DONE u0000000000000000 no match [ 2765.940530] binder: 5019:5020 got new transaction with bad transaction stack, transaction 9052 has target 5019:0 14:35:58 executing program 2: syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/net\x00') r0 = syz_open_dev$mice(&(0x7f0000000040)='/dev/input/mice\x00', 0x0, 0x4000) ioctl$EVIOCGEFFECTS(r0, 0x80044584, &(0x7f0000000100)=""/94) syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/net\x00') 14:35:58 executing program 3: [ 2765.989605] binder: 5009:5010 unknown command 0 14:35:59 executing program 4: r0 = syz_open_dev$sndseq(&(0x7f0000042000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000280)='/dev/full\x00', 0x800, 0x0) getsockopt$inet_sctp_SCTP_CONTEXT(0xffffffffffffffff, 0x84, 0x11, &(0x7f00000002c0)={0x0, 0x10000}, &(0x7f0000000300)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r1, 0x84, 0x22, &(0x7f0000000340)={0x5, 0x8209, 0x6, 0x800, r2}, 0x10) r3 = dup(r0) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f00000000c0)={r3, 0x28, &(0x7f0000000080)}, 0x10) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r0, 0xc058534b, &(0x7f0000000000)) ioctl$VT_GETSTATE(r3, 0x5603, &(0x7f0000000500)={0xef, 0x7ff, 0x4}) read(r3, &(0x7f0000000100)=""/220, 0xdc) ioctl$VHOST_SET_FEATURES(r1, 0x4008af00, &(0x7f00000004c0)=0x8000000) ioctl$DRM_IOCTL_AGP_ALLOC(r1, 0xc0206434, &(0x7f0000000540)={0xff, 0x0, 0x10002}) ioctl$DRM_IOCTL_SG_FREE(r3, 0x40106439, &(0x7f0000000580)={0x0, r4}) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r3, 0x4040534e, &(0x7f0000000200)={0x80, @time={0x0, 0x1c9c380}, 0xfe00000000000000, {0x3f, 0xffffffffffffff72}, 0x4, 0x0, 0xbb98}) getsockopt$inet6_opts(r1, 0x29, 0x37, &(0x7f0000000380)=""/254, &(0x7f0000000480)=0xfe) [ 2766.043949] binder: 5009:5010 ioctl c0306201 20000600 returned -22 [ 2766.052282] binder_alloc: binder_alloc_mmap_handler: 5019 20001000-20004000 already mapped failed -16 14:35:59 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 2766.140584] binder: BINDER_SET_CONTEXT_MGR already set 14:35:59 executing program 3: [ 2766.184230] binder: 5019:5020 ioctl 40046207 0 returned -16 [ 2766.213217] binder: 5036:5037 BC_ACQUIRE_DONE u0000000000000000 no match [ 2766.226370] binder_alloc: 5019: binder_alloc_buf, no vma 14:35:59 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00'}}}}, 0x68}}, 0x0) 14:35:59 executing program 2: syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/net\x00') r0 = syz_open_dev$sndpcmc(&(0x7f0000000080)='/dev/snd/pcmC#D#c\x00', 0x40, 0x2800) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000240)={r0, &(0x7f00000000c0)="7e37da3030526415a14b5876e033c273b0e86b683eb951dec96e3e5cc849832b6604209a08a9c91c87838fbdd5f1fe9133b15461990f6ea1ef09b9c94409b4811929ba58268990c4f498e11ff6edd1df8f5c3c3d455cf8a2a68019a51c2603955931f1ec", &(0x7f0000000140)=""/255}, 0x18) fcntl$getownex(r0, 0x10, &(0x7f0000000280)={0x0, 0x0}) syz_open_procfs$namespace(r1, &(0x7f0000000000)='ns/ipc\x00') [ 2766.229263] binder: release 5019:5020 transaction 9052 out, still active [ 2766.247871] binder: undelivered TRANSACTION_COMPLETE [ 2766.262855] binder: 5036:5037 unknown command 0 [ 2766.276292] binder: send failed reply for transaction 9052, target dead 14:35:59 executing program 3: [ 2766.317583] binder: 5036:5037 ioctl c0306201 20000600 returned -22 14:35:59 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20013, r1, 0x0) fanotify_init(0x74, 0x8000) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:35:59 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xf0\x00'}}}}, 0x68}}, 0x0) 14:35:59 executing program 2: syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/net\x00') r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ubi_ctrl\x00', 0x80000, 0x0) ioctl$VIDIOC_ENUMINPUT(r0, 0xc050561a, &(0x7f0000000100)={0x9e, "2f435cff70e1fd9d9fc541684a6e057a7d6cd4d5a1e742807952a44636c7ba77", 0x3, 0xff, 0x5, 0x3000000, 0x1000004, 0xa}) recvfrom$inet6(r0, &(0x7f0000000180)=""/72, 0x48, 0x2140, &(0x7f0000000080)={0xa, 0xffffffffffffffc0, 0x1, @initdev={0xfe, 0x88, [], 0x0, 0x0}, 0x101}, 0x1c) syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/net\x00') 14:35:59 executing program 3: 14:35:59 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6c, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 2766.546584] binder: 5052:5055 got new transaction with bad transaction stack, transaction 9056 has target 5052:0 [ 2766.580497] binder: 5061:5062 BC_ACQUIRE_DONE u0000000000000000 no match 14:35:59 executing program 2: r0 = syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/net\x00') ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000040)) fcntl$getown(r0, 0x9) getpgrp(0xffffffffffffffff) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000100)) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x1, &(0x7f0000000280)='\x00', 0xffffffffffffffff}, 0x30) syz_open_procfs$namespace(r1, &(0x7f0000000140)='\x00\x00k\xd3\xc0\xc0\xd8\xaa\xd1\xc6\x82\x8e\xb1\xb7\x87\xeb\xf5\x00\x00\x00\x00\x00\xf5\x84\xad/\xb1\xc6X-\xcfKM=\xfa\xde\xa4\xef\xf4\x02\xbd\xe4\xa8\x1b\x96\x98co\x00`)z\xfa/,\xb4\n\xd1\xd6\xfe\xd8m4\x03\xd2\xd0\xe7\x84T\x7f\xd1m.\xbf\xf9\x95\x9e\x83\xd9dl\x8denle\xd5\xb4$\xdc(}\xff5\x8e\aw\xd2\x91\x89k\xe8\x02\x05\xf6\xd1\xcf\x0e\x83\x96\xc2\xb9\xbe\xfb\\rg\xa0\xeen\xe6&H*\xdf\xdb\x01\xd6\x01\xd0\xf4h7\xde$}\xc2,\xea\xb6\xe7\xd6E\xcc\x83\x9f\xe6\x1d\xaa\x95\xec\xf4\xde$b\xc2\xa1\x90\xd9\xbb\x9f}j\b\x8aE\xc6\xb6$\xa0,\xaf7\xa0s\xa5\x1d\xc6`\x19\xd8\a\x01\x9a\xeb\xc8\x94\xbc\xd0 ?\xb0\xbc\x13\xffQ\xabM\x01\xbe\n\xe4\x87\xb1\xac\xfe\x13\x1d\xd7\xf3\x8d`\xc3\xedT/\xb4)\x9b\xba^-\xce\xfe#\x8f\xa0\xbd\x82\x04\x1a\x9c\xcf\xc1u\x19\xe9_u\f\\\xe3\x1a\xb3\x7f\x11M\x15E\x03\xf1\x13=\xc0r\x12\xdb\x05\x91\xebJ^\xa5[\r\x13R7\xa8>\xab[\xae\xfc\xfbf\xc72|\xa7\x83\x8f\x8cW\xf8\xceM\xdb\xbc\x8d ?<\x8c\x12UDV\x9b\xcdSI') [ 2766.618504] binder_alloc: binder_alloc_mmap_handler: 5052 20001000-20004000 already mapped failed -16 [ 2766.630673] binder: 5061:5062 unknown command 0 [ 2766.663429] binder: 5061:5062 ioctl c0306201 20000600 returned -22 [ 2766.686266] binder: BINDER_SET_CONTEXT_MGR already set [ 2766.711152] binder: 5052:5066 ioctl 40046207 0 returned -16 [ 2766.742177] binder_alloc: 5052: binder_alloc_buf, no vma [ 2766.764429] binder_alloc: 5052: binder_alloc_buf, no vma [ 2766.785388] binder_transaction: 12 callbacks suppressed [ 2766.785407] binder: 5052:5063 transaction failed 29189/-3, size 0-0 line 3035 [ 2766.827641] binder: release 5052:5055 transaction 9056 out, still active [ 2766.835676] binder: 5052:5055 transaction failed 29189/-3, size 0-0 line 3035 [ 2766.844326] binder: undelivered TRANSACTION_COMPLETE [ 2766.857628] binder: send failed reply for transaction 9056, target dead 14:35:59 executing program 4: getitimer(0x3, &(0x7f0000000080)) r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x60000) r1 = openat$zero(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/zero\x00', 0x0, 0x0) ioctl$sock_bt_bnep_BNEPGETSUPPFEAT(r1, 0x800442d4, &(0x7f0000000140)=0x8) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r0, 0xc058534b, &(0x7f0000000000)) 14:36:00 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000400)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-serpent-sse2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = accept$alg(r0, 0x0, 0x0) sendto(r1, &(0x7f0000000080)="3a5753f1b260d7aeae1fcc9bdc0ce301262ed6a3f32c23b5bd332923bba0916bf4da58820251baa0fac400d8ccaa7790e6ac9c2b9953b2036907ac205eba27b449ea35e5dd248c58bd44701eed02fd8a36a7688bed69bf2573108f72122b4de877c8e1c0739e7e4523c7c0680000008000000000f96c57f61020c28bd65eba7b2bd53a8658f504b465ba8871636124a4a0367c5b8d9682c8a4a3927158e4cfeaa5879f0a8c2ee4f22da7a66e5ca75026c251be72407bb95b19e5c5380a1d3d9bfa6b5103c8ee61ff5893c3d110edd3fff224a34f53", 0xd5, 0x800000000000000, 0x0, 0x0) recvmmsg(r1, &(0x7f0000000040)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0x7ffff000}], 0x1}}], 0x1, 0x0, 0x0) 14:36:00 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xfc\xff\xff\xff\x00'}}}}, 0x68}}, 0x0) 14:36:00 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:36:00 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cachefiles\x00', 0x80002, 0x0) setsockopt$inet_sctp6_SCTP_HMAC_IDENT(r2, 0x84, 0x16, &(0x7f0000000080)={0x8, [0x9, 0x2cf1, 0x3f, 0x3, 0x100000000, 0x8000, 0x86, 0x270682b1]}, 0x14) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="01000080"], 0x0, 0x0, 0x0}) syz_genetlink_get_family_id$ipvs(&(0x7f0000000100)='IPVS\x00') socket(0x5, 0x80000, 0x2) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:36:00 executing program 2: syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/net\x00') syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/net\x00') r0 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/mixer\x00', 0x10800, 0x0) r1 = syz_open_dev$amidi(&(0x7f0000000080)='/dev/amidi#\x00', 0x4, 0x40000) ioctl$VIDIOC_DQBUF(r0, 0xc0585611, &(0x7f0000000100)={0x3f, 0xf, 0x4, 0x40100, {0x0, 0x2710}, {0x3, 0x0, 0x4, 0x0, 0xaf, 0x5, "ad803c85"}, 0x100, 0x40cc4275facb9fc3, @fd=r1, 0x4}) close(r0) setsockopt$MISDN_TIME_STAMP(r1, 0x0, 0x1, &(0x7f0000000180), 0x4) [ 2767.126141] binder: 5074:5075 unknown command 0 [ 2767.143319] binder: 5081:5082 unknown command -2147483647 14:36:00 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0e\x00'}}}}, 0x68}}, 0x0) [ 2767.186850] binder: 5074:5075 ioctl c0306201 20000600 returned -22 [ 2767.215730] binder: 5081:5082 ioctl c0306201 20000000 returned -22 14:36:00 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x763044000000000, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:36:00 executing program 2: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0xa040, 0x0) write$P9_RRENAMEAT(r0, &(0x7f0000000080)={0x7, 0x4b, 0x2}, 0x7) syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/net\x00') syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/net\x00') syz_open_dev$sndpcmp(&(0x7f0000000100)='/dev/snd/pcmC#D#p\x00', 0x7, 0x185000) ioctl$SCSI_IOCTL_DOORUNLOCK(r0, 0x5381) 14:36:00 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = socket(0x840000000002, 0x3, 0xff) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040)='syz_tun\x00', 0x3cd) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000140)=0x32, 0x4) connect$inet(r0, &(0x7f0000593000)={0x2, 0x0, @broadcast}, 0x10) write$binfmt_elf64(r1, &(0x7f0000000180)={{0x7f, 0x45, 0x4c, 0x46, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40}, [{}]}, 0x78) [ 2767.325099] binder_alloc: binder_alloc_mmap_handler: 5081 20001000-20004000 already mapped failed -16 [ 2767.359868] binder: 5094:5095 unknown command 0 [ 2767.408340] binder: 5094:5095 ioctl c0306201 20000600 returned -22 [ 2767.445310] binder: 5081:5087 unknown command -2147483647 14:36:00 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0f\x00'}}}}, 0x68}}, 0x0) [ 2767.473301] binder: BINDER_SET_CONTEXT_MGR already set 14:36:00 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7400, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 2767.534378] binder: 5081:5087 ioctl c0306201 20000000 returned -22 [ 2767.558183] binder: 5081:5082 ioctl 40046207 0 returned -16 [ 2767.590694] binder: release 5081:5082 transaction 9061 out, still active [ 2767.612869] binder: undelivered TRANSACTION_COMPLETE [ 2767.614077] binder: 5113:5114 unknown command 0 14:36:00 executing program 4: r0 = syz_open_dev$sndseq(&(0x7f0000042000)='/dev/snd/seq\x00', 0x0, 0x0) arch_prctl$ARCH_MAP_VDSO_64(0x2003, 0x100000001) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r0, 0xc058534b, &(0x7f0000000000)) 14:36:00 executing program 2: syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/net\x00') r0 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dlm_plock\x00', 0x0, 0x0) setsockopt$inet_opts(r0, 0x0, 0xd, &(0x7f0000000100)="a40ddc52bac287a8345dbd2304f037d333fa7104849306420cafdfe21c56373554e5af85701025c17852881472bb9ff496b76f45eb61d836a3bf211d929f1c331d9cd3a8424213efa9ebb89f22138c609d15bd7ddc32f5da22ca30b9cfce2aed9a4ef8fc00ee6332a37a9eee0f", 0x3d) syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/net\x00') [ 2767.643973] binder: send failed reply for transaction 9061, target dead [ 2767.678638] binder: 5113:5114 ioctl c0306201 20000600 returned -22 14:36:00 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r2 = syz_open_dev$adsp(&(0x7f0000000180)='/dev/adsp#\x00', 0xcd, 0x82740) ioctl$UFFDIO_ZEROPAGE(r2, 0xc020aa04, &(0x7f00000001c0)={{&(0x7f0000003000/0x2000)=nil, 0x2000}}) r3 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000100)='/dev/qat_adf_ctl\x00', 0x8400, 0x0) ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000140)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="00634040000000000000000000000000000000002000000000000000000000000000000000000000000000000000008d9d0000000000000000100000000000000000098e83818ac8624aae4ea82557fad965cbc3922b0cdbc4f038fbf442071a7fb76ef9f77f4878000000000000000000"], 0x0, 0x0, 0x0}) 14:36:00 executing program 3: r0 = socket$inet6(0xa, 0x3, 0x5) socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000002c0)={{{@in6, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast1, 0x0, 0x33}, 0x0, @in6=@loopback, 0x0, 0x0, 0x0, 0x90, 0x7}}, 0xe8) connect$inet6(r0, &(0x7f0000000100), 0x1c) 14:36:00 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03@\x00'}}}}, 0x68}}, 0x0) 14:36:00 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x7f\xff\xff\xff\x00'}}}}, 0x68}}, 0x0) 14:36:00 executing program 2: syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/net\x00') r0 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000080)='/proc/capi/capi20ncci\x00', 0x101000, 0x0) ioctl$KVM_SET_XCRS(r0, 0x4188aea7, &(0x7f0000000100)={0x8, 0x3, [{0x7fff, 0x0, 0x4}, {0x3, 0x0, 0xff}, {0xc820, 0x0, 0xcd}, {0x1, 0x0, 0x82}, {0x80, 0x0, 0x8000}, {0x1, 0x0, 0x3}, {0x8, 0x0, 0x5}, {0x1010000, 0x0, 0x20}]}) syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/net\x00') openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x2, 0x0) 14:36:00 executing program 3: socket$inet6(0xa, 0x80003, 0x800000000000006) r0 = socket$netlink(0x10, 0x3, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") poll(&(0x7f00000000c0)=[{r0, 0x2001}], 0x1, 0x80) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x48, 0x15, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f000001e3d8960f65b27ee8125f42360500000015739d53d5"]}, 0x48}}, 0x0) 14:36:00 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc63000000000000, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 2767.813483] QAT: Invalid ioctl [ 2767.830105] binder: 5126:5127 got new transaction with bad transaction stack, transaction 9063 has target 5126:0 [ 2767.917045] binder: 5136:5137 unknown command 0 [ 2767.937233] binder: 5126:5127 transaction failed 29201/-71, size 0-676675452928 line 2946 [ 2767.957319] binder: 5136:5137 ioctl c0306201 20000600 returned -22 14:36:00 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00'}}}}, 0x68}}, 0x0) [ 2767.988677] binder_alloc: binder_alloc_mmap_handler: 5126 20001000-20004000 already mapped failed -16 14:36:01 executing program 4: r0 = syz_open_dev$midi(&(0x7f0000000080)='/dev/midi#\x00', 0x30, 0x101100) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000000c0)={{0x7, 0x2}, 'port1\x00', 0x80, 0x4, 0x3, 0x6, 0xffffffffffffffec, 0x7f, 0x0, 0x0, 0x1, 0x7f}) r1 = syz_open_dev$sndseq(&(0x7f0000042000)='/dev/snd/seq\x00', 0x0, 0x1) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r1, 0xc058534b, &(0x7f0000000000)) 14:36:01 executing program 2: syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/net\x00') r0 = syz_open_dev$midi(&(0x7f0000000040)='/dev/midi#\x00', 0x5, 0x82002) getsockname$tipc(r0, &(0x7f0000000140)=@name, &(0x7f0000000100)=0x10) ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f0000000080)=0x0) syz_open_procfs$namespace(r1, &(0x7f0000000180)='ns/net\x00;9R)\xd4\xd3\x0e\xb7GBy%/\xefY\x02VL\x14\x89A\x9a\xb5\xc5\x03)\xa2G\xe9\x8cx9\xb0\xbe?by\xe2\xb1\xe7\x96hi\xdd\xa4\x18\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00') [ 2768.084804] binder: BINDER_SET_CONTEXT_MGR already set 14:36:01 executing program 3: socket$inet6(0xa, 0x80003, 0x800000000000006) r0 = socket$netlink(0x10, 0x3, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") poll(&(0x7f00000000c0)=[{r0, 0x2001}], 0x1, 0x80) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x48, 0x15, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f000001e3d8960f65b27ee8125f42360500000015739d53d5"]}, 0x48}}, 0x0) 14:36:01 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4c000000, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 2768.133932] binder: 5126:5127 ioctl 40046207 0 returned -16 [ 2768.161825] binder_alloc: 5126: binder_alloc_buf, no vma [ 2768.187502] binder: 5126:5155 transaction failed 29189/-3, size 0-0 line 3035 [ 2768.217934] binder: 5157:5159 unknown command 0 [ 2768.236344] binder: 5157:5159 ioctl c0306201 20000600 returned -22 [ 2768.254236] QAT: Invalid ioctl [ 2768.266535] binder: release 5126:5127 transaction 9063 out, still active [ 2768.273430] binder: undelivered TRANSACTION_COMPLETE 14:36:01 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) accept4$packet(0xffffffffffffff9c, &(0x7f0000000580)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f00000005c0)=0x14, 0x742631ccfe4daac1) bpf$PROG_LOAD(0x5, &(0x7f0000000a40)={0x1f, 0xb, &(0x7f0000000040)=@framed={{0x18, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x81}, [@generic={0x3, 0xfffffffffffffc00, 0x551, 0x2, 0xfffffffffffff801}, @alu={0x7, 0x10001, 0xc, 0x5, 0x2, 0x8, 0xfffffffffffffffc}, @exit, @initr0={0x18, 0x0, 0x0, 0x0, 0x1fffffffc00, 0x0, 0x0, 0x0, 0x2}, @generic={0x9, 0x6, 0xfd9c, 0x8, 0x100000001}, @generic={0x7fff, 0x5, 0x6, 0x3ff, 0x1}, @generic={0x9, 0x5, 0x6, 0x8}]}, &(0x7f0000000100)='GPL\x00', 0x1, 0x99, &(0x7f0000000140)=""/153, 0x41000, 0x1, [], r2, 0x3}, 0x48) mmap(&(0x7f0000002000/0x2000)=nil, 0x2000, 0x2000000, 0x20011, 0xffffffffffffff9c, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) pkey_alloc(0x0, 0x3) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0xfe7b, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:36:01 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x9e\xff\xff\xff\x00'}}}}, 0x68}}, 0x0) 14:36:01 executing program 2: perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x800000000000013, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="240000002600c1f30000000000007701000014fe0100000000008663c1b2827d7145ff10", 0x24) 14:36:01 executing program 3: socket$inet6(0xa, 0x80003, 0x800000000000006) r0 = socket$netlink(0x10, 0x3, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") poll(&(0x7f00000000c0)=[{r0, 0x2001}], 0x1, 0x80) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x48, 0x15, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f000001e3d8960f65b27ee8125f42360500000015739d53d5"]}, 0x48}}, 0x0) 14:36:01 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7000000, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 2768.314291] binder_release_work: 14 callbacks suppressed [ 2768.314298] binder: undelivered TRANSACTION_ERROR: 29201 [ 2768.350114] binder: undelivered TRANSACTION_ERROR: 29189 14:36:01 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) fcntl$F_SET_FILE_RW_HINT(r0, 0x40e, &(0x7f0000000080)) r1 = syz_open_dev$sndseq(&(0x7f0000042000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r1, 0xc058534b, &(0x7f0000000000)) [ 2768.397011] binder: send failed reply for transaction 9063, target dead [ 2768.423896] binder: 5166:5167 unknown command 0 [ 2768.428707] binder: 5166:5167 ioctl c0306201 20000600 returned -22 [ 2768.439007] binder_alloc: 5172: binder_alloc_buf, no vma 14:36:01 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6000000, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:36:01 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xf0\xff\xff\x00'}}}}, 0x68}}, 0x0) 14:36:01 executing program 3: socket$inet6(0xa, 0x80003, 0x800000000000006) r0 = socket$netlink(0x10, 0x3, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") poll(&(0x7f00000000c0)=[{r0, 0x2001}], 0x1, 0x80) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x48, 0x15, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f000001e3d8960f65b27ee8125f42360500000015739d53d5"]}, 0x48}}, 0x0) [ 2768.502403] binder: 5172:5173 transaction failed 29189/-3, size 0-0 line 3035 [ 2768.502420] binder_alloc: 5172: binder_alloc_buf, no vma 14:36:01 executing program 2: perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x800000000000013, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="240000002600c1f30000000000007701000014fe0100000000008663c1b2827d7145ff10", 0x24) [ 2768.587433] binder: 5182:5184 unknown command 0 [ 2768.624472] binder: 5182:5184 ioctl c0306201 20000600 returned -22 14:36:01 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xf0\x00'}}}}, 0x68}}, 0x0) 14:36:01 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400c630f, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 2768.703887] binder: 5172:5180 transaction failed 29189/-3, size 0-0 line 3035 [ 2768.786419] binder: BINDER_SET_CONTEXT_MGR already set [ 2768.791913] binder: 5172:5173 ioctl 40046207 0 returned -16 [ 2768.824542] binder: 5201:5202 unknown command 0 [ 2768.829448] binder: 5201:5202 ioctl c0306201 20000600 returned -22 [ 2768.843684] binder: 5172:5204 transaction failed 29189/-3, size 0-0 line 3035 [ 2768.880189] binder: 5172:5203 transaction failed 29189/-3, size 0-0 line 3035 [ 2768.895100] binder: undelivered TRANSACTION_ERROR: 29189 [ 2768.900858] binder: undelivered TRANSACTION_ERROR: 29189 14:36:01 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x0) r2 = syz_open_dev$usbmon(&(0x7f00000002c0)='/dev/usbmon#\x00', 0x8f, 0x0) r3 = geteuid() fstat(r1, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) mount$fuse(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='fuse\x00', 0x2000, &(0x7f0000000640)={{'fd', 0x3d, r2}, 0x2c, {'rootmode', 0x3d, 0xa000}, 0x2c, {'user_id', 0x3d, r3}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@max_read={'max_read', 0x3d, 0x3}}, {@blksize={'blksize'}}, {@max_read={'max_read', 0x3d, 0x750a18ff}}, {@max_read={'max_read', 0x3d, 0xfffffffffffffff9}}, {@default_permissions='default_permissions'}], [{@smackfsfloor={'smackfsfloor', 0x3d, '/dev/binder#\x00'}}, {@context={'context', 0x3d, 'staff_u'}}, {@defcontext={'defcontext', 0x3d, 'unconfined_u'}}, {@pcr={'pcr', 0x3d, 0x21}}, {@pcr={'pcr', 0x3d, 0x3b}}, {@dont_appraise='dont_appraise'}, {@fsname={'fsname', 0x3d, 'keyring/'}}]}}) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r2, 0x84, 0xa, &(0x7f0000000380)={0xffff, 0x8001, 0x204, 0x4, 0x1ff, 0x7fff, 0x0, 0x8, 0x0}, &(0x7f0000000400)=0x20) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(r2, 0x84, 0x7c, &(0x7f0000000440)={r5, 0x3, 0x5}, &(0x7f0000000480)=0x8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r6 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000040)='/proc/capi/capi20\x00', 0x28000, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffff9c, 0x84, 0x6f, &(0x7f0000000080)={0x0, 0xac, &(0x7f0000000100)=[@in6={0xa, 0x4e21, 0xc200, @mcast1, 0x158c}, @in={0x2, 0x4e21, @remote}, @in={0x2, 0x4e22, @loopback}, @in={0x2, 0x4e22, @rand_addr=0x6}, @in={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x24}}, @in={0x2, 0x4e23, @initdev={0xac, 0x1e, 0x1, 0x0}}, @in={0x2, 0x4e21, @broadcast}, @in={0x2, 0x4e24, @multicast1}, @in={0x2, 0x4e20, @multicast2}, @in={0x2, 0x4e21, @multicast1}]}, &(0x7f00000001c0)=0x10) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r6, 0x84, 0x7b, &(0x7f0000000200)={r7, 0x3ff}, 0x8) lseek(r2, 0x0, 0x2) 14:36:01 executing program 4: r0 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000140)='/dev/dlm_plock\x00', 0x400, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_INFO(r0, 0xc08c5334, &(0x7f0000000180)={0x1, 0x8, 0x6, 'queue1\x00', 0x81}) getsockopt$packet_buf(r0, 0x107, 0x2, &(0x7f0000000240)=""/156, &(0x7f0000000300)=0x9c) r1 = syz_open_dev$sndseq(&(0x7f0000042000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_DELETE_PORT(r1, 0x40a85321, &(0x7f0000000080)={{0x401, 0x81}, 'port1\x00', 0x91, 0x4, 0x8, 0x401, 0x6, 0xf41e, 0x4d37, 0x0, 0x1, 0x800}) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r1, 0xc08c5336, &(0x7f0000000340)={0x4ce2, 0x400, 0xfff, 'queue1\x00', 0x8}) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r1, 0xc058534b, &(0x7f0000000000)) 14:36:01 executing program 2: r0 = syz_open_pts(0xffffffffffffffff, 0x0) fcntl$lock(r0, 0x400000009, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x101000000}) flock(r0, 0x2) mknod(&(0x7f0000000200)='./file0\x00', 0x8007, 0x16ea) flock(r0, 0x2) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2, 0x10, r1, 0x0) flock(r0, 0x2) sendmsg(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="ff0086"], 0x3}, 0x0) 14:36:01 executing program 3: socket$inet6(0xa, 0x80003, 0x800000000000006) r0 = socket$netlink(0x10, 0x3, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") poll(&(0x7f00000000c0)=[{r0, 0x2001}], 0x1, 0x80) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x48, 0x15, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f000001e3d8960f65b27ee8125f42360500000015739d53d5"]}, 0x48}}, 0x0) 14:36:01 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\x9e\x00'}}}}, 0x68}}, 0x0) 14:36:01 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000000000000, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 2768.941128] binder: undelivered TRANSACTION_ERROR: 29189 [ 2768.957957] binder: undelivered TRANSACTION_ERROR: 29189 [ 2769.004328] binder: 5210:5212 unknown command 0 [ 2769.009138] binder: 5210:5212 ioctl c0306201 20000600 returned -22 14:36:02 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00`\x00'}}}}, 0x68}}, 0x0) 14:36:02 executing program 2: r0 = socket$kcm(0xa, 0x5, 0x0) sendmsg(r0, &(0x7f00000006c0)={&(0x7f0000000100)=@in={0x2, 0x0, @local={0xac, 0x98}}, 0xffd6, &(0x7f0000000640), 0x98, &(0x7f0000000180)=[{0x20}], 0x20}, 0x0) [ 2769.057909] binder: 5215:5218 got new transaction with bad transaction stack, transaction 9072 has target 5215:0 14:36:02 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x11634840, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:36:02 executing program 3: socket$inet6(0xa, 0x80003, 0x800000000000006) r0 = socket$netlink(0x10, 0x3, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") poll(&(0x7f00000000c0)=[{r0, 0x2001}], 0x1, 0x80) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x48, 0x15, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f000001e3d8960f65b27ee8125f42360500000015739d53d5"]}, 0x48}}, 0x0) [ 2769.115910] binder: 5215:5218 transaction failed 29201/-71, size 0-0 line 2946 [ 2769.177062] binder: 5229:5230 unknown command 0 [ 2769.190822] binder: BINDER_SET_CONTEXT_MGR already set [ 2769.212660] binder: 5229:5230 ioctl c0306201 20000600 returned -22 [ 2769.217660] binder: 5215:5222 ioctl 40046207 0 returned -16 14:36:02 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00'}}}}, 0x68}}, 0x0) [ 2769.243059] binder: 5215:5234 transaction failed 29189/-3, size 0-0 line 3035 14:36:02 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x500000000000000, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 2769.301380] binder: send failed reply for transaction 9072 to 5215:5218 14:36:02 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0xfffffffffffffffe) r1 = dup(0xffffffffffffffff) r2 = dup3(r0, r0, 0x80000) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000003000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f0000000080)="0f06360f01d466410f2ab5ffea0000460f00d266baf80cb8d4263f89ef66bafc0c66b8ed8466efc462b5ae64466036410f221df22e0f20c466baf80cb87c36bc8def66bafc0ced0fc7aa44a1fc75", 0x4e}], 0x1, 0x20, &(0x7f0000000180), 0x0) r3 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x802) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:36:02 executing program 4: r0 = syz_open_dev$sndseq(&(0x7f0000000080)='/dev/snd/seq\x00', 0x0, 0x1000000000000) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r0, 0xc058534b, &(0x7f0000000000)) 14:36:02 executing program 3: socket$inet6(0xa, 0x80003, 0x800000000000006) r0 = socket$netlink(0x10, 0x3, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") poll(&(0x7f00000000c0)=[{r0, 0x2001}], 0x1, 0x80) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x48, 0x15, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f000001e3d8960f65b27ee8125f42360500000015739d53d5"]}, 0x48}}, 0x0) 14:36:02 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xff\x00'}}}}, 0x68}}, 0x0) [ 2769.348580] binder: undelivered TRANSACTION_ERROR: 29189 [ 2769.382954] binder: undelivered TRANSACTION_ERROR: 29189 [ 2769.422859] binder: undelivered TRANSACTION_COMPLETE [ 2769.449728] binder_thread_write: 10 callbacks suppressed [ 2769.449738] binder: 5242:5248 BC_ACQUIRE_DONE u0000000000000000 no match [ 2769.475237] binder: undelivered TRANSACTION_ERROR: 29201 [ 2769.484402] binder: 5242:5248 unknown command 0 [ 2769.490306] binder: undelivered TRANSACTION_ERROR: 29189 14:36:02 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00'}}}}, 0x68}}, 0x0) 14:36:02 executing program 3: socket$inet6(0xa, 0x80003, 0x800000000000006) r0 = socket$netlink(0x10, 0x3, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x48, 0x15, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f000001e3d8960f65b27ee8125f42360500000015739d53d5"]}, 0x48}}, 0x0) [ 2769.493041] binder_alloc: binder_alloc_mmap_handler: 5250 20001000-20004000 already mapped failed -16 [ 2769.501523] binder: 5242:5248 ioctl c0306201 20000600 returned -22 14:36:02 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb63000000000000, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 2769.574059] binder: BINDER_SET_CONTEXT_MGR already set [ 2769.584004] binder: 5250:5251 ioctl 40046207 0 returned -16 [ 2769.646145] binder: 5263:5264 BC_ACQUIRE_DONE u0000000000000000 no match [ 2769.686510] binder: 5263:5264 unknown command 0 [ 2769.710219] binder: 5263:5264 ioctl c0306201 20000600 returned -22 14:36:02 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) finit_module(r0, &(0x7f0000000040)='/dev/binder#\x00', 0x3) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:36:02 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00'}}}}, 0x68}}, 0x0) 14:36:02 executing program 3: socket$inet6(0xa, 0x80003, 0x800000000000006) r0 = socket$netlink(0x10, 0x3, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x48, 0x15, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f000001e3d8960f65b27ee8125f42360500000015739d53d5"]}, 0x48}}, 0x0) 14:36:02 executing program 4: r0 = syz_open_dev$sndseq(&(0x7f0000042000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = syz_open_dev$vbi(&(0x7f0000000080)='/dev/vbi#\x00', 0x2, 0x2) setsockopt$RDS_GET_MR(r1, 0x114, 0x2, &(0x7f0000000180)={{&(0x7f00000000c0)=""/125, 0x7d}, &(0x7f0000000140), 0x4}, 0x20) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r0, 0xc058534b, &(0x7f0000000000)) write(r0, &(0x7f00000001c0)="b4c651454df8a8330d36d38211a46c31db7f1360412d3fb54fe8f2978dc06be51197aa482704b6f568ee0269cdc35cdb1fa336d34e7153", 0x37) 14:36:02 executing program 2: bpf$MAP_CREATE(0x2, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x5e, &(0x7f0000000280)='/group.stat\x00<#\xfbW*\x1f\x02\x94\xe6\xf3x\xb4\x1a\xd5KM\x9d\x9a\x1fc\xf8xZ\xd1\x88\xa7\xe1\xc8\x88u\xe0[\x18\xa4\xcb:\x9c\xd1-\xce\xa4@\xd8\x99\xc2,e+:G\x1bJ\x7f\xa2\xf3\xfd\xf6\xe04\xd8\x04\xe5\xf0\xdfK\x1d\xeeH;\x15v$\xc5\x9c\x01\x00\xe8\x9ej5|\x00', 0xffffffffffffffff}, 0x30) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x5, 0xffff, 0x3ff, 0xfffffffffffff2da, 0x0, 0x8, 0x124, 0x0, 0x4, 0x0, 0x9, 0x1, 0x1, 0x0, 0xfffffffffffffff7, 0xdb, 0x0, 0x0, 0x7, 0x0, 0x8, 0x0, 0x9, 0x7fff, 0x0, 0x9, 0x1, 0x6, 0x0, 0x0, 0x5b, 0x9, 0x5, 0x0, 0x0, 0x3, 0x0, 0x2, 0x1, @perf_bp={0x0}, 0x1144, 0x4, 0x9, 0x7, 0x62, 0xffffffffffffff52, 0x5}, r0, 0x0, 0xffffffffffffffff, 0xa) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x2400, 0x0) socketpair(0x3, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0xfffffffffffffffe, 0x0, &(0x7f0000000100)) socketpair(0x0, 0x0, 0x2, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000004c0)='/group.stat\x00<#\xfbW*\x1f\x02\x94\xe6\xf3x\xb4\x1a\xd5KM\x9d\x9a\x1fc\xf8xZ\xd1\x88\xa7\xe1\xc8\x88u\xe0[\x18\xa4\xcb:\x9c\xd1-\xce\xa4@\xd8\x99\xc2,e+:G\x1bJ\x7f\xa2\xf3\xfd\xf6\xe04\xd8\x04\xe5\xf0\xdfK\x1d\xeeH;\x15v$\xc5\x9c\x01\x00\xe8\x9ej5|\x00\x00\x00', 0x2761, 0x0) write$cgroup_int(r1, &(0x7f0000000080), 0x297ef) close(r1) ioctl$TUNATTACHFILTER(0xffffffffffffffff, 0x401054d5, 0x0) 14:36:02 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb63, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 2770.048783] binder: 5279:5280 BC_ACQUIRE_DONE u0000000000000000 no match [ 2770.050330] binder: 5281:5282 got new transaction with bad transaction stack, transaction 9078 has target 5281:0 14:36:03 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00`\x00'}}}}, 0x68}}, 0x0) 14:36:03 executing program 3: socket$inet6(0xa, 0x80003, 0x800000000000006) r0 = socket$netlink(0x10, 0x3, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x48, 0x15, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f000001e3d8960f65b27ee8125f42360500000015739d53d5"]}, 0x48}}, 0x0) [ 2770.101364] binder: 5279:5280 unknown command 0 [ 2770.119894] binder: 5279:5280 ioctl c0306201 20000600 returned -22 [ 2770.174470] binder: BINDER_SET_CONTEXT_MGR already set [ 2770.208876] binder: 5281:5289 ioctl 40046207 0 returned -16 14:36:03 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6c00, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:36:03 executing program 2: bpf$MAP_CREATE(0x2, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x5e, &(0x7f0000000280)='/group.stat\x00<#\xfbW*\x1f\x02\x94\xe6\xf3x\xb4\x1a\xd5KM\x9d\x9a\x1fc\xf8xZ\xd1\x88\xa7\xe1\xc8\x88u\xe0[\x18\xa4\xcb:\x9c\xd1-\xce\xa4@\xd8\x99\xc2,e+:G\x1bJ\x7f\xa2\xf3\xfd\xf6\xe04\xd8\x04\xe5\xf0\xdfK\x1d\xeeH;\x15v$\xc5\x9c\x01\x00\xe8\x9ej5|\x00', 0xffffffffffffffff}, 0x30) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x5, 0xffff, 0x3ff, 0xfffffffffffff2da, 0x0, 0x8, 0x124, 0x0, 0x4, 0x0, 0x9, 0x1, 0x1, 0x0, 0xfffffffffffffff7, 0xdb, 0x0, 0x0, 0x7, 0x0, 0x8, 0x0, 0x9, 0x7fff, 0x0, 0x9, 0x1, 0x6, 0x0, 0x0, 0x5b, 0x9, 0x5, 0x0, 0x0, 0x3, 0x0, 0x2, 0x1, @perf_bp={0x0}, 0x1144, 0x4, 0x9, 0x7, 0x62, 0xffffffffffffff52, 0x5}, r0, 0x0, 0xffffffffffffffff, 0xa) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x2400, 0x0) socketpair(0x3, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0xfffffffffffffffe, 0x0, &(0x7f0000000100)) socketpair(0x0, 0x0, 0x2, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000004c0)='/group.stat\x00<#\xfbW*\x1f\x02\x94\xe6\xf3x\xb4\x1a\xd5KM\x9d\x9a\x1fc\xf8xZ\xd1\x88\xa7\xe1\xc8\x88u\xe0[\x18\xa4\xcb:\x9c\xd1-\xce\xa4@\xd8\x99\xc2,e+:G\x1bJ\x7f\xa2\xf3\xfd\xf6\xe04\xd8\x04\xe5\xf0\xdfK\x1d\xeeH;\x15v$\xc5\x9c\x01\x00\xe8\x9ej5|\x00\x00\x00', 0x2761, 0x0) write$cgroup_int(r1, &(0x7f0000000080), 0x297ef) close(r1) ioctl$TUNATTACHFILTER(0xffffffffffffffff, 0x401054d5, 0x0) [ 2770.220628] binder_alloc_new_buf_locked: 4 callbacks suppressed [ 2770.220638] binder_alloc: 5281: binder_alloc_buf, no vma 14:36:03 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00'}}}}, 0x68}}, 0x0) 14:36:03 executing program 3: socket$inet6(0xa, 0x80003, 0x800000000000006) r0 = socket$netlink(0x10, 0x3, 0x4) socket$inet_udplite(0x2, 0x2, 0x88) poll(&(0x7f00000000c0)=[{r0, 0x2001}], 0x1, 0x80) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x48, 0x15, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f000001e3d8960f65b27ee8125f42360500000015739d53d5"]}, 0x48}}, 0x0) [ 2770.270902] binder: release 5281:5282 transaction 9078 out, still active [ 2770.286908] binder: undelivered TRANSACTION_COMPLETE [ 2770.303233] binder: 5298:5299 BC_ACQUIRE_DONE u0000000000000000 no match [ 2770.312966] binder: send failed reply for transaction 9078, target dead [ 2770.344379] binder: 5298:5299 unknown command 0 [ 2770.349135] binder: 5298:5299 ioctl c0306201 20000600 returned -22 14:36:03 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x800) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r2, 0x6, 0xd, &(0x7f0000000040)='vegas\x00', 0x6) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$VIDIOC_DBG_G_REGISTER(r2, 0xc0385650, &(0x7f0000000200)={{0x3, @addr=0x6}, 0x8, 0x401, 0x8000}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="00634040e435101ee55d8fa6bc7700b4a952cf4c1e843dba3a1e70d4d7ac573a7aed6910c452ead3cea0e76239a39a7524ea1ac07992eafe7e49c1fe5e7b2e88022e7992"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="00634040000000000000000000000000020000000000b568e9cb5993be8a53a42d00afde144cd094bf0000000000000000010000000000000000000000000000000000001dd84f644a3a019f3455f533a470f1c6ab1e37ee78d69b18dbc4f4aa2548f9278c9bef035a9d4761c02658fbe66161f210f6084da4a3e36af952a26681e9f5eb119df17dc55aaedd34314e73303e0fc6cf7fec0e8560dac0de53aea09365c1e557a0e080b8dc962ba47468043613cfe936b17c339b516b64c4e31a65bf4af1fe43c39c3b4ffe411d52cb6de22d05492ef9ff4e5b8f53601cd9233d7be6a4256d6abd89b295edee0a75c2567b022b97ea1180a3bf0343441e2e8f81980c28b6fd7f0440832e68be312c62d11240121d32"], 0x0, 0x0, 0x0}) 14:36:03 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x7f\xff\xff\xff\x00'}}}}, 0x68}}, 0x0) [ 2770.412237] binder: 5298:5299 BC_ACQUIRE_DONE u0000000000000000 no match [ 2770.435138] binder: 5298:5299 unknown command 0 [ 2770.450813] binder: 5309:5310 got transaction to invalid handle 14:36:03 executing program 2: bpf$MAP_CREATE(0x2, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x5e, &(0x7f0000000280)='/group.stat\x00<#\xfbW*\x1f\x02\x94\xe6\xf3x\xb4\x1a\xd5KM\x9d\x9a\x1fc\xf8xZ\xd1\x88\xa7\xe1\xc8\x88u\xe0[\x18\xa4\xcb:\x9c\xd1-\xce\xa4@\xd8\x99\xc2,e+:G\x1bJ\x7f\xa2\xf3\xfd\xf6\xe04\xd8\x04\xe5\xf0\xdfK\x1d\xeeH;\x15v$\xc5\x9c\x01\x00\xe8\x9ej5|\x00', 0xffffffffffffffff}, 0x30) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x5, 0xffff, 0x3ff, 0xfffffffffffff2da, 0x0, 0x8, 0x124, 0x0, 0x4, 0x0, 0x9, 0x1, 0x1, 0x0, 0xfffffffffffffff7, 0xdb, 0x0, 0x0, 0x7, 0x0, 0x8, 0x0, 0x9, 0x7fff, 0x0, 0x9, 0x1, 0x6, 0x0, 0x0, 0x5b, 0x9, 0x5, 0x0, 0x0, 0x3, 0x0, 0x2, 0x1, @perf_bp={0x0}, 0x1144, 0x4, 0x9, 0x7, 0x62, 0xffffffffffffff52, 0x5}, r0, 0x0, 0xffffffffffffffff, 0xa) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x2400, 0x0) socketpair(0x3, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0xfffffffffffffffe, 0x0, &(0x7f0000000100)) socketpair(0x0, 0x0, 0x2, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000004c0)='/group.stat\x00<#\xfbW*\x1f\x02\x94\xe6\xf3x\xb4\x1a\xd5KM\x9d\x9a\x1fc\xf8xZ\xd1\x88\xa7\xe1\xc8\x88u\xe0[\x18\xa4\xcb:\x9c\xd1-\xce\xa4@\xd8\x99\xc2,e+:G\x1bJ\x7f\xa2\xf3\xfd\xf6\xe04\xd8\x04\xe5\xf0\xdfK\x1d\xeeH;\x15v$\xc5\x9c\x01\x00\xe8\x9ej5|\x00\x00\x00', 0x2761, 0x0) write$cgroup_int(r1, &(0x7f0000000080), 0x297ef) close(r1) ioctl$TUNATTACHFILTER(0xffffffffffffffff, 0x401054d5, 0x0) [ 2770.469607] binder: 5298:5299 ioctl c0306201 20000600 returned -22 [ 2770.481665] binder_alloc: binder_alloc_mmap_handler: 5309 20001000-20004000 already mapped failed -16 14:36:03 executing program 3: socket$inet6(0xa, 0x80003, 0x800000000000006) r0 = socket$netlink(0x10, 0x3, 0x4) socket$inet_udplite(0x2, 0x2, 0x88) poll(&(0x7f00000000c0)=[{r0, 0x2001}], 0x1, 0x80) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x48, 0x15, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f000001e3d8960f65b27ee8125f42360500000015739d53d5"]}, 0x48}}, 0x0) [ 2770.548982] binder: BINDER_SET_CONTEXT_MGR already set [ 2770.573479] binder: 5309:5313 got transaction to invalid handle [ 2770.587021] binder: 5309:5310 ioctl 40046207 0 returned -16 [ 2770.616086] binder_alloc: 5309: binder_alloc_buf, no vma 14:36:03 executing program 4: openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20ncci\x00', 0x28000, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000042000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r0, 0xc058534b, &(0x7f00000000c0)={0x4}) openat$ipvs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioperm(0x8, 0xce0, 0x4) 14:36:03 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40086310, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:36:03 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xff\xff\xff\xf0\x00'}}}}, 0x68}}, 0x0) 14:36:03 executing program 2: r0 = socket$kcm(0xa, 0x5, 0x0) sendmsg(r0, &(0x7f00000006c0)={&(0x7f0000000100)=@in={0x2, 0x0, @local={0xac, 0x98}}, 0xffd6, &(0x7f0000000640), 0x98, &(0x7f0000000180)=[{0x20, 0x84, 0x7}], 0x20}, 0x0) 14:36:03 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) bind$inet(r1, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x10) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:36:03 executing program 3: socket$inet6(0xa, 0x80003, 0x800000000000006) r0 = socket$netlink(0x10, 0x3, 0x4) socket$inet_udplite(0x2, 0x2, 0x88) poll(&(0x7f00000000c0)=[{r0, 0x2001}], 0x1, 0x80) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x48, 0x15, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f000001e3d8960f65b27ee8125f42360500000015739d53d5"]}, 0x48}}, 0x0) [ 2770.734050] binder: 5328:5330 BC_ACQUIRE_DONE u0000000000000000 no match [ 2770.740988] binder: 5328:5330 unknown command 0 [ 2770.769764] binder: 5333:5335 got new transaction with bad transaction stack, transaction 9086 has target 5333:0 14:36:03 executing program 2: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r0) write$cgroup_subtree(0xffffffffffffffff, 0x0, 0xfffffffffffffe3b) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$cgroup_pid(r0, 0x0, 0x0) perf_event_open(&(0x7f0000000380)={0x2, 0x70, 0x8f, 0x80000201, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000300)='/group.stat\x00<#\xfbW*\x1f\x02\x94\xe6\xf3x\xb4\x1a\xd5KM\x9d\x9a\x1fc\xf8xZ\xd1\x88\xa7\xe1\xc8\x88u\xe0[\x18\xa4\xcb:\x9c\xd1-\xce\xa4@\xd8\x99\xc2,e+:G\x1bJ\x7f\xa2\xf3\xfd\xf6\xe04\xd8\x04\xe5\xf0\xdfK\x1d\xeeH;\x15v$\xc5\x9c\x01\x00\xe8\x9ej5|\x00\x00\x00', 0x2761, 0x0) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000600)={0xffffffffffffffff, 0x28}, 0x10) write$cgroup_int(r2, &(0x7f0000000080)=0xe000000, 0x297ef) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(0xffffffffffffffff, 0x40042409, 0x0) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f00000002c0)={r1, 0x0, 0x0}, 0x10) r3 = socket$kcm(0xa, 0x2, 0x11) sendmsg$kcm(r3, &(0x7f0000000480)={0x0, 0x0, 0x0}, 0x0) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)) 14:36:03 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0f\x00'}}}}, 0x68}}, 0x0) [ 2770.829312] binder: 5328:5330 ioctl c0306201 20000600 returned -22 [ 2770.836163] binder_alloc: binder_alloc_mmap_handler: 5333 20001000-20004000 already mapped failed -16 14:36:03 executing program 3: socket$inet6(0xa, 0x80003, 0x800000000000006) r0 = socket$netlink(0x10, 0x3, 0x4) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") poll(&(0x7f00000000c0)=[{r0, 0x2001}], 0x1, 0x80) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x48, 0x15, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f000001e3d8960f65b27ee8125f42360500000015739d53d5"]}, 0x48}}, 0x0) [ 2770.876297] binder: BINDER_SET_CONTEXT_MGR already set [ 2770.882407] binder: 5328:5330 BC_ACQUIRE_DONE u0000000000000000 no match [ 2770.913666] binder: 5333:5335 ioctl 40046207 0 returned -16 [ 2770.919111] binder: 5328:5330 unknown command 0 [ 2770.946675] binder: 5328:5330 ioctl c0306201 20000600 returned -22 [ 2770.962582] binder_alloc: 5333: binder_alloc_buf, no vma 14:36:03 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00'}}}}, 0x68}}, 0x0) 14:36:04 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe630c4000000000, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 2771.008711] binder_alloc: 5333: binder_alloc_buf, no vma [ 2771.013928] binder: send failed reply for transaction 9086 to 5333:5335 [ 2771.021594] binder: undelivered TRANSACTION_COMPLETE 14:36:04 executing program 3: socket$inet6(0xa, 0x80003, 0x800000000000006) r0 = socket$netlink(0x10, 0x3, 0x4) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") poll(&(0x7f00000000c0)=[{r0, 0x2001}], 0x1, 0x80) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x48, 0x15, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f000001e3d8960f65b27ee8125f42360500000015739d53d5"]}, 0x48}}, 0x0) [ 2771.111501] binder: 5360:5361 BC_ACQUIRE_DONE u0000000000000000 no match [ 2771.158065] binder: 5360:5361 unknown command 0 [ 2771.176640] binder: 5360:5361 ioctl c0306201 20000600 returned -22 14:36:04 executing program 4: r0 = syz_open_dev$sndseq(&(0x7f00000000c0)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r0, 0xc058534b, &(0x7f0000000180)={0xd014, 0x1f, 0x100000000}) 14:36:04 executing program 2: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r0) write$cgroup_subtree(0xffffffffffffffff, 0x0, 0xfffffffffffffe3b) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$cgroup_pid(r0, 0x0, 0x0) perf_event_open(&(0x7f0000000380)={0x2, 0x70, 0x8f, 0x80000201, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000300)='/group.stat\x00<#\xfbW*\x1f\x02\x94\xe6\xf3x\xb4\x1a\xd5KM\x9d\x9a\x1fc\xf8xZ\xd1\x88\xa7\xe1\xc8\x88u\xe0[\x18\xa4\xcb:\x9c\xd1-\xce\xa4@\xd8\x99\xc2,e+:G\x1bJ\x7f\xa2\xf3\xfd\xf6\xe04\xd8\x04\xe5\xf0\xdfK\x1d\xeeH;\x15v$\xc5\x9c\x01\x00\xe8\x9ej5|\x00\x00\x00', 0x2761, 0x0) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000600)={0xffffffffffffffff, 0x28}, 0x10) write$cgroup_int(r2, &(0x7f0000000080)=0xe000000, 0x297ef) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(0xffffffffffffffff, 0x40042409, 0x0) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f00000002c0)={r1, 0x0, 0x0}, 0x10) r3 = socket$kcm(0xa, 0x2, 0x11) sendmsg$kcm(r3, &(0x7f0000000480)={0x0, 0x0, 0x0}, 0x0) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)) 14:36:04 executing program 0: r0 = socket$nl_crypto(0x10, 0x3, 0x15) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r0, 0x10e, 0x1, &(0x7f0000000040)=0x8, 0x4) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r3 = syz_open_dev$vcsn(&(0x7f0000000080)='/dev/vcs#\x00', 0x8, 0x1) recvfrom$unix(r3, &(0x7f0000000100)=""/254, 0xfe, 0x40010103, &(0x7f0000000200)=@abs={0x0, 0x0, 0x4e23}, 0x6e) 14:36:04 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03@\x00'}}}}, 0x68}}, 0x0) 14:36:04 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000000, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:36:04 executing program 3: socket$inet6(0xa, 0x80003, 0x800000000000006) r0 = socket$netlink(0x10, 0x3, 0x4) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") poll(&(0x7f00000000c0)=[{r0, 0x2001}], 0x1, 0x80) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x48, 0x15, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f000001e3d8960f65b27ee8125f42360500000015739d53d5"]}, 0x48}}, 0x0) [ 2771.286586] binder: 5370:5371 BC_ACQUIRE_DONE u0000000000000000 no match [ 2771.314902] binder: 5370:5371 unknown command 0 [ 2771.319713] binder: 5370:5371 ioctl c0306201 20000600 returned -22 [ 2771.319938] binder: 5372:5375 got new transaction with bad transaction stack, transaction 9091 has target 5372:0 14:36:04 executing program 3: socket$inet6(0xa, 0x80003, 0x800000000000006) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") poll(&(0x7f00000000c0)=[{0xffffffffffffffff, 0x2001}], 0x1, 0x80) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x48, 0x15, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f000001e3d8960f65b27ee8125f42360500000015739d53d5"]}, 0x48}}, 0x0) [ 2771.382066] binder_alloc: binder_alloc_mmap_handler: 5372 20001000-20004000 already mapped failed -16 [ 2771.396020] binder: BINDER_SET_CONTEXT_MGR already set [ 2771.412871] binder_alloc: 5372: binder_alloc_buf, no vma 14:36:04 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa63084000000000, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 2771.440854] binder: 5372:5375 ioctl 40046207 0 returned -16 [ 2771.465647] binder_alloc: 5372: binder_alloc_buf, no vma 14:36:04 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00`\x00'}}}}, 0x68}}, 0x0) 14:36:04 executing program 2: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r0) write$cgroup_subtree(0xffffffffffffffff, 0x0, 0xfffffffffffffe3b) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$cgroup_pid(r0, 0x0, 0x0) perf_event_open(&(0x7f0000000380)={0x2, 0x70, 0x8f, 0x80000201, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000300)='/group.stat\x00<#\xfbW*\x1f\x02\x94\xe6\xf3x\xb4\x1a\xd5KM\x9d\x9a\x1fc\xf8xZ\xd1\x88\xa7\xe1\xc8\x88u\xe0[\x18\xa4\xcb:\x9c\xd1-\xce\xa4@\xd8\x99\xc2,e+:G\x1bJ\x7f\xa2\xf3\xfd\xf6\xe04\xd8\x04\xe5\xf0\xdfK\x1d\xeeH;\x15v$\xc5\x9c\x01\x00\xe8\x9ej5|\x00\x00\x00', 0x2761, 0x0) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000600)={0xffffffffffffffff, 0x28}, 0x10) write$cgroup_int(r2, &(0x7f0000000080)=0xe000000, 0x297ef) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(0xffffffffffffffff, 0x40042409, 0x0) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f00000002c0)={r1, 0x0, 0x0}, 0x10) r3 = socket$kcm(0xa, 0x2, 0x11) sendmsg$kcm(r3, &(0x7f0000000480)={0x0, 0x0, 0x0}, 0x0) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)) [ 2771.487670] binder: release 5372:5375 transaction 9091 out, still active [ 2771.501141] binder: 5391:5392 BC_ACQUIRE_DONE u0000000000000000 no match [ 2771.510137] binder: undelivered TRANSACTION_COMPLETE 14:36:04 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0) 14:36:04 executing program 4: r0 = syz_open_dev$sndseq(&(0x7f00000000c0)='/dev/snd/seq\x00', 0x0, 0x101240) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r0, 0xc058534b, &(0x7f0000000000)) [ 2771.544393] binder: send failed reply for transaction 9091, target dead [ 2771.560259] binder: 5391:5392 unknown command 0 [ 2771.581182] binder: 5391:5392 ioctl c0306201 20000600 returned -22 14:36:04 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xa1\x00'}}}}, 0x68}}, 0x0) [ 2771.624305] binder: 5391:5392 unknown command 0 [ 2771.639420] binder: 5403:5404 got new transaction with bad transaction stack, transaction 9096 has target 5403:0 [ 2771.652192] binder: 5391:5392 ioctl c0306201 20000600 returned -22 14:36:04 executing program 3: socket$inet6(0xa, 0x80003, 0x800000000000006) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") poll(&(0x7f00000000c0)=[{0xffffffffffffffff, 0x2001}], 0x1, 0x80) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x48, 0x15, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f000001e3d8960f65b27ee8125f42360500000015739d53d5"]}, 0x48}}, 0x0) [ 2771.715622] binder_alloc: binder_alloc_mmap_handler: 5403 20001000-20004000 already mapped failed -16 14:36:04 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 2771.759993] binder: BINDER_SET_CONTEXT_MGR already set 14:36:04 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xa1\xff\xff\xff\x00'}}}}, 0x68}}, 0x0) [ 2771.787343] binder: 5403:5404 ioctl 40046207 0 returned -16 [ 2771.798667] binder_alloc: 5403: binder_alloc_buf, no vma [ 2771.825623] binder: 5413:5414 unknown command 0 [ 2771.831764] binder_transaction: 13 callbacks suppressed 14:36:04 executing program 2: r0 = socket$inet_sctp(0x2, 0x800000000001, 0x84) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x20001000008912, &(0x7f0000000040)="0af51f023c123f3188a070") connect$inet(r0, &(0x7f0000f6fff0)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff}}, 0x10) listen(r0, 0x200000000200) r2 = accept(r0, 0x0, 0x0) getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(r2, 0x84, 0x6d, &(0x7f00000003c0)={0x0, 0x69, "5fbec90b927dc4cf556b775f2f83a28f0d891a7d7440575e83358086288421c29a1f346add8676b9092604b2fe0bb5fb9380d157cf7c647dc761bacbe2920a076e87068d80eb1270f50995857c4b7fcfa56acb5051ca17679341145c2dbe93635e176a8776e12ecaf9"}, 0x0) [ 2771.831779] binder: 5403:5407 transaction failed 29189/-3, size 0-0 line 3035 [ 2771.846181] binder_alloc: 5403: binder_alloc_buf, no vma [ 2771.863917] binder: 5413:5414 ioctl c0306201 20000600 returned -22 14:36:04 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:36:04 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\n\x00'}}}}, 0x68}}, 0x0) [ 2771.894129] binder: release 5403:5404 transaction 9096 out, still active [ 2771.903883] binder: undelivered TRANSACTION_COMPLETE [ 2771.910923] binder: 5403:5415 transaction failed 29189/-3, size 0-0 line 3035 [ 2771.933057] binder: send failed reply for transaction 9096, target dead 14:36:04 executing program 3: socket$inet6(0xa, 0x80003, 0x800000000000006) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") poll(&(0x7f00000000c0)=[{0xffffffffffffffff, 0x2001}], 0x1, 0x80) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x48, 0x15, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f000001e3d8960f65b27ee8125f42360500000015739d53d5"]}, 0x48}}, 0x0) [ 2771.991036] binder: 5424:5425 unknown command 0 14:36:04 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 2772.030993] binder: 5424:5425 ioctl c0306201 20000600 returned -22 [ 2772.050540] binder: 5424:5425 unknown command 0 14:36:05 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x004\x8c\x00'}}}}, 0x68}}, 0x0) [ 2772.077657] binder: 5424:5425 ioctl c0306201 20000600 returned -22 [ 2772.105554] binder: 5435:5436 got new transaction with bad transaction stack, transaction 9101 has target 5435:0 14:36:05 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40046304, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:36:05 executing program 4: r0 = syz_open_dev$sndseq(&(0x7f0000042000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r0, 0xc058534b, &(0x7f0000000000)) r1 = syz_open_dev$media(&(0x7f0000000080)='/dev/media#\x00', 0x10001, 0x0) ioctl$CAPI_MANUFACTURER_CMD(r1, 0xc0104320, &(0x7f00000001c0)={0x200, &(0x7f00000000c0)="e5fa1f52155d0ccd20104ac8f8d158fe16cc539f826597ecf4a638f8fa8049feed406128052fe71a7a84c636d3e8ac19b0ca49acdddfc31f428c068456b8052a47f5ccc64a7ae20f4330a71a32a3d5d94849a309caff4b0bfe7e7561518be9c35abc63238883e34ead9b5858c3508c9defbeb8f33e5bddcb92588ed87e6c698c03370e81b658d32cdb50fe412e894893f83ed016de4072ba1335f99046d89276f5d6e2697f3c9856bcd518d15bcc80f13da1a445dd53566521fb5c998fb62013604f13"}) [ 2772.146662] binder: 5435:5436 transaction failed 29201/-71, size 0-0 line 2946 [ 2772.186837] binder: 5440:5442 unknown command 0 [ 2772.188048] binder_alloc: binder_alloc_mmap_handler: 5435 20001000-20004000 already mapped failed -16 [ 2772.197054] binder: 5440:5442 ioctl c0306201 20000600 returned -22 14:36:05 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") poll(&(0x7f00000000c0)=[{r0, 0x2001}], 0x1, 0x80) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x48, 0x15, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f000001e3d8960f65b27ee8125f42360500000015739d53d5"]}, 0x48}}, 0x0) [ 2772.242945] binder_alloc: 5435: binder_alloc_buf, no vma [ 2772.271739] binder: BINDER_SET_CONTEXT_MGR already set [ 2772.274196] binder: 5435:5439 transaction failed 29189/-3, size 0-0 line 3035 14:36:05 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00'}}}}, 0x68}}, 0x0) 14:36:05 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1200, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 2772.367975] binder: 5435:5436 ioctl 40046207 0 returned -16 [ 2772.367992] binder: release 5435:5436 transaction 9101 out, still active [ 2772.382763] binder: undelivered TRANSACTION_COMPLETE [ 2772.389800] binder: 5452:5454 unknown command 0 [ 2772.400764] binder: send failed reply for transaction 9101, target dead [ 2772.411406] binder: 5452:5454 ioctl c0306201 20000600 returned -22 14:36:05 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") poll(&(0x7f00000000c0)=[{r0, 0x2001}], 0x1, 0x80) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x48, 0x15, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f000001e3d8960f65b27ee8125f42360500000015739d53d5"]}, 0x48}}, 0x0) 14:36:05 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bc070") syz_emit_ethernet(0x2e, &(0x7f0000000000)={@broadcast=[0xff, 0xe0], @remote, [{}], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}, @multicast1}, @udp={0x0, 0x0, 0x8}}}}}, 0x0) 14:36:05 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00'}}}}, 0x68}}, 0x0) 14:36:05 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf630c4000000000, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:36:05 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r2 = syz_open_dev$mouse(&(0x7f0000000040)='/dev/input/mouse#\x00', 0x8, 0x2) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000100)={{{@in=@remote, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@initdev}, 0x0, @in=@broadcast}}, &(0x7f0000000080)=0xe8) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000200)={0x0, 0x0, 0x0}, &(0x7f0000000240)=0xc) write$FUSE_CREATE_OPEN(r2, &(0x7f0000000280)={0xa0, 0xfffffffffffffffe, 0x1, {{0x3, 0x3, 0x2, 0x8, 0x0, 0x1, {0x6, 0x1, 0x80000000, 0x68, 0x3, 0xac6e, 0xc24d, 0x9, 0x1ff, 0x8001, 0x5, r3, r4, 0x6, 0x7ff}}, {0x0, 0x2}}}, 0xa0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:36:05 executing program 4: ftruncate(0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='clear_refs\x00') r1 = syz_open_procfs(0x0, &(0x7f0000000200)='loginuid\x009\xda\xd3\xc4D\xdeJ5\xf0\xfd\"=\xb6\xaa\x1e/\xddc\xc9\xf3_8\x9eFi\xe0\xafe\"\xc2%\xbb\xb6E\xae\x9e\x0fF\xc8|\xd4M\xb4\x91\x9c\x1a4\xab\x1d\x00\xbbAW\xf7\x9b#\x91.\x9b\x96Vn\xbf#a\x8d\xfd\xd31\xfc\xac\xfe\xcc\xdb\x93\x89t\xf4\x8dB\fI\xe5\xb3\x7f\x94\xbd\xb6Q\xb9\xc1\x02e\x904\xf4\x19/') sendfile(r0, r1, 0x0, 0x1) 14:36:05 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") poll(&(0x7f00000000c0)=[{r0, 0x2001}], 0x1, 0x80) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x48, 0x15, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f000001e3d8960f65b27ee8125f42360500000015739d53d5"]}, 0x48}}, 0x0) [ 2772.715097] binder: 5471:5472 unknown command 0 [ 2772.733967] binder: 5471:5472 ioctl c0306201 20000600 returned -22 [ 2772.750474] binder: 5475:5476 got new transaction with bad transaction stack, transaction 9105 has target 5475:0 14:36:05 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00'}}}}, 0x68}}, 0x0) 14:36:05 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6c000000, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 2772.778933] binder: 5475:5476 transaction failed 29201/-71, size 0-0 line 2946 [ 2772.808936] binder_alloc: binder_alloc_mmap_handler: 5475 20001000-20004000 already mapped failed -16 14:36:05 executing program 3: socket$inet6(0xa, 0x0, 0x800000000000006) r0 = socket$netlink(0x10, 0x3, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") poll(&(0x7f00000000c0)=[{r0, 0x2001}], 0x1, 0x80) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x48, 0x15, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f000001e3d8960f65b27ee8125f42360500000015739d53d5"]}, 0x48}}, 0x0) 14:36:05 executing program 2: r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f00000000c0)=@req3={0x10000, 0x100000001, 0x10000, 0x1}, 0x1c) sendmmsg(r0, &(0x7f0000000140)=[{{&(0x7f0000000300)=@nfc={0x27, 0x1}, 0x80, 0x0}}, {{&(0x7f0000000280)=@in6={0xa, 0x0, 0x4, @loopback}, 0x80, 0x0}}], 0x2, 0x0) [ 2772.844184] binder: 5486:5487 unknown command 0 [ 2772.851846] binder: BINDER_SET_CONTEXT_MGR already set [ 2772.873849] binder: 5486:5487 ioctl c0306201 20000600 returned -22 [ 2772.887548] binder: 5475:5476 ioctl 40046207 0 returned -16 14:36:05 executing program 4: creat(&(0x7f0000000040)='./file0\x00', 0x0) socket$inet(0x2, 0x2, 0x0) clone(0x13102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x2a) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x4, 0x36}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 2772.920800] binder_alloc: 5475: binder_alloc_buf, no vma [ 2772.952290] binder: send failed reply for transaction 9105 to 5475:5476 [ 2772.962730] binder: 5475:5484 transaction failed 29189/-3, size 0-0 line 3035 14:36:05 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0e\x00'}}}}, 0x68}}, 0x0) [ 2772.974038] binder: undelivered TRANSACTION_COMPLETE 14:36:05 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1634040, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:36:06 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000240)='/dev/dri/card#\x00', 0x0, 0x0) socketpair$unix(0x1, 0x20000000000005, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$DRM_IOCTL_GET_MAGIC(r0, 0x80046402, 0x0) 14:36:06 executing program 3: socket$inet6(0xa, 0x0, 0x800000000000006) r0 = socket$netlink(0x10, 0x3, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") poll(&(0x7f00000000c0)=[{r0, 0x2001}], 0x1, 0x80) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x48, 0x15, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f000001e3d8960f65b27ee8125f42360500000015739d53d5"]}, 0x48}}, 0x0) [ 2773.071880] binder: 5508:5509 unknown command 0 14:36:06 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x8000004000) r1 = syz_open_dev$binder(0x0, 0x0, 0x40) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000dd8acddd000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) r2 = accept(0xffffffffffffff9c, &(0x7f0000000080)=@can, &(0x7f0000000100)=0x80) getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f0000000140)={0x0, @local, @multicast1}, &(0x7f0000000180)=0xc) setsockopt$inet6_mreq(r2, 0x29, 0x1f, &(0x7f00000001c0)={@local, r3}, 0x14) [ 2773.115228] binder: 5508:5509 ioctl c0306201 20000600 returned -22 14:36:06 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00'}}}}, 0x68}}, 0x0) 14:36:06 executing program 2: getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, 0x0, &(0x7f0000000440)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x2) r0 = socket$inet6_udp(0xa, 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_inet6_SIOCSIFADDR(r0, 0x89a1, &(0x7f00000000c0)={@local={0xfe, 0x80, [0x600, 0x3ef, 0x0, 0x3f00000000000000, 0x100000000000000, 0x0, 0x1103, 0x0, 0x0, 0x0, 0x0, 0x6]}}) ioctl$sock_inet6_SIOCADDRT(r0, 0x89a0, &(0x7f0000000100)={@local={0xfe, 0x80, [0x0, 0xfeff0000]}, @empty, @loopback}) ioctl$UI_DEV_DESTROY(0xffffffffffffffff, 0x5502) prctl$PR_CAP_AMBIENT(0x2f, 0x0, 0x1c) r1 = inotify_init() inotify_add_watch(r1, &(0x7f0000000080)='.\x00', 0xfe) write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000000480)=ANY=[], 0x2e7) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f00000001c0), 0xa198) getpeername$packet(0xffffffffffffff9c, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) ioctl$DRM_IOCTL_RES_CTX(r2, 0xc0106426, &(0x7f0000000200)={0x0, 0x0}) r3 = syz_open_procfs(0x0, &(0x7f00000002c0)='cpuset\x00') preadv(r3, &(0x7f00000017c0), 0x1a1, 0x0) mknod(&(0x7f0000000300)='./file0\x00', 0x80, 0x4) lseek(0xffffffffffffffff, 0x0, 0x4) [ 2773.155848] binder: 5508:5509 unknown command 0 [ 2773.160681] binder: 5508:5509 ioctl c0306201 20000600 returned -22 [ 2773.180250] binder_alloc: binder_alloc_mmap_handler: 5517 20001000-20004000 already mapped failed -16 14:36:06 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x500, 0x0, 0x0}) [ 2773.228839] binder: BINDER_SET_CONTEXT_MGR already set [ 2773.245284] binder: 5517:5519 ioctl 40046207 0 returned -16 14:36:06 executing program 3: socket$inet6(0xa, 0x0, 0x800000000000006) r0 = socket$netlink(0x10, 0x3, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") poll(&(0x7f00000000c0)=[{r0, 0x2001}], 0x1, 0x80) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x48, 0x15, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f000001e3d8960f65b27ee8125f42360500000015739d53d5"]}, 0x48}}, 0x0) 14:36:06 executing program 4: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vhost-net\x00', 0x2, 0x0) socketpair$unix(0x1, 0x200000003, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) dup2(r1, r0) [ 2773.296623] binder: 5530:5532 unknown command 0 [ 2773.302819] binder: 5530:5532 ioctl c0306201 20000600 returned -22 14:36:06 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008aba5d052f0537385900cf4747e3bcca2ab45e2ebf2fedcbbadb815c81843f6f3aa7a4de890433cfe0873d1d4b5fd6abaca67d825c5e74f23e5306a8f26c"], 0x0, 0x0, 0x0}) 14:36:06 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x300, 0x0, 0x0}) 14:36:06 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\x9e\x00'}}}}, 0x68}}, 0x0) [ 2773.461601] binder: 5543:5546 got new transaction with bad transaction stack, transaction 9110 has target 5543:0 [ 2773.462404] binder: 5547:5548 unknown command 0 14:36:06 executing program 3: socket$inet6(0xa, 0x80003, 0x0) r0 = socket$netlink(0x10, 0x3, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") poll(&(0x7f00000000c0)=[{r0, 0x2001}], 0x1, 0x80) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x48, 0x15, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f000001e3d8960f65b27ee8125f42360500000015739d53d5"]}, 0x48}}, 0x0) [ 2773.510830] binder: 5543:5546 transaction failed 29201/-71, size 0-0 line 2946 [ 2773.548637] binder: 5547:5548 ioctl c0306201 20000600 returned -22 14:36:06 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\n\x00'}}}}, 0x68}}, 0x0) [ 2773.569415] binder_alloc: binder_alloc_mmap_handler: 5543 20001000-20004000 already mapped failed -16 [ 2773.580798] binder: 5547:5548 unknown command 0 [ 2773.597830] binder: 5547:5548 ioctl c0306201 20000600 returned -22 [ 2773.605958] binder: BINDER_SET_CONTEXT_MGR already set [ 2773.638378] binder: 5543:5546 ioctl 40046207 0 returned -16 [ 2773.673167] binder: release 5543:5546 transaction 9110 out, still active 14:36:06 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2000000000000000, 0x0, 0x0}) [ 2773.692102] binder: undelivered TRANSACTION_COMPLETE [ 2773.712150] binder_release_work: 20 callbacks suppressed [ 2773.712156] binder: undelivered TRANSACTION_ERROR: 29201 14:36:06 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00'}}}}, 0x68}}, 0x0) 14:36:06 executing program 3: socket$inet6(0xa, 0x80003, 0x0) r0 = socket$netlink(0x10, 0x3, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") poll(&(0x7f00000000c0)=[{r0, 0x2001}], 0x1, 0x80) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x48, 0x15, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f000001e3d8960f65b27ee8125f42360500000015739d53d5"]}, 0x48}}, 0x0) [ 2773.741838] binder: send failed reply for transaction 9110, target dead [ 2773.750113] binder: 5564:5565 unknown command 0 [ 2773.778659] binder: 5564:5565 ioctl c0306201 20000600 returned -22 [ 2773.819792] binder: 5564:5565 unknown command 0 [ 2773.845244] binder: 5564:5565 ioctl c0306201 20000600 returned -22 14:36:07 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bind$alg(r0, &(0x7f0000000400)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-serpent-sse2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) sendto(r1, &(0x7f0000001640)="3a5753f1b260d7aeae1fcc9bdc0ce301262ed6a3f32c23b5bd332923bba0916bf4da58820251bac3a0fac400d8ccaa7790e6ac9c2b9953b2036907ac205eba27b449ea35e5dd248c58bd44701eed02fd8a36a7688bed69bf2573108f72122b4de877c8e1c0739e7e4523c7c0683f0b7184b014a148f96c57f61020c28bd65eba", 0x80, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000000040)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0x7ffff000}], 0x1}}], 0x1, 0x0, 0x0) 14:36:07 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="0063c040"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:36:07 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xa000000, 0x0, 0x0}) 14:36:07 executing program 3: socket$inet6(0xa, 0x80003, 0x0) r0 = socket$netlink(0x10, 0x3, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") poll(&(0x7f00000000c0)=[{r0, 0x2001}], 0x1, 0x80) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x48, 0x15, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f000001e3d8960f65b27ee8125f42360500000015739d53d5"]}, 0x48}}, 0x0) 14:36:07 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00'}}}}, 0x68}}, 0x0) 14:36:07 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000001340)=@broute={'broute\x00', 0x20, 0x3, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200004c0], 0x0, &(0x7f00000003c0)}, 0x78) [ 2774.329998] binder: 5584:5593 unknown command 0 [ 2774.336251] binder: 5585:5587 unknown command 1086350080 [ 2774.343576] binder: 5584:5593 ioctl c0306201 20000600 returned -22 [ 2774.364905] binder: 5585:5587 ioctl c0306201 20000000 returned -22 14:36:07 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x1163484000000000, 0x0, 0x0}) [ 2774.374756] kernel msg: ebtables bug: please report to author: Entries_size never zero 14:36:07 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xa1\x00'}}}}, 0x68}}, 0x0) [ 2774.402114] binder_alloc: binder_alloc_mmap_handler: 5585 20001000-20004000 already mapped failed -16 14:36:07 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bind$alg(r0, &(0x7f0000000400)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-serpent-sse2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) sendto(r1, &(0x7f0000001640)="3a5753f1b260d7aeae1fcc9bdc0ce301262ed6a3f32c23b5bd332923bba0916bf4da58820251bac3a0fac400d8ccaa7790e6ac9c2b9953b2036907ac205eba27b449ea35e5dd248c58bd44701eed02fd8a36a7688bed69bf2573108f72122b4de877c8e1c0739e7e4523c7c0683f0b7184b014a148f96c57f61020c28bd65eba", 0x80, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000000040)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0x7ffff000}], 0x1}}], 0x1, 0x0, 0x0) 14:36:07 executing program 4: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='oom_adj\x00') perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='projid_map\x00') sendfile(r0, r1, 0x0, 0x7fc) [ 2774.447011] binder: BINDER_SET_CONTEXT_MGR already set [ 2774.465233] binder_thread_write: 16 callbacks suppressed [ 2774.465244] binder: 5605:5606 BC_ACQUIRE_DONE u0000000000000000 no match 14:36:07 executing program 3: socket$inet6(0xa, 0x80003, 0x800000000000006) r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") poll(&(0x7f00000000c0)=[{r0, 0x2001}], 0x1, 0x80) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x48, 0x15, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f000001e3d8960f65b27ee8125f42360500000015739d53d5"]}, 0x48}}, 0x0) 14:36:07 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xf0\x00'}}}}, 0x68}}, 0x0) [ 2774.545846] binder: 5585:5587 ioctl 40046207 0 returned -16 [ 2774.560534] binder: 5605:5606 unknown command 0 [ 2774.586190] binder: 5585:5614 unknown command 1086350080 [ 2774.595214] binder: 5605:5606 ioctl c0306201 20000600 returned -22 [ 2774.609509] binder: release 5585:5600 transaction 9113 out, still active [ 2774.620245] binder: undelivered TRANSACTION_COMPLETE [ 2774.627507] binder: 5585:5614 ioctl c0306201 20000000 returned -22 14:36:07 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bind$alg(r0, &(0x7f0000000400)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-serpent-sse2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) sendto(r1, &(0x7f0000001640)="3a5753f1b260d7aeae1fcc9bdc0ce301262ed6a3f32c23b5bd332923bba0916bf4da58820251bac3a0fac400d8ccaa7790e6ac9c2b9953b2036907ac205eba27b449ea35e5dd248c58bd44701eed02fd8a36a7688bed69bf2573108f72122b4de877c8e1c0739e7e4523c7c0683f0b7184b014a148f96c57f61020c28bd65eba", 0x80, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000000040)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0x7ffff000}], 0x1}}], 0x1, 0x0, 0x0) [ 2774.636495] netlink: 48 bytes leftover after parsing attributes in process `syz-executor3'. [ 2774.650958] binder: send failed reply for transaction 9113, target dead 14:36:07 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) openat$udambuf(0xffffffffffffff9c, &(0x7f0000000040)='/dev/udmabuf\x00', 0x2) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:36:07 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x3000000, 0x0, 0x0}) 14:36:07 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x04\x00'}}}}, 0x68}}, 0x0) 14:36:07 executing program 3: socket$inet6(0xa, 0x80003, 0x800000000000006) r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") poll(&(0x7f00000000c0)=[{r0, 0x2001}], 0x1, 0x80) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x48, 0x15, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f000001e3d8960f65b27ee8125f42360500000015739d53d5"]}, 0x48}}, 0x0) [ 2774.751914] binder: 5625:5626 BC_ACQUIRE_DONE u0000000000000000 no match [ 2774.797180] binder: 5625:5626 unknown command 0 14:36:07 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\n\x00'}}}}, 0x68}}, 0x0) [ 2774.833349] binder: 5625:5626 ioctl c0306201 20000600 returned -22 [ 2774.836968] binder: 5635:5636 got new transaction with bad transaction stack, transaction 9115 has target 5635:0 [ 2774.855816] netlink: 48 bytes leftover after parsing attributes in process `syz-executor3'. [ 2774.872271] binder: 5625:5626 BC_ACQUIRE_DONE u0000000000000000 no match 14:36:07 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bind$alg(r0, &(0x7f0000000400)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-serpent-sse2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) sendto(r1, &(0x7f0000001640)="3a5753f1b260d7aeae1fcc9bdc0ce301262ed6a3f32c23b5bd332923bba0916bf4da58820251bac3a0fac400d8ccaa7790e6ac9c2b9953b2036907ac205eba27b449ea35e5dd248c58bd44701eed02fd8a36a7688bed69bf2573108f72122b4de877c8e1c0739e7e4523c7c0683f0b7184b014a148f96c57f61020c28bd65eba", 0x80, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000000040)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0x7ffff000}], 0x1}}], 0x1, 0x0, 0x0) [ 2774.879208] binder: 5635:5636 transaction failed 29201/-71, size 0-0 line 2946 14:36:07 executing program 3: socket$inet6(0xa, 0x80003, 0x800000000000006) r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") poll(&(0x7f00000000c0)=[{r0, 0x2001}], 0x1, 0x80) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x48, 0x15, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f000001e3d8960f65b27ee8125f42360500000015739d53d5"]}, 0x48}}, 0x0) [ 2774.921983] binder_alloc: binder_alloc_mmap_handler: 5635 20001000-20004000 already mapped failed -16 [ 2774.950274] binder: 5625:5626 unknown command 0 [ 2774.963670] binder: 5625:5626 ioctl c0306201 20000600 returned -22 14:36:07 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xf0\xff\xff\xff\x00'}}}}, 0x68}}, 0x0) 14:36:07 executing program 4: r0 = socket$alg(0x26, 0x5, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f000014f000)={&(0x7f00003c7ff4), 0xc, &(0x7f00000bfff0)={&(0x7f0000006440)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in6=@mcast1, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) bind$alg(0xffffffffffffffff, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000000040)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0x7ffff000}], 0x1}}], 0x1, 0x0, 0x0) [ 2774.994841] binder: BINDER_SET_CONTEXT_MGR already set [ 2775.012943] binder: 5635:5636 ioctl 40046207 0 returned -16 14:36:08 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x4c000000, 0x0, 0x0}) 14:36:08 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bind$alg(r0, &(0x7f0000000400)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-serpent-sse2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) recvmmsg(r1, &(0x7f0000000040)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0x7ffff000}], 0x1}}], 0x1, 0x0, 0x0) [ 2775.075737] binder: 5635:5654 transaction failed 29189/-3, size 0-0 line 3035 [ 2775.093353] netlink: 48 bytes leftover after parsing attributes in process `syz-executor3'. [ 2775.111902] binder: 5657:5658 BC_ACQUIRE_DONE u0000000000000000 no match 14:36:08 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xea\x00'}}}}, 0x68}}, 0x0) [ 2775.146737] binder: 5657:5658 unknown command 0 [ 2775.151474] binder: 5657:5658 ioctl c0306201 20000600 returned -22 [ 2775.168967] binder: 5635:5641 transaction failed 29189/-3, size 0-0 line 3035 [ 2775.206398] binder: undelivered TRANSACTION_ERROR: 29189 [ 2775.211919] binder: undelivered TRANSACTION_ERROR: 29189 [ 2775.245336] binder: send failed reply for transaction 9115 to 5635:5636 14:36:08 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bind$alg(r0, &(0x7f0000000400)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-serpent-sse2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) recvmmsg(r1, &(0x7f0000000040)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0x7ffff000}], 0x1}}], 0x1, 0x0, 0x0) 14:36:08 executing program 3: socket$inet6(0xa, 0x80003, 0x800000000000006) r0 = socket$netlink(0x10, 0x3, 0x4) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") poll(&(0x7f00000000c0)=[{r0, 0x2001}], 0x1, 0x80) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x48, 0x15, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f000001e3d8960f65b27ee8125f42360500000015739d53d5"]}, 0x48}}, 0x0) 14:36:08 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x004\x8c\x00'}}}}, 0x68}}, 0x0) 14:36:08 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x3) r2 = mmap$binder(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x1000004, 0x2010, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x1c, 0x0, &(0x7f00000001c0)=[@release={0x40046306, 0x2}, @increfs_done={0x40106308, r2, 0x3}], 0xd0, 0x0, &(0x7f0000000200)="16747fe21032cb254de8605dd1952013d8d11fe9a798452d8cbb987a79ddef1213df887dcca0810645ed9ac69516c92245bcdc1795db456310aeb7e7c12f1c8d8ec8205cdff9aa591b377c9087393b49bda8d55fd7785eb5b4607a6595cc38aa6dee4b9a042531510e80a905685b94550026bfc358c98f233639f2f66809273ce655bfa80da8e9d062d9719894237f6f16dd979f0adb2e9fe67f08142e7093ac86cc2c29b8bcb158768a4ad41fedbd9068df6143caea8d940917750c56a18bc26f549b8a259476e54f232f2ff7f0de0f"}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$tipc(0x1e, 0x7, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCGETLINKNAME(r3, 0x89e0, &(0x7f0000000140)={0x3, 0x3}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="acc51822e401f8aab7de43c3f950d844a6a1f6b59eb1490aa48728c40372c4f951477512cb9bb906201eb4d760375d723a1ea7b7c9b0dfbace7d780fd209b468ec31d25ded9d2a45bcf2dd811af597ccad5af2075f3f6bcf25fb42"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) socket$vsock_stream(0x28, 0x1, 0x0) 14:36:08 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x700, 0x0, 0x0}) 14:36:08 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f000014f000)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000006440)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in6=@mcast1, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) [ 2775.273707] binder: undelivered TRANSACTION_COMPLETE [ 2775.291383] binder: undelivered TRANSACTION_ERROR: 29201 [ 2775.308937] binder: undelivered TRANSACTION_ERROR: 29189 [ 2775.375870] binder: 5671:5672 BC_ACQUIRE_DONE u0000000000000000 no match [ 2775.382911] binder: 5671:5672 unknown command 0 [ 2775.396861] binder: 5671:5672 ioctl c0306201 20000600 returned -22 14:36:08 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bind$alg(r0, &(0x7f0000000400)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-serpent-sse2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) recvmmsg(r1, &(0x7f0000000040)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0x7ffff000}], 0x1}}], 0x1, 0x0, 0x0) [ 2775.424258] binder: 5676:5677 Release 1 refcount change on invalid ref 2 ret -22 [ 2775.454354] binder: 5676:5677 BC_INCREFS_DONE u0000000000000000 no match 14:36:08 executing program 3: socket$inet6(0xa, 0x80003, 0x800000000000006) r0 = socket$netlink(0x10, 0x3, 0x4) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") poll(&(0x7f00000000c0)=[{r0, 0x2001}], 0x1, 0x80) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x48, 0x15, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f000001e3d8960f65b27ee8125f42360500000015739d53d5"]}, 0x48}}, 0x0) 14:36:08 executing program 4: 14:36:08 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x4008630a, 0x0, 0x0}) 14:36:08 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x04\x00'}}}}, 0x68}}, 0x0) [ 2775.481498] binder: 5676:5677 unknown command 572048812 [ 2775.496951] binder: 5676:5677 ioctl c0306201 20000000 returned -22 14:36:08 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bind$alg(r0, &(0x7f0000000400)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-serpent-sse2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = accept$alg(r0, 0x0, 0x0) sendto(r1, &(0x7f0000001640)="3a5753f1b260d7aeae1fcc9bdc0ce301262ed6a3f32c23b5bd332923bba0916bf4da58820251bac3a0fac400d8ccaa7790e6ac9c2b9953b2036907ac205eba27b449ea35e5dd248c58bd44701eed02fd8a36a7688bed69bf2573108f72122b4de877c8e1c0739e7e4523c7c0683f0b7184b014a148f96c57f61020c28bd65eba", 0x80, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000000040)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0x7ffff000}], 0x1}}], 0x1, 0x0, 0x0) [ 2775.565835] binder_alloc_new_buf_locked: 2 callbacks suppressed [ 2775.565844] binder_alloc: 5676: binder_alloc_buf, no vma [ 2775.598588] binder: 5688:5696 BC_ACQUIRE_DONE u0000000000000000 no match [ 2775.626442] binder: 5688:5696 unknown command 0 [ 2775.641594] binder: BINDER_SET_CONTEXT_MGR already set [ 2775.644566] binder: 5676:5698 unknown command 572048812 [ 2775.647458] binder: 5688:5696 ioctl c0306201 20000600 returned -22 [ 2775.668721] binder: 5676:5695 Release 1 refcount change on invalid ref 2 ret -22 14:36:08 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00'}}}}, 0x68}}, 0x0) 14:36:08 executing program 3: socket$inet6(0xa, 0x80003, 0x800000000000006) r0 = socket$netlink(0x10, 0x3, 0x4) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") poll(&(0x7f00000000c0)=[{r0, 0x2001}], 0x1, 0x80) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x48, 0x15, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f000001e3d8960f65b27ee8125f42360500000015739d53d5"]}, 0x48}}, 0x0) [ 2775.672385] binder: 5676:5698 ioctl c0306201 20000000 returned -22 [ 2775.679340] binder: 5688:5696 BC_ACQUIRE_DONE u0000000000000000 no match [ 2775.711741] binder_alloc: 5676: binder_alloc_buf, no vma [ 2775.718920] binder: 5688:5696 unknown command 0 [ 2775.745877] binder: 5688:5696 ioctl c0306201 20000600 returned -22 [ 2775.758339] binder: undelivered TRANSACTION_ERROR: 29189 [ 2775.765596] binder: undelivered TRANSACTION_ERROR: 29189 [ 2775.775054] binder: 5676:5677 ioctl 40046207 0 returned -16 14:36:08 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bind$alg(r0, &(0x7f0000000400)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-serpent-sse2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = accept$alg(r0, 0x0, 0x0) sendto(r1, &(0x7f0000001640)="3a5753f1b260d7aeae1fcc9bdc0ce301262ed6a3f32c23b5bd332923bba0916bf4da58820251bac3a0fac400d8ccaa7790e6ac9c2b9953b2036907ac205eba27b449ea35e5dd248c58bd44701eed02fd8a36a7688bed69bf2573108f72122b4de877c8e1c0739e7e4523c7c0683f0b7184b014a148f96c57f61020c28bd65eba", 0x80, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000000040)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0x7ffff000}], 0x1}}], 0x1, 0x0, 0x0) [ 2775.809219] binder: 5676:5695 BC_INCREFS_DONE u0000000000000000 node 9119 cookie mismatch 0000000000000003 != 0000000000000000 14:36:08 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:36:08 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00'}}}}, 0x68}}, 0x0) 14:36:08 executing program 4: 14:36:08 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x7400000000000000, 0x0, 0x0}) 14:36:08 executing program 3: socket$inet6(0xa, 0x80003, 0x800000000000006) r0 = socket$netlink(0x10, 0x3, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x0, &(0x7f0000000100)="0af51f023c123f3188a070") poll(&(0x7f00000000c0)=[{r0, 0x2001}], 0x1, 0x80) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x48, 0x15, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f000001e3d8960f65b27ee8125f42360500000015739d53d5"]}, 0x48}}, 0x0) 14:36:08 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bind$alg(r0, &(0x7f0000000400)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-serpent-sse2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = accept$alg(r0, 0x0, 0x0) sendto(r1, &(0x7f0000001640)="3a5753f1b260d7aeae1fcc9bdc0ce301262ed6a3f32c23b5bd332923bba0916bf4da58820251bac3a0fac400d8ccaa7790e6ac9c2b9953b2036907ac205eba27b449ea35e5dd248c58bd44701eed02fd8a36a7688bed69bf2573108f72122b4de877c8e1c0739e7e4523c7c0683f0b7184b014a148f96c57f61020c28bd65eba", 0x80, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000000040)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0x7ffff000}], 0x1}}], 0x1, 0x0, 0x0) [ 2775.981902] binder: 5719:5720 BC_ACQUIRE_DONE u0000000000000000 no match [ 2776.004971] binder: 5719:5720 unknown command 0 [ 2776.014841] binder: 5721:5725 got new transaction with bad transaction stack, transaction 9123 has target 5721:0 [ 2776.024005] binder: 5719:5720 ioctl c0306201 20000600 returned -22 14:36:09 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xfc\x00'}}}}, 0x68}}, 0x0) 14:36:09 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bind$alg(r0, &(0x7f0000000400)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-serpent-sse2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) sendmsg$alg(0xffffffffffffffff, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) sendto(0xffffffffffffffff, &(0x7f0000001640)="3a5753f1b260d7aeae1fcc9bdc0ce301262ed6a3f32c23b5bd332923bba0916bf4da58820251bac3a0fac400d8ccaa7790e6ac9c2b9953b2036907ac205eba27b449ea35e5dd248c58bd44701eed02fd8a36a7688bed69bf2573108f72122b4de877c8e1c0739e7e4523c7c0683f0b7184b014a148f96c57f61020c28bd65eba", 0x80, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000000040)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0x7ffff000}], 0x1}}], 0x1, 0x0, 0x0) 14:36:09 executing program 4: [ 2776.046347] binder_alloc: binder_alloc_mmap_handler: 5721 20001000-20004000 already mapped failed -16 [ 2776.086395] binder: BINDER_SET_CONTEXT_MGR already set 14:36:09 executing program 3: socket$inet6(0xa, 0x80003, 0x800000000000006) r0 = socket$netlink(0x10, 0x3, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x0, &(0x7f0000000100)="0af51f023c123f3188a070") poll(&(0x7f00000000c0)=[{r0, 0x2001}], 0x1, 0x80) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x48, 0x15, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f000001e3d8960f65b27ee8125f42360500000015739d53d5"]}, 0x48}}, 0x0) 14:36:09 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x634040, 0x0, 0x0}) [ 2776.120868] binder: 5721:5728 ioctl 40046207 0 returned -16 [ 2776.152907] binder_alloc: 5721: binder_alloc_buf, no vma 14:36:09 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xea\x00'}}}}, 0x68}}, 0x0) [ 2776.203013] binder: release 5721:5725 transaction 9123 out, still active [ 2776.214156] binder: undelivered TRANSACTION_COMPLETE [ 2776.223501] binder_alloc: 5721: binder_alloc_buf, no vma [ 2776.235866] binder: undelivered TRANSACTION_ERROR: 29201 [ 2776.259965] binder: send failed reply for transaction 9123, target dead [ 2776.261139] binder: 5742:5743 BC_ACQUIRE_DONE u0000000000000000 no match [ 2776.295870] binder: undelivered TRANSACTION_ERROR: 29189 [ 2776.301556] binder: undelivered TRANSACTION_ERROR: 29189 [ 2776.329049] binder: 5742:5743 unknown command 0 14:36:09 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rfkill\x00', 0xab2fe0b43c8346b7, 0x0) ioctl$RTC_ALM_SET(r1, 0x40247007, &(0x7f0000000080)={0x2d, 0xe, 0x15, 0x1c, 0x4, 0x101, 0x1, 0x16a}) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$GIO_UNISCRNMAP(r1, 0x4b69, &(0x7f0000000100)=""/118) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:36:09 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bind$alg(r0, &(0x7f0000000400)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-serpent-sse2\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) sendto(r1, &(0x7f0000001640)="3a5753f1b260d7aeae1fcc9bdc0ce301262ed6a3f32c23b5bd332923bba0916bf4da58820251bac3a0fac400d8ccaa7790e6ac9c2b9953b2036907ac205eba27b449ea35e5dd248c58bd44701eed02fd8a36a7688bed69bf2573108f72122b4de877c8e1c0739e7e4523c7c0683f0b7184b014a148f96c57f61020c28bd65eba", 0x80, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000000040)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0x7ffff000}], 0x1}}], 0x1, 0x0, 0x0) 14:36:09 executing program 3: socket$inet6(0xa, 0x80003, 0x800000000000006) r0 = socket$netlink(0x10, 0x3, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x0, &(0x7f0000000100)="0af51f023c123f3188a070") poll(&(0x7f00000000c0)=[{r0, 0x2001}], 0x1, 0x80) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x48, 0x15, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f000001e3d8960f65b27ee8125f42360500000015739d53d5"]}, 0x48}}, 0x0) [ 2776.363407] binder: 5742:5743 ioctl c0306201 20000600 returned -22 14:36:09 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00`\x00'}}}}, 0x68}}, 0x0) [ 2776.408422] binder: 5742:5743 unknown command 0 [ 2776.413243] binder: 5742:5743 ioctl c0306201 20000600 returned -22 14:36:09 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) sendto(r1, &(0x7f0000001640)="3a5753f1b260d7aeae1fcc9bdc0ce301262ed6a3f32c23b5bd332923bba0916bf4da58820251bac3a0fac400d8ccaa7790e6ac9c2b9953b2036907ac205eba27b449ea35e5dd248c58bd44701eed02fd8a36a7688bed69bf2573108f72122b4de877c8e1c0739e7e4523c7c0683f0b7184b014a148f96c57f61020c28bd65eba", 0x80, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000000040)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0x7ffff000}], 0x1}}], 0x1, 0x0, 0x0) 14:36:09 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x600, 0x0, 0x0}) 14:36:09 executing program 4: [ 2776.452570] binder: 5754:5755 got new transaction with bad transaction stack, transaction 9128 has target 5754:0 14:36:09 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000400)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-serpent-sse2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) sendto(r1, &(0x7f0000001640)="3a5753f1b260d7aeae1fcc9bdc0ce301262ed6a3f32c23b5bd332923bba0916bf4da58820251bac3a0fac400d8ccaa7790e6ac9c2b9953b2036907ac205eba27b449ea35e5dd248c58bd44701eed02fd8a36a7688bed69bf2573108f72122b4de877c8e1c0739e7e4523c7c0683f0b7184b014a148f96c57f61020c28bd65eba", 0x80, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000000040)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0x7ffff000}], 0x1}}], 0x1, 0x0, 0x0) [ 2776.553954] binder: 5763:5766 unknown command 0 [ 2776.561621] binder_alloc: binder_alloc_mmap_handler: 5754 20001000-20004000 already mapped failed -16 [ 2776.571385] binder: 5763:5766 ioctl c0306201 20000600 returned -22 14:36:09 executing program 3: socket$inet6(0xa, 0x80003, 0x800000000000006) r0 = socket$netlink(0x10, 0x3, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, 0x0) poll(&(0x7f00000000c0)=[{r0, 0x2001}], 0x1, 0x80) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x48, 0x15, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f000001e3d8960f65b27ee8125f42360500000015739d53d5"]}, 0x48}}, 0x0) 14:36:09 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x7400, 0x0, 0x0}) 14:36:09 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\n\x00'}}}}, 0x68}}, 0x0) 14:36:09 executing program 2: bind$alg(0xffffffffffffffff, &(0x7f0000000400)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-serpent-sse2\x00'}, 0x58) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, 0x0, 0x0) r0 = accept$alg(0xffffffffffffffff, 0x0, 0x0) sendmsg$alg(r0, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) sendto(r0, &(0x7f0000001640)="3a5753f1b260d7aeae1fcc9bdc0ce301262ed6a3f32c23b5bd332923bba0916bf4da58820251bac3a0fac400d8ccaa7790e6ac9c2b9953b2036907ac205eba27b449ea35e5dd248c58bd44701eed02fd8a36a7688bed69bf2573108f72122b4de877c8e1c0739e7e4523c7c0683f0b7184b014a148f96c57f61020c28bd65eba", 0x80, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f0000000040)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0x7ffff000}], 0x1}}], 0x1, 0x0, 0x0) [ 2776.689602] binder: 5772:5775 unknown command 0 [ 2776.697599] binder: BINDER_SET_CONTEXT_MGR already set [ 2776.700589] binder: 5772:5775 ioctl c0306201 20000600 returned -22 [ 2776.710074] binder_alloc: 5754: binder_alloc_buf, no vma [ 2776.751151] binder: 5754:5755 ioctl 40046207 0 returned -16 [ 2776.788312] binder: release 5754:5755 transaction 9128 out, still active [ 2776.800612] binder: undelivered TRANSACTION_COMPLETE 14:36:09 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$amidi(&(0x7f0000000040)='/dev/amidi#\x00', 0x3436, 0x0) setsockopt$RXRPC_EXCLUSIVE_CONNECTION(r2, 0x110, 0x3) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) mmap$binder(&(0x7f0000003000/0x1000)=nil, 0x1000, 0x1000000, 0x1010, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="0063404000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) 14:36:09 executing program 4: 14:36:09 executing program 3: socket$inet6(0xa, 0x80003, 0x800000000000006) r0 = socket$netlink(0x10, 0x3, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, 0x0) poll(&(0x7f00000000c0)=[{r0, 0x2001}], 0x1, 0x80) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x48, 0x15, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f000001e3d8960f65b27ee8125f42360500000015739d53d5"]}, 0x48}}, 0x0) 14:36:09 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xa00, 0x0, 0x0}) 14:36:09 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00'}}}}, 0x68}}, 0x0) 14:36:09 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000000400)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-serpent-sse2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) sendto(r1, &(0x7f0000001640)="3a5753f1b260d7aeae1fcc9bdc0ce301262ed6a3f32c23b5bd332923bba0916bf4da58820251bac3a0fac400d8ccaa7790e6ac9c2b9953b2036907ac205eba27b449ea35e5dd248c58bd44701eed02fd8a36a7688bed69bf2573108f72122b4de877c8e1c0739e7e4523c7c0683f0b7184b014a148f96c57f61020c28bd65eba", 0x80, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000000040)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0x7ffff000}], 0x1}}], 0x1, 0x0, 0x0) [ 2776.830420] binder: send failed reply for transaction 9128, target dead [ 2776.886765] binder: 5790:5791 unknown command 0 [ 2776.902018] binder: 5790:5791 ioctl c0306201 20000600 returned -22 [ 2776.920958] binder: 5795:5796 got new transaction with bad transaction stack, transaction 9132 has target 5795:0 14:36:09 executing program 3: socket$inet6(0xa, 0x80003, 0x800000000000006) r0 = socket$netlink(0x10, 0x3, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, 0x0) poll(&(0x7f00000000c0)=[{r0, 0x2001}], 0x1, 0x80) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x48, 0x15, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f000001e3d8960f65b27ee8125f42360500000015739d53d5"]}, 0x48}}, 0x0) 14:36:09 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xf0\x00'}}}}, 0x68}}, 0x0) 14:36:09 executing program 4: [ 2776.957569] binder_transaction: 7 callbacks suppressed [ 2776.957586] binder: 5795:5796 transaction failed 29201/-71, size 0-0 line 2946 14:36:09 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x40406300, 0x0, 0x0}) [ 2777.018764] binder: BINDER_SET_CONTEXT_MGR already set 14:36:10 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, 0x0, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) sendto(r1, &(0x7f0000001640)="3a5753f1b260d7aeae1fcc9bdc0ce301262ed6a3f32c23b5bd332923bba0916bf4da58820251bac3a0fac400d8ccaa7790e6ac9c2b9953b2036907ac205eba27b449ea35e5dd248c58bd44701eed02fd8a36a7688bed69bf2573108f72122b4de877c8e1c0739e7e4523c7c0683f0b7184b014a148f96c57f61020c28bd65eba", 0x80, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000000040)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0x7ffff000}], 0x1}}], 0x1, 0x0, 0x0) [ 2777.057964] binder: 5795:5800 ioctl 40046207 0 returned -16 [ 2777.080558] binder_alloc: 5795: binder_alloc_buf, no vma [ 2777.105539] binder: 5795:5796 transaction failed 29189/-3, size 0-0 line 3035 [ 2777.123480] binder: 5810:5813 unknown command 0 [ 2777.141251] binder_alloc: 5795: binder_alloc_buf, no vma [ 2777.148224] binder: 5810:5813 ioctl c0306201 20000600 returned -22 14:36:10 executing program 3: socket$inet6(0xa, 0x80003, 0x800000000000006) r0 = socket$netlink(0x10, 0x3, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000100)) poll(&(0x7f00000000c0)=[{r0, 0x2001}], 0x1, 0x80) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x48, 0x15, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f000001e3d8960f65b27ee8125f42360500000015739d53d5"]}, 0x48}}, 0x0) [ 2777.163951] binder: release 5795:5796 transaction 9132 out, still active [ 2777.181287] binder: 5795:5811 transaction failed 29189/-3, size 0-0 line 3035 [ 2777.197007] binder: undelivered TRANSACTION_COMPLETE [ 2777.202223] binder: send failed reply for transaction 9132, target dead 14:36:10 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) openat$vimc0(0xffffffffffffff9c, &(0x7f0000000040)='/dev/video0\x00', 0x2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:36:10 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0f\x00'}}}}, 0x68}}, 0x0) 14:36:10 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x863104000000000, 0x0, 0x0}) 14:36:10 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000400)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-serpent-sse2\x00'}, 0x58) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, 0x0, 0x0) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) sendto(r1, &(0x7f0000001640)="3a5753f1b260d7aeae1fcc9bdc0ce301262ed6a3f32c23b5bd332923bba0916bf4da58820251bac3a0fac400d8ccaa7790e6ac9c2b9953b2036907ac205eba27b449ea35e5dd248c58bd44701eed02fd8a36a7688bed69bf2573108f72122b4de877c8e1c0739e7e4523c7c0683f0b7184b014a148f96c57f61020c28bd65eba", 0x80, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000000040)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0x7ffff000}], 0x1}}], 0x1, 0x0, 0x0) 14:36:10 executing program 4: 14:36:10 executing program 3: socket$inet6(0xa, 0x80003, 0x800000000000006) r0 = socket$netlink(0x10, 0x3, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000100)) poll(&(0x7f00000000c0)=[{r0, 0x2001}], 0x1, 0x80) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x48, 0x15, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f000001e3d8960f65b27ee8125f42360500000015739d53d5"]}, 0x48}}, 0x0) [ 2777.308380] binder: 5824:5825 unknown command 0 [ 2777.313269] binder: 5824:5825 ioctl c0306201 20000600 returned -22 14:36:10 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xf0\x00'}}}}, 0x68}}, 0x0) [ 2777.359461] binder: 5830:5831 got new transaction with bad transaction stack, transaction 9137 has target 5830:0 14:36:10 executing program 4: 14:36:10 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000400)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-serpent-sse2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = accept$alg(0xffffffffffffffff, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) sendto(r1, &(0x7f0000001640)="3a5753f1b260d7aeae1fcc9bdc0ce301262ed6a3f32c23b5bd332923bba0916bf4da58820251bac3a0fac400d8ccaa7790e6ac9c2b9953b2036907ac205eba27b449ea35e5dd248c58bd44701eed02fd8a36a7688bed69bf2573108f72122b4de877c8e1c0739e7e4523c7c0683f0b7184b014a148f96c57f61020c28bd65eba", 0x80, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000000040)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0x7ffff000}], 0x1}}], 0x1, 0x0, 0x0) [ 2777.403847] binder: 5830:5831 transaction failed 29201/-71, size 0-0 line 2946 [ 2777.430839] binder_alloc: binder_alloc_mmap_handler: 5830 20001000-20004000 already mapped failed -16 14:36:10 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x12634840, 0x0, 0x0}) 14:36:10 executing program 3: socket$inet6(0xa, 0x80003, 0x800000000000006) r0 = socket$netlink(0x10, 0x3, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000100)) poll(&(0x7f00000000c0)=[{r0, 0x2001}], 0x1, 0x80) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x48, 0x15, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f000001e3d8960f65b27ee8125f42360500000015739d53d5"]}, 0x48}}, 0x0) [ 2777.504217] binder: BINDER_SET_CONTEXT_MGR already set 14:36:10 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0e\x00'}}}}, 0x68}}, 0x0) [ 2777.528469] binder: 5830:5831 ioctl 40046207 0 returned -16 [ 2777.534652] binder: 5845:5846 unknown command 0 [ 2777.558267] binder_alloc: 5830: binder_alloc_buf, no vma [ 2777.560357] binder: 5845:5846 ioctl c0306201 20000600 returned -22 [ 2777.593191] binder: 5845:5846 unknown command 0 [ 2777.605537] binder: 5845:5846 ioctl c0306201 20000600 returned -22 [ 2777.618213] binder: 5830:5848 transaction failed 29189/-3, size 0-0 line 3035 [ 2777.618385] binder_alloc: 5830: binder_alloc_buf, no vma [ 2777.648454] binder: 5830:5838 transaction failed 29189/-3, size 0-0 line 3035 [ 2777.675015] binder: send failed reply for transaction 9137 to 5830:5831 14:36:10 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x7ff) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:36:10 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000400)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-serpent-sse2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(0xffffffffffffffff, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) sendto(r1, &(0x7f0000001640)="3a5753f1b260d7aeae1fcc9bdc0ce301262ed6a3f32c23b5bd332923bba0916bf4da58820251bac3a0fac400d8ccaa7790e6ac9c2b9953b2036907ac205eba27b449ea35e5dd248c58bd44701eed02fd8a36a7688bed69bf2573108f72122b4de877c8e1c0739e7e4523c7c0683f0b7184b014a148f96c57f61020c28bd65eba", 0x80, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000000040)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0x7ffff000}], 0x1}}], 0x1, 0x0, 0x0) 14:36:10 executing program 4: 14:36:10 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xfc\x00'}}}}, 0x68}}, 0x0) 14:36:10 executing program 3: socket$inet6(0xa, 0x80003, 0x800000000000006) r0 = socket$netlink(0x10, 0x3, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000100)="0af51f023c12") poll(&(0x7f00000000c0)=[{r0, 0x2001}], 0x1, 0x80) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x48, 0x15, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f000001e3d8960f65b27ee8125f42360500000015739d53d5"]}, 0x48}}, 0x0) 14:36:10 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x4c, 0x0, 0x0}) [ 2777.719986] binder: undelivered TRANSACTION_COMPLETE [ 2777.780667] binder: 5865:5866 unknown command 0 [ 2777.806986] binder: 5865:5866 ioctl c0306201 20000600 returned -22 [ 2777.815424] binder: 5870:5871 transaction failed 29189/-22, size 0-0 line 2896 14:36:10 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000400)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-serpent-sse2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(0xffffffffffffffff, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) sendto(r1, &(0x7f0000001640)="3a5753f1b260d7aeae1fcc9bdc0ce301262ed6a3f32c23b5bd332923bba0916bf4da58820251bac3a0fac400d8ccaa7790e6ac9c2b9953b2036907ac205eba27b449ea35e5dd248c58bd44701eed02fd8a36a7688bed69bf2573108f72122b4de877c8e1c0739e7e4523c7c0683f0b7184b014a148f96c57f61020c28bd65eba", 0x80, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000000040)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0x7ffff000}], 0x1}}], 0x1, 0x0, 0x0) 14:36:10 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c4\x00'}}}}, 0x68}}, 0x0) 14:36:10 executing program 3: socket$inet6(0xa, 0x80003, 0x800000000000006) r0 = socket$netlink(0x10, 0x3, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000100)="0af51f023c12") poll(&(0x7f00000000c0)=[{r0, 0x2001}], 0x1, 0x80) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x48, 0x15, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f000001e3d8960f65b27ee8125f42360500000015739d53d5"]}, 0x48}}, 0x0) [ 2777.864960] binder: 5870:5873 transaction failed 29189/-22, size 0-0 line 2896 14:36:10 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x74, 0x0, 0x0}) 14:36:10 executing program 4: 14:36:10 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$FS_IOC_GETFLAGS(r0, 0x80086601, &(0x7f0000000040)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 2777.995284] binder: 5884:5885 unknown command 0 14:36:10 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xf0\xff\xff\xff\xff\xff\xff\x00'}}}}, 0x68}}, 0x0) 14:36:11 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000400)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-serpent-sse2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(0xffffffffffffffff, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) sendto(r1, &(0x7f0000001640)="3a5753f1b260d7aeae1fcc9bdc0ce301262ed6a3f32c23b5bd332923bba0916bf4da58820251bac3a0fac400d8ccaa7790e6ac9c2b9953b2036907ac205eba27b449ea35e5dd248c58bd44701eed02fd8a36a7688bed69bf2573108f72122b4de877c8e1c0739e7e4523c7c0683f0b7184b014a148f96c57f61020c28bd65eba", 0x80, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000000040)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0x7ffff000}], 0x1}}], 0x1, 0x0, 0x0) [ 2778.035109] binder: 5884:5885 ioctl c0306201 20000600 returned -22 [ 2778.058121] binder: 5887:5889 ioctl 80086601 20000040 returned -22 14:36:11 executing program 3: socket$inet6(0xa, 0x80003, 0x800000000000006) r0 = socket$netlink(0x10, 0x3, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000100)="0af51f023c12") poll(&(0x7f00000000c0)=[{r0, 0x2001}], 0x1, 0x80) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x48, 0x15, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f000001e3d8960f65b27ee8125f42360500000015739d53d5"]}, 0x48}}, 0x0) 14:36:11 executing program 4: [ 2778.094604] binder: 5887:5889 got new transaction with bad transaction stack, transaction 9144 has target 5887:0 [ 2778.105988] binder: 5887:5889 transaction failed 29201/-71, size 0-0 line 2946 [ 2778.129717] binder_alloc: binder_alloc_mmap_handler: 5887 20001000-20004000 already mapped failed -16 14:36:11 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2000000, 0x0, 0x0}) 14:36:11 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@\x03\x00'}}}}, 0x68}}, 0x0) [ 2778.191320] binder: BINDER_SET_CONTEXT_MGR already set [ 2778.197337] binder: 5887:5889 ioctl 40046207 0 returned -16 [ 2778.208983] binder: 5887:5900 ioctl 80086601 20000040 returned -22 14:36:11 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000400)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-serpent-sse2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, 0x0, 0x0) sendto(r1, &(0x7f0000001640)="3a5753f1b260d7aeae1fcc9bdc0ce301262ed6a3f32c23b5bd332923bba0916bf4da58820251bac3a0fac400d8ccaa7790e6ac9c2b9953b2036907ac205eba27b449ea35e5dd248c58bd44701eed02fd8a36a7688bed69bf2573108f72122b4de877c8e1c0739e7e4523c7c0683f0b7184b014a148f96c57f61020c28bd65eba", 0x80, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000000040)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0x7ffff000}], 0x1}}], 0x1, 0x0, 0x0) [ 2778.234255] binder_alloc: 5887: binder_alloc_buf, no vma [ 2778.264338] binder: 5887:5889 transaction failed 29189/-3, size 0-0 line 3035 [ 2778.274039] binder: 5907:5908 unknown command 0 14:36:11 executing program 3: socket$inet6(0xa, 0x80003, 0x800000000000006) r0 = socket$netlink(0x10, 0x3, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188") poll(&(0x7f00000000c0)=[{r0, 0x2001}], 0x1, 0x80) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x48, 0x15, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f000001e3d8960f65b27ee8125f42360500000015739d53d5"]}, 0x48}}, 0x0) [ 2778.287339] binder: release 5887:5889 transaction 9144 out, still active [ 2778.299628] binder: undelivered TRANSACTION_COMPLETE [ 2778.305265] binder: 5907:5908 ioctl c0306201 20000600 returned -22 [ 2778.319677] binder: send failed reply for transaction 9144, target dead 14:36:11 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00'}}}}, 0x68}}, 0x0) 14:36:11 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="256772cf5b039868634b6bc9fbefb1ceeb2be89f64f5400000000085b7"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:36:11 executing program 4: 14:36:11 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x630b, 0x0, 0x0}) 14:36:11 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000400)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-serpent-sse2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, 0x0, 0x0) sendto(r1, &(0x7f0000001640)="3a5753f1b260d7aeae1fcc9bdc0ce301262ed6a3f32c23b5bd332923bba0916bf4da58820251bac3a0fac400d8ccaa7790e6ac9c2b9953b2036907ac205eba27b449ea35e5dd248c58bd44701eed02fd8a36a7688bed69bf2573108f72122b4de877c8e1c0739e7e4523c7c0683f0b7184b014a148f96c57f61020c28bd65eba", 0x80, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000000040)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0x7ffff000}], 0x1}}], 0x1, 0x0, 0x0) [ 2778.444505] binder: 5916:5920 unknown command -814586075 [ 2778.472523] binder: 5923:5924 unknown command 0 [ 2778.477815] binder: 5916:5920 ioctl c0306201 20000000 returned -22 [ 2778.484500] binder: 5923:5924 ioctl c0306201 20000600 returned -22 14:36:11 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x263044000000000, 0x0, 0x0}) 14:36:11 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x04\x00'}}}}, 0x68}}, 0x0) 14:36:11 executing program 4: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket(0x10, 0x802, 0x0) write(r0, &(0x7f0000000380)="fc0000004a000700ab092500090007000aab80ff010000000000369321000100ff010000000500000000000000036915fa2c1ec28656aaa79bb94b46fe0000000700020800008c0000036c6c256f1a272f2e117c22ebc205214000000000008934d07302ade01720d7d5bbc91a3e2e80772c74fb2cc56ce1f0f156272f5b00000005defd5a32e280fc83ab82f605f70c9ddef2fe082038f4f8b29d3ef3d92c83170e5bbab2ccd243f295ed94e0ad91bd0734babc7c3f2eeb57d43dd16b17e583df150c3b880f411f46a6b567b4d5715587e658a1ad0a4fa9a2bdafa22995cf41f0d48f6f2000080548deac270e33429fd3000175e63fb8d38a873cf1", 0xfc) 14:36:11 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000400)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-serpent-sse2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, 0x0, 0x0) sendto(r1, &(0x7f0000001640)="3a5753f1b260d7aeae1fcc9bdc0ce301262ed6a3f32c23b5bd332923bba0916bf4da58820251bac3a0fac400d8ccaa7790e6ac9c2b9953b2036907ac205eba27b449ea35e5dd248c58bd44701eed02fd8a36a7688bed69bf2573108f72122b4de877c8e1c0739e7e4523c7c0683f0b7184b014a148f96c57f61020c28bd65eba", 0x80, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000000040)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0x7ffff000}], 0x1}}], 0x1, 0x0, 0x0) [ 2778.536570] binder_alloc: binder_alloc_mmap_handler: 5916 20001000-20004000 already mapped failed -16 14:36:11 executing program 3: socket$inet6(0xa, 0x80003, 0x800000000000006) r0 = socket$netlink(0x10, 0x3, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188") poll(&(0x7f00000000c0)=[{r0, 0x2001}], 0x1, 0x80) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x48, 0x15, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f000001e3d8960f65b27ee8125f42360500000015739d53d5"]}, 0x48}}, 0x0) [ 2778.592672] binder: BINDER_SET_CONTEXT_MGR already set [ 2778.616649] binder: 5932:5937 unknown command 0 [ 2778.636331] binder: 5932:5937 ioctl c0306201 20000600 returned -22 [ 2778.637503] binder: 5916:5920 ioctl 40046207 0 returned -16 14:36:11 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x004\x8c\x00'}}}}, 0x68}}, 0x0) 14:36:11 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000400)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-serpent-sse2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0}, 0x0) sendto(r1, &(0x7f0000001640)="3a5753f1b260d7aeae1fcc9bdc0ce301262ed6a3f32c23b5bd332923bba0916bf4da58820251bac3a0fac400d8ccaa7790e6ac9c2b9953b2036907ac205eba27b449ea35e5dd248c58bd44701eed02fd8a36a7688bed69bf2573108f72122b4de877c8e1c0739e7e4523c7c0683f0b7184b014a148f96c57f61020c28bd65eba", 0x80, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000000040)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0x7ffff000}], 0x1}}], 0x1, 0x0, 0x0) 14:36:11 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x11634840, 0x0, 0x0}) [ 2778.693304] binder: 5916:5942 unknown command -814586075 [ 2778.739778] binder: send failed reply for transaction 9149 to 5916:5928 [ 2778.766998] binder: undelivered TRANSACTION_COMPLETE [ 2778.767216] binder: 5916:5942 ioctl c0306201 20000000 returned -22 [ 2778.785412] binder: 5946:5950 unknown command 0 [ 2778.788268] binder_release_work: 14 callbacks suppressed [ 2778.788274] binder: undelivered TRANSACTION_ERROR: 29189 [ 2778.799351] binder: 5946:5950 ioctl c0306201 20000600 returned -22 14:36:11 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000100)='/dev/rtc0\x00', 0x44002, 0x0) ioctl$UI_DEV_DESTROY(r2, 0x5502) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r3 = syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x3ff, 0x40) ioctl$DRM_IOCTL_ADD_MAP(r3, 0xc0286415, &(0x7f0000000080)={&(0x7f0000002000/0x3000)=nil, 0x485f6688, 0x3, 0x4, &(0x7f0000002000/0x3000)=nil, 0x1}) 14:36:11 executing program 3: socket$inet6(0xa, 0x80003, 0x800000000000006) r0 = socket$netlink(0x10, 0x3, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188") poll(&(0x7f00000000c0)=[{r0, 0x2001}], 0x1, 0x80) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x48, 0x15, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f000001e3d8960f65b27ee8125f42360500000015739d53d5"]}, 0x48}}, 0x0) 14:36:11 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0e\x00'}}}}, 0x68}}, 0x0) 14:36:11 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000400)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-serpent-sse2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0}, 0x0) sendto(r1, &(0x7f0000001640)="3a5753f1b260d7aeae1fcc9bdc0ce301262ed6a3f32c23b5bd332923bba0916bf4da58820251bac3a0fac400d8ccaa7790e6ac9c2b9953b2036907ac205eba27b449ea35e5dd248c58bd44701eed02fd8a36a7688bed69bf2573108f72122b4de877c8e1c0739e7e4523c7c0683f0b7184b014a148f96c57f61020c28bd65eba", 0x80, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000000040)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0x7ffff000}], 0x1}}], 0x1, 0x0, 0x0) 14:36:11 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x4630440, 0x0, 0x0}) [ 2778.865606] netlink: 180 bytes leftover after parsing attributes in process `syz-executor4'. [ 2778.923056] netlink: 180 bytes leftover after parsing attributes in process `syz-executor4'. [ 2778.956651] binder: 5958:5960 unknown command 0 14:36:11 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000400)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-serpent-sse2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0}, 0x0) sendto(r1, &(0x7f0000001640)="3a5753f1b260d7aeae1fcc9bdc0ce301262ed6a3f32c23b5bd332923bba0916bf4da58820251bac3a0fac400d8ccaa7790e6ac9c2b9953b2036907ac205eba27b449ea35e5dd248c58bd44701eed02fd8a36a7688bed69bf2573108f72122b4de877c8e1c0739e7e4523c7c0683f0b7184b014a148f96c57f61020c28bd65eba", 0x80, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000000040)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0x7ffff000}], 0x1}}], 0x1, 0x0, 0x0) [ 2778.967492] binder: 5958:5960 ioctl c0306201 20000600 returned -22 [ 2778.967672] binder: 5964:5965 got new transaction with bad transaction stack, transaction 9151 has target 5964:0 [ 2778.990194] binder: 5958:5960 unknown command 0 [ 2779.000128] binder: 5958:5960 ioctl c0306201 20000600 returned -22 14:36:11 executing program 4: r0 = perf_event_open(&(0x7f0000aaa000)={0x2, 0x70, 0x859, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$F_SET_RW_HINT(r0, 0x40c, &(0x7f0000000400)=0x1) mkdir(&(0x7f00000013c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000026ff8)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') symlink(&(0x7f0000000100)='.\x00', &(0x7f0000000540)='./file0\x00') mount(0x0, &(0x7f0000000080)='.', 0x0, 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x20000, 0x0) mount(&(0x7f0000000080), &(0x7f0000187ff8)='.', 0x0, 0x5010, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000200)='/dev/vcs\x00', 0x7, 0x0) link(&(0x7f00000001c0)='./file0/file0/file0\x00', &(0x7f0000000100)='./file0/file0\x00') perf_event_open$cgroup(&(0x7f0000000240)={0x5, 0x70, 0x8, 0x20, 0x4fc1, 0xfffffffffffffffd, 0x0, 0x1, 0x8040, 0x2, 0xcc, 0x80000000, 0x1033, 0x101, 0x8, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0xffffffffffffffff, 0x0, 0xffffffffffffff9c, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_inet_SIOCGIFDSTADDR(0xffffffffffffffff, 0x8917, 0x0) r1 = socket$inet6(0xa, 0x400000000001, 0x0) r2 = dup(r1) setsockopt$inet6_tcp_int(r2, 0x6, 0xa, &(0x7f00007b1000)=0x81, 0x4) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) sendto$inet6(r1, 0x0, 0x0, 0x20000005, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) r3 = open(&(0x7f0000000040)='./bus\x00', 0x141042, 0x0) ftruncate(r3, 0x7fff) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000000)='bbr\x00', 0x4) sendfile(r2, r3, 0x0, 0x8000dffffffe) 14:36:11 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00'}}}}, 0x68}}, 0x0) 14:36:11 executing program 3: socket$inet6(0xa, 0x80003, 0x800000000000006) r0 = socket$netlink(0x10, 0x3, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a0") poll(&(0x7f00000000c0)=[{r0, 0x2001}], 0x1, 0x80) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x48, 0x15, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f000001e3d8960f65b27ee8125f42360500000015739d53d5"]}, 0x48}}, 0x0) 14:36:12 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xc630000, 0x0, 0x0}) [ 2779.101048] binder_alloc: binder_alloc_mmap_handler: 5964 20001000-20004000 already mapped failed -16 14:36:12 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000400)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-serpent-sse2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)}, 0x0) sendto(r1, &(0x7f0000001640)="3a5753f1b260d7aeae1fcc9bdc0ce301262ed6a3f32c23b5bd332923bba0916bf4da58820251bac3a0fac400d8ccaa7790e6ac9c2b9953b2036907ac205eba27b449ea35e5dd248c58bd44701eed02fd8a36a7688bed69bf2573108f72122b4de877c8e1c0739e7e4523c7c0683f0b7184b014a148f96c57f61020c28bd65eba", 0x80, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000000040)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0x7ffff000}], 0x1}}], 0x1, 0x0, 0x0) [ 2779.149884] binder: 5979:5980 unknown command 0 [ 2779.160294] binder: 5979:5980 ioctl c0306201 20000600 returned -22 14:36:12 executing program 3: socket$inet6(0xa, 0x80003, 0x800000000000006) r0 = socket$netlink(0x10, 0x3, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a0") poll(&(0x7f00000000c0)=[{r0, 0x2001}], 0x1, 0x80) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x48, 0x15, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f000001e3d8960f65b27ee8125f42360500000015739d53d5"]}, 0x48}}, 0x0) [ 2779.204738] binder: BINDER_SET_CONTEXT_MGR already set [ 2779.238567] binder: 5964:5965 ioctl 40046207 0 returned -16 [ 2779.238608] binder: undelivered TRANSACTION_ERROR: 29189 [ 2779.250785] binder: send failed reply for transaction 9151 to 5964:5965 [ 2779.271623] binder: undelivered TRANSACTION_COMPLETE 14:36:12 executing program 0: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x0, 0x0) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/autofs\x00', 0x200, 0x0) ioctl$VHOST_SET_VRING_ADDR(r1, 0x4028af11, &(0x7f00000002c0)={0x2, 0x1, &(0x7f0000000080)=""/240, &(0x7f0000000180)=""/68, &(0x7f0000000200)=""/174}) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000340)={0xfffffffffffffd01, 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:36:12 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) 14:36:12 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00'}}}}, 0x68}}, 0x0) [ 2779.304635] binder: undelivered TRANSACTION_ERROR: 29201 [ 2779.329169] binder: undelivered TRANSACTION_ERROR: 29189 14:36:12 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000400)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-serpent-sse2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)}, 0x0) sendto(r1, &(0x7f0000001640)="3a5753f1b260d7aeae1fcc9bdc0ce301262ed6a3f32c23b5bd332923bba0916bf4da58820251bac3a0fac400d8ccaa7790e6ac9c2b9953b2036907ac205eba27b449ea35e5dd248c58bd44701eed02fd8a36a7688bed69bf2573108f72122b4de877c8e1c0739e7e4523c7c0683f0b7184b014a148f96c57f61020c28bd65eba", 0x80, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000000040)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0x7ffff000}], 0x1}}], 0x1, 0x0, 0x0) 14:36:12 executing program 3: socket$inet6(0xa, 0x80003, 0x800000000000006) r0 = socket$netlink(0x10, 0x3, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a0") poll(&(0x7f00000000c0)=[{r0, 0x2001}], 0x1, 0x80) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x48, 0x15, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f000001e3d8960f65b27ee8125f42360500000015739d53d5"]}, 0x48}}, 0x0) [ 2779.366219] binder: 5991:5996 unknown command 0 [ 2779.382529] binder: 5991:5996 ioctl c0306201 20000600 returned -22 14:36:12 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0e\x00'}}}}, 0x68}}, 0x0) 14:36:12 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) msgctl$MSG_STAT(0x0, 0xb, 0x0) 14:36:12 executing program 3: socket$inet6(0xa, 0x80003, 0x800000000000006) r0 = socket$netlink(0x10, 0x3, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") poll(0x0, 0x0, 0x80) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x48, 0x15, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f000001e3d8960f65b27ee8125f42360500000015739d53d5"]}, 0x48}}, 0x0) 14:36:12 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x163404000000000, 0x0, 0x0}) 14:36:12 executing program 0: r0 = syz_open_dev$mice(&(0x7f0000000240)='/dev/input/mice\x00', 0x0, 0x200000) setsockopt$inet6_opts(r0, 0x29, 0x36, &(0x7f0000000280)=@hopopts={0x62, 0x9, [], [@hao={0xc9, 0x10, @dev={0xfe, 0x80, [], 0x12}}, @padn={0x1, 0x4, [0x0, 0x0, 0x0, 0x0]}, @padn={0x1, 0x7, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, @calipso={0x7, 0x28, {0xfffffffffffffffc, 0x8, 0x80000001, 0xffff, [0x6, 0x6, 0x2, 0x7]}}, @pad1]}, 0x58) r1 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0x0, 0x802) prctl$PR_TASK_PERF_EVENTS_ENABLE(0x20) r2 = syz_open_dev$dmmidi(&(0x7f0000000040)='/dev/dmmidi#\x00', 0x401, 0x20000) ioctl$CAPI_MANUFACTURER_CMD(r2, 0xc0104320, &(0x7f0000000300)={0x5, &(0x7f0000000140)="7a3694a1364937c6f83cecf1efd65597551c416371031b6ba1d7e66fb04e23e67032571ed3dde5e939a2f539cac659fbf3c982801bfbfdcb3f5dc951bbdeac2ee8f4fb9d6f96672d241cbb3ab071d1985ed8a3fd70a01bdc997578"}) r3 = syz_open_dev$binder(0x0, 0x0, 0x0) r4 = openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/sequencer\x00', 0x80, 0x0) getsockopt$inet_sctp6_SCTP_INITMSG(r4, 0x84, 0x2, &(0x7f0000000080), &(0x7f0000000100)=0x8) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x100000e, 0x20011, r3, 0x0) r5 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r5, &(0x7f0000000080)=@ax25={{0x3, @netrom}, [@remote, @null, @netrom, @bcast, @bcast, @remote, @null, @default]}, 0x80) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r2, 0x40045532, &(0x7f0000000380)=0xfffffffffffffff7) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xfffffffffffffd66, 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$KDSKBMODE(r4, 0x4b45, &(0x7f0000000200)=0xffffffff) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="0063405e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000227dad77ad49a14ce12613164960000000000008616679d910a35297054005f1d0fe6760f7d41caaa247864295c0e8c7d9fa69d991101bbf84c07ca676ab7f8ed6c7c6ff5151afcdceea25753248fdc5302c5fd355039600000"], 0x0, 0x0, 0x0}) getsockopt$inet_sctp_SCTP_NODELAY(r2, 0x84, 0x3, &(0x7f00000004c0), &(0x7f0000000500)=0x4) 14:36:12 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000400)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-serpent-sse2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)}, 0x0) sendto(r1, &(0x7f0000001640)="3a5753f1b260d7aeae1fcc9bdc0ce301262ed6a3f32c23b5bd332923bba0916bf4da58820251bac3a0fac400d8ccaa7790e6ac9c2b9953b2036907ac205eba27b449ea35e5dd248c58bd44701eed02fd8a36a7688bed69bf2573108f72122b4de877c8e1c0739e7e4523c7c0683f0b7184b014a148f96c57f61020c28bd65eba", 0x80, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000000040)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0x7ffff000}], 0x1}}], 0x1, 0x0, 0x0) 14:36:12 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00'}}}}, 0x68}}, 0x0) [ 2779.654499] binder: 6019:6020 unknown command 1581277952 [ 2779.683701] binder: 6019:6020 ioctl c0306201 20000600 returned -22 [ 2779.691249] binder_thread_write: 18 callbacks suppressed [ 2779.691258] binder: 6021:6022 BC_ACQUIRE_DONE u0000000000000000 no match 14:36:12 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\x9e\x00'}}}}, 0x68}}, 0x0) 14:36:12 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000400)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-serpent-sse2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18}], 0x18}, 0x0) sendto(r1, &(0x7f0000001640)="3a5753f1b260d7aeae1fcc9bdc0ce301262ed6a3f32c23b5bd332923bba0916bf4da58820251bac3a0fac400d8ccaa7790e6ac9c2b9953b2036907ac205eba27b449ea35e5dd248c58bd44701eed02fd8a36a7688bed69bf2573108f72122b4de877c8e1c0739e7e4523c7c0683f0b7184b014a148f96c57f61020c28bd65eba", 0x80, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000000040)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0x7ffff000}], 0x1}}], 0x1, 0x0, 0x0) [ 2779.734278] binder: 6019:6028 unknown command 1581277952 [ 2779.757880] binder: 6019:6028 ioctl c0306201 20000600 returned -22 [ 2779.773520] binder: 6021:6022 unknown command 0 [ 2779.797494] binder: 6021:6022 ioctl c0306201 20000600 returned -22 14:36:12 executing program 3: socket$inet6(0xa, 0x80003, 0x800000000000006) r0 = socket$netlink(0x10, 0x3, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") poll(0x0, 0x0, 0x80) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x48, 0x15, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f000001e3d8960f65b27ee8125f42360500000015739d53d5"]}, 0x48}}, 0x0) 14:36:12 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$admmidi(&(0x7f0000000180)='/dev/admmidi#\x00', 0x0, 0x102) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f00000001c0), &(0x7f0000000200)=0x14) r2 = syz_open_dev$binder(0x0, 0x0, 0xc00000000000805) r3 = syz_open_dev$audion(&(0x7f0000000100)='/dev/audio#\x00', 0x83a2, 0xa400) write$P9_RRENAMEAT(r3, &(0x7f0000000140)={0x7, 0x4b, 0x1}, 0x7) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000000000000000000000000000004ebf37e2381113ae1e0000000000000000000000000000f18b94085db913d9000000000000000000000000"], 0x0, 0x0, 0x0}) 14:36:12 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x7630440, 0x0, 0x0}) 14:36:12 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0e\x00'}}}}, 0x68}}, 0x0) [ 2779.904692] binder: 6039:6040 BC_ACQUIRE_DONE u0000000000000000 no match [ 2779.946078] binder: undelivered TRANSACTION_ERROR: 29189 [ 2779.958433] binder: 6039:6040 unknown command 0 [ 2779.960828] binder: undelivered TRANSACTION_ERROR: 29189 [ 2779.966818] binder: 6039:6040 ioctl c0306201 20000600 returned -22 [ 2779.987067] binder: undelivered TRANSACTION_ERROR: 29189 14:36:13 executing program 4: syz_execute_func(&(0x7f0000000100)="3666440f50f564ff0941c3c4e2c9975842c4c27d794e0066420fe2e33e0f1110c442019dccd319409c") clone(0x200, 0x0, 0x0, 0x0, 0x0) mknod(&(0x7f0000f80000)='./file0\x00', 0x1040, 0x0) execve(&(0x7f0000000340)='./file0\x00', 0x0, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) mknod(&(0x7f0000000000)='./file1\x00', 0x0, 0x0) read(r0, &(0x7f0000001ac0)=""/11, 0x58) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000200)) r1 = creat(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x109) r2 = dup2(r0, r1) execve(&(0x7f0000000140)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0) open$dir(&(0x7f0000000240)='./file0\x00', 0x841, 0x0) clone(0x3102001ff6, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000040)='./file1\x00', 0x0, 0x0) ioctl$sock_inet_SIOCADDRT(r2, 0x890b, 0x0) 14:36:13 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000400)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-serpent-sse2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18}], 0x18}, 0x0) sendto(r1, &(0x7f0000001640)="3a5753f1b260d7aeae1fcc9bdc0ce301262ed6a3f32c23b5bd332923bba0916bf4da58820251bac3a0fac400d8ccaa7790e6ac9c2b9953b2036907ac205eba27b449ea35e5dd248c58bd44701eed02fd8a36a7688bed69bf2573108f72122b4de877c8e1c0739e7e4523c7c0683f0b7184b014a148f96c57f61020c28bd65eba", 0x80, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000000040)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0x7ffff000}], 0x1}}], 0x1, 0x0, 0x0) 14:36:13 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000040)='/dev/btrfs-control\x00', 0x101000, 0x0) r3 = socket$pppoe(0x18, 0x1, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000300)={&(0x7f0000000000/0x3000)=nil, &(0x7f0000000000/0x3000)=nil, &(0x7f0000001000/0x4000)=nil, &(0x7f0000002000/0x4000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000002000/0x4000)=nil, &(0x7f0000002000/0x4000)=nil, &(0x7f0000005000/0x2000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000001000/0x3000)=nil, &(0x7f0000004000/0x4000)=nil, &(0x7f0000000200)="10e6e1994c1380bd9d0774d5ccdff0deff2644c913bb5cb1ee2b5738ff081e0a7717c6140ed0f8867da53d504aa452d8b540593b2476ce3921958ee44ba24ba37949d74b126662c57f82a46f07d605e5058bbae0bf9f912671fc92352afe08412b3ef941fbae115a88871190a5c8266886685e20107f0d3ec5c856c2b7982d2689d6edc17a895cf291dc818a88d69862c046d799541f635289c0dce6d4a155fd24a9da39d09b1fafad737f554232e821b67be0b2d2ded89eca715b1d059eef7eaaf1244804703f2979c9e792856679c2996035e9e1dedbb58d47196d675a42ee", 0xe0, r3}, 0x68) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8916, &(0x7f0000000380)={'vcan0\x00', {0x2, 0x4e20, @multicast2}}) getsockopt$inet_sctp6_SCTP_MAX_BURST(r2, 0x84, 0x14, &(0x7f0000000100)=@assoc_value={0x0}, &(0x7f0000000140)=0x8) setsockopt$inet_sctp_SCTP_RTOINFO(r2, 0x84, 0x0, &(0x7f0000000180)={r4, 0x3, 0xffffffff00000000, 0x5}, 0x10) write$P9_RCLUNK(r2, &(0x7f0000000080)={0x7, 0x79, 0x1}, 0x7) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$EVIOCGABS0(r2, 0x80184540, &(0x7f0000000400)=""/223) ioctl$BLKBSZSET(r2, 0x40081271, &(0x7f00000001c0)=0x12) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:36:13 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00`\x00'}}}}, 0x68}}, 0x0) 14:36:13 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x400000000000000, 0x0, 0x0}) 14:36:13 executing program 3: socket$inet6(0xa, 0x80003, 0x800000000000006) r0 = socket$netlink(0x10, 0x3, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") poll(0x0, 0x0, 0x80) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x48, 0x15, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f000001e3d8960f65b27ee8125f42360500000015739d53d5"]}, 0x48}}, 0x0) [ 2780.148482] binder: 6060:6061 got new transaction with bad transaction stack, transaction 9158 has target 6060:0 [ 2780.171476] binder: 6058:6059 BC_ACQUIRE_DONE u0000000000000000 no match 14:36:13 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00'}}}}, 0x68}}, 0x0) [ 2780.193641] binder: BINDER_SET_CONTEXT_MGR already set [ 2780.199513] binder: 6058:6059 unknown command 0 [ 2780.204944] binder: 6058:6059 ioctl c0306201 20000600 returned -22 14:36:13 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000400)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-serpent-sse2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18}], 0x18}, 0x0) sendto(r1, &(0x7f0000001640)="3a5753f1b260d7aeae1fcc9bdc0ce301262ed6a3f32c23b5bd332923bba0916bf4da58820251bac3a0fac400d8ccaa7790e6ac9c2b9953b2036907ac205eba27b449ea35e5dd248c58bd44701eed02fd8a36a7688bed69bf2573108f72122b4de877c8e1c0739e7e4523c7c0683f0b7184b014a148f96c57f61020c28bd65eba", 0x80, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000000040)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0x7ffff000}], 0x1}}], 0x1, 0x0, 0x0) [ 2780.243972] binder: 6060:6067 ioctl 40046207 0 returned -16 [ 2780.255466] binder: release 6060:6061 transaction 9158 out, still active [ 2780.268683] binder: undelivered TRANSACTION_COMPLETE [ 2780.300118] binder: undelivered TRANSACTION_ERROR: 29201 14:36:13 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xd630000, 0x0, 0x0}) [ 2780.327269] binder: undelivered TRANSACTION_ERROR: 29189 14:36:13 executing program 3: socket$inet6(0xa, 0x80003, 0x800000000000006) r0 = socket$netlink(0x10, 0x3, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") poll(&(0x7f00000000c0), 0x0, 0x80) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x48, 0x15, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f000001e3d8960f65b27ee8125f42360500000015739d53d5"]}, 0x48}}, 0x0) 14:36:13 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x802) socket$xdp(0x2c, 0x3, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x803) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0xff93, 0x0, &(0x7f0000000080)=ANY=[@ANYRES64], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 2780.360512] binder: undelivered TRANSACTION_ERROR: 29189 [ 2780.395524] binder: send failed reply for transaction 9158, target dead 14:36:13 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x004\x8c\x00'}}}}, 0x68}}, 0x0) [ 2780.408699] binder: 6077:6078 BC_ACQUIRE_DONE u0000000000000000 no match [ 2780.448597] binder: 6082:6083 unknown command -1 [ 2780.465622] binder: 6082:6083 ioctl c0306201 20000000 returned -22 [ 2780.469069] binder: 6077:6078 unknown command 0 [ 2780.497566] binder: 6077:6078 ioctl c0306201 20000600 returned -22 [ 2780.498525] binder: BINDER_SET_CONTEXT_MGR already set [ 2780.521931] binder: 6077:6078 BC_ACQUIRE_DONE u0000000000000000 no match [ 2780.529264] binder: 6082:6088 ioctl 40046207 0 returned -16 [ 2780.558266] binder: 6082:6083 unknown command -1 [ 2780.562680] binder: 6077:6078 unknown command 0 [ 2780.580176] binder: 6077:6078 ioctl c0306201 20000600 returned -22 [ 2780.592046] binder: 6082:6083 ioctl c0306201 20000000 returned -22 [ 2780.608497] binder_alloc_new_buf_locked: 5 callbacks suppressed [ 2780.608505] binder_alloc: 6082: binder_alloc_buf, no vma 14:36:13 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x400000000000000, 0x0, 0x0}) 14:36:13 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000400)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-serpent-sse2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) sendto(0xffffffffffffffff, &(0x7f0000001640)="3a5753f1b260d7aeae1fcc9bdc0ce301262ed6a3f32c23b5bd332923bba0916bf4da58820251bac3a0fac400d8ccaa7790e6ac9c2b9953b2036907ac205eba27b449ea35e5dd248c58bd44701eed02fd8a36a7688bed69bf2573108f72122b4de877c8e1c0739e7e4523c7c0683f0b7184b014a148f96c57f61020c28bd65eba", 0x80, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000000040)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0x7ffff000}], 0x1}}], 0x1, 0x0, 0x0) 14:36:13 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00'}}}}, 0x68}}, 0x0) 14:36:13 executing program 3: socket$inet6(0xa, 0x80003, 0x800000000000006) r0 = socket$netlink(0x10, 0x3, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") poll(&(0x7f00000000c0), 0x0, 0x80) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x48, 0x15, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f000001e3d8960f65b27ee8125f42360500000015739d53d5"]}, 0x48}}, 0x0) 14:36:13 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xe630c40, 0x0, 0x0}) 14:36:13 executing program 0: r0 = open(&(0x7f0000000000)='./file0\x00', 0x40041, 0x0) write$binfmt_elf32(r0, 0x0, 0x0) 14:36:13 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000400)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-serpent-sse2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) sendto(0xffffffffffffffff, &(0x7f0000001640)="3a5753f1b260d7aeae1fcc9bdc0ce301262ed6a3f32c23b5bd332923bba0916bf4da58820251bac3a0fac400d8ccaa7790e6ac9c2b9953b2036907ac205eba27b449ea35e5dd248c58bd44701eed02fd8a36a7688bed69bf2573108f72122b4de877c8e1c0739e7e4523c7c0683f0b7184b014a148f96c57f61020c28bd65eba", 0x80, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000000040)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0x7ffff000}], 0x1}}], 0x1, 0x0, 0x0) [ 2780.901442] binder: 6108:6109 BC_ACQUIRE_DONE u0000000000000000 no match [ 2780.927163] binder: 6108:6109 unknown command 0 [ 2780.931985] binder: 6108:6109 ioctl c0306201 20000600 returned -22 14:36:13 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xf0\xff\xff\xff\xff\xff\xff\x00'}}}}, 0x68}}, 0x0) 14:36:13 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xc630000, 0x0, 0x0}) 14:36:13 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x6c00, 0x0, 0x0}) [ 2781.055057] binder: 6122:6126 BC_ACQUIRE_DONE u0000000000000000 no match [ 2781.086594] binder: 6122:6126 unknown command 0 [ 2781.097068] binder: 6122:6126 ioctl c0306201 20000600 returned -22 14:36:14 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00`\x00'}}}}, 0x68}}, 0x0) 14:36:14 executing program 3: socket$inet6(0xa, 0x80003, 0x800000000000006) r0 = socket$netlink(0x10, 0x3, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") poll(&(0x7f00000000c0), 0x0, 0x80) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x48, 0x15, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f000001e3d8960f65b27ee8125f42360500000015739d53d5"]}, 0x48}}, 0x0) [ 2781.110363] binder: 6127:6128 BC_ACQUIRE_DONE u0000000000000000 no match [ 2781.164606] binder: 6127:6128 unknown command 0 [ 2781.187558] binder: 6127:6128 ioctl c0306201 20000600 returned -22 [ 2781.204514] binder: 6117:6136 BC_ACQUIRE_DONE u0000000000000000 no match [ 2781.212618] binder: 6127:6128 BC_ACQUIRE_DONE u0000000000000000 no match [ 2781.221661] binder: 6117:6136 unknown command 0 [ 2781.229454] binder: 6127:6128 unknown command 0 14:36:14 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f0000000040)='loginuid\x00') sendfile(r0, r0, &(0x7f0000000180)=0x74000004, 0x5) fcntl$setflags(r0, 0x2, 0xd71a722c425b7e6b) write$FUSE_NOTIFY_POLL(r0, &(0x7f0000000000)={0x18, 0x1, 0x0, {0x7830}}, 0x18) 14:36:14 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000400)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-serpent-sse2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) sendto(0xffffffffffffffff, &(0x7f0000001640)="3a5753f1b260d7aeae1fcc9bdc0ce301262ed6a3f32c23b5bd332923bba0916bf4da58820251bac3a0fac400d8ccaa7790e6ac9c2b9953b2036907ac205eba27b449ea35e5dd248c58bd44701eed02fd8a36a7688bed69bf2573108f72122b4de877c8e1c0739e7e4523c7c0683f0b7184b014a148f96c57f61020c28bd65eba", 0x80, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000000040)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0x7ffff000}], 0x1}}], 0x1, 0x0, 0x0) 14:36:14 executing program 0: socket$inet6(0xa, 0x80003, 0x800000000000006) r0 = socket$netlink(0x10, 0x3, 0x4) socket$inet_udplite(0x2, 0x2, 0x88) poll(&(0x7f00000000c0)=[{r0, 0x2001}], 0x1, 0x80) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x48, 0x15, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f000001e3d8960f65b27ee8125f42360500000015739d53d5"]}, 0x48}}, 0x0) 14:36:14 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00`\x00'}}}}, 0x68}}, 0x0) [ 2781.236177] binder: 6117:6136 ioctl c0306201 20000600 returned -22 [ 2781.242855] binder: 6127:6128 ioctl c0306201 20000600 returned -22 14:36:14 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x7, 0x0, 0x0}) 14:36:14 executing program 3: socket$inet6(0xa, 0x80003, 0x800000000000006) r0 = socket$netlink(0x10, 0x3, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") poll(&(0x7f00000000c0)=[{0xffffffffffffffff, 0x2001}], 0x1, 0x80) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x48, 0x15, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f000001e3d8960f65b27ee8125f42360500000015739d53d5"]}, 0x48}}, 0x0) 14:36:14 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0f\x00'}}}}, 0x68}}, 0x0) 14:36:14 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000400)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-serpent-sse2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) sendto(r1, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000000040)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0x7ffff000}], 0x1}}], 0x1, 0x0, 0x0) [ 2781.395920] binder: 6148:6150 unknown command 0 [ 2781.400719] binder: 6148:6150 ioctl c0306201 20000600 returned -22 14:36:14 executing program 0: socket$inet6(0xa, 0x80003, 0x800000000000006) r0 = socket$netlink(0x10, 0x3, 0x4) socket$inet_udplite(0x2, 0x2, 0x88) poll(&(0x7f00000000c0)=[{r0, 0x2001}], 0x1, 0x80) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x48, 0x15, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f000001e3d8960f65b27ee8125f42360500000015739d53d5"]}, 0x48}}, 0x0) 14:36:14 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x1063084000000000, 0x0, 0x0}) 14:36:14 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x04\x00'}}}}, 0x68}}, 0x0) 14:36:14 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000400)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-serpent-sse2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) sendto(r1, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000000040)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0x7ffff000}], 0x1}}], 0x1, 0x0, 0x0) 14:36:14 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f0000000040)='loginuid\x00') sendfile(r0, r0, &(0x7f0000000180)=0x74000004, 0x5) fcntl$setflags(r0, 0x2, 0xd71a722c425b7e6b) write$FUSE_NOTIFY_POLL(r0, &(0x7f0000000000)={0x18, 0x1, 0x0, {0x7830}}, 0x18) 14:36:14 executing program 3: socket$inet6(0xa, 0x80003, 0x800000000000006) r0 = socket$netlink(0x10, 0x3, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") poll(&(0x7f00000000c0)=[{0xffffffffffffffff, 0x2001}], 0x1, 0x80) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x48, 0x15, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f000001e3d8960f65b27ee8125f42360500000015739d53d5"]}, 0x48}}, 0x0) [ 2781.635970] binder: 6171:6172 unknown command 0 14:36:14 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000400)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-serpent-sse2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) sendto(r1, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000000040)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0x7ffff000}], 0x1}}], 0x1, 0x0, 0x0) 14:36:14 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03@\x00'}}}}, 0x68}}, 0x0) 14:36:14 executing program 0: socket$inet6(0xa, 0x80003, 0x800000000000006) r0 = socket$netlink(0x10, 0x3, 0x4) socket$inet_udplite(0x2, 0x2, 0x88) poll(&(0x7f00000000c0)=[{r0, 0x2001}], 0x1, 0x80) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x48, 0x15, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f000001e3d8960f65b27ee8125f42360500000015739d53d5"]}, 0x48}}, 0x0) [ 2781.687959] binder: 6171:6172 ioctl c0306201 20000600 returned -22 [ 2781.716351] binder: 6171:6172 unknown command 0 [ 2781.725721] binder: 6171:6172 ioctl c0306201 20000600 returned -22 14:36:14 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x12, 0x0, 0x0}) 14:36:14 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000400)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-serpent-sse2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) sendto(r1, &(0x7f0000001640), 0x0, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000000040)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0x7ffff000}], 0x1}}], 0x1, 0x0, 0x0) 14:36:14 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\n\x00'}}}}, 0x68}}, 0x0) [ 2781.845367] binder: 6187:6188 unknown command 0 [ 2781.872889] binder: 6187:6188 ioctl c0306201 20000600 returned -22 14:36:14 executing program 3: socket$inet6(0xa, 0x80003, 0x800000000000006) r0 = socket$netlink(0x10, 0x3, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") poll(&(0x7f00000000c0)=[{0xffffffffffffffff, 0x2001}], 0x1, 0x80) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x48, 0x15, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f000001e3d8960f65b27ee8125f42360500000015739d53d5"]}, 0x48}}, 0x0) 14:36:14 executing program 0: socket$inet6(0xa, 0x80003, 0x800000000000006) r0 = socket$netlink(0x10, 0x3, 0x4) socket$inet_udplite(0x2, 0x2, 0x88) poll(&(0x7f00000000c0)=[{r0, 0x2001}], 0x1, 0x80) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x48, 0x15, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f000001e3d8960f65b27ee8125f42360500000015739d53d5"]}, 0x48}}, 0x0) 14:36:14 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x630c, 0x0, 0x0}) 14:36:14 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000400)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-serpent-sse2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) sendto(r1, &(0x7f0000001640), 0x0, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000000040)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0x7ffff000}], 0x1}}], 0x1, 0x0, 0x0) [ 2782.069881] binder: 6205:6207 unknown command 0 14:36:15 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f0000000040)='loginuid\x00') sendfile(r0, r0, &(0x7f0000000180)=0x74000004, 0x5) fcntl$setflags(r0, 0x2, 0xd71a722c425b7e6b) write$FUSE_NOTIFY_POLL(r0, &(0x7f0000000000)={0x18, 0x1, 0x0, {0x7830}}, 0x18) 14:36:15 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00'}}}}, 0x68}}, 0x0) 14:36:15 executing program 0: socket$inet6(0xa, 0x80003, 0x800000000000006) r0 = socket$netlink(0x10, 0x3, 0x4) socket$inet_udplite(0x2, 0x2, 0x88) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x48, 0x15, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f000001e3d8960f65b27ee8125f42360500000015739d53d5"]}, 0x48}}, 0x0) 14:36:15 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000400)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-serpent-sse2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) sendto(r1, &(0x7f0000001640), 0x0, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000000040)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0x7ffff000}], 0x1}}], 0x1, 0x0, 0x0) [ 2782.091041] binder: 6205:6207 ioctl c0306201 20000600 returned -22 14:36:15 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x630d, 0x0, 0x0}) 14:36:15 executing program 3: socket$inet6(0xa, 0x80003, 0x800000000000006) r0 = socket$netlink(0x10, 0x3, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") poll(&(0x7f00000000c0)=[{r0}], 0x1, 0x80) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x48, 0x15, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f000001e3d8960f65b27ee8125f42360500000015739d53d5"]}, 0x48}}, 0x0) 14:36:15 executing program 0: socket$inet6(0xa, 0x80003, 0x800000000000006) r0 = socket$netlink(0x10, 0x3, 0x4) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x48, 0x15, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f000001e3d8960f65b27ee8125f42360500000015739d53d5"]}, 0x48}}, 0x0) [ 2782.197934] binder: 6218:6219 unknown command 0 [ 2782.202761] binder: 6218:6219 ioctl c0306201 20000600 returned -22 14:36:15 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000400)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-serpent-sse2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) sendto(r1, &(0x7f0000001640)="3a5753f1b260d7aeae1fcc9bdc0ce301262ed6a3f32c23b5bd332923bba0916bf4da58820251bac3a0fac400d8ccaa7790e6ac9c2b9953b2036907ac205eba27", 0x40, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000000040)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0x7ffff000}], 0x1}}], 0x1, 0x0, 0x0) 14:36:15 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xf0\x00'}}}}, 0x68}}, 0x0) 14:36:15 executing program 0: socket$inet6(0xa, 0x80003, 0x800000000000006) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x48, 0x15, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f000001e3d8960f65b27ee8125f42360500000015739d53d5"]}, 0x48}}, 0x0) 14:36:15 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xa630840, 0x0, 0x0}) 14:36:15 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x4) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x48, 0x15, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f000001e3d8960f65b27ee8125f42360500000015739d53d5"]}, 0x48}}, 0x0) [ 2782.429826] binder: 6235:6236 unknown command 0 14:36:15 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f0000000040)='loginuid\x00') sendfile(r0, r0, &(0x7f0000000180)=0x74000004, 0x5) fcntl$setflags(r0, 0x2, 0xd71a722c425b7e6b) 14:36:15 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00'}}}}, 0x68}}, 0x0) 14:36:15 executing program 3: socket$inet6(0xa, 0x80003, 0x800000000000006) r0 = socket$netlink(0x10, 0x3, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") poll(&(0x7f00000000c0)=[{r0}], 0x1, 0x80) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x48, 0x15, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f000001e3d8960f65b27ee8125f42360500000015739d53d5"]}, 0x48}}, 0x0) 14:36:15 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000400)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-serpent-sse2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) sendto(r1, &(0x7f0000001640)="3a5753f1b260d7aeae1fcc9bdc0ce301262ed6a3f32c23b5bd332923bba0916bf4da58820251bac3a0fac400d8ccaa7790e6ac9c2b9953b2036907ac205eba27", 0x40, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000000040)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0x7ffff000}], 0x1}}], 0x1, 0x0, 0x0) [ 2782.461621] binder: 6235:6236 ioctl c0306201 20000600 returned -22 14:36:15 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x68000000, 0x0, 0x0}) 14:36:15 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xf0\x00'}}}}, 0x68}}, 0x0) 14:36:15 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x48, 0x15, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f000001e3d8960f65b27ee8125f42360500000015739d53d5"]}, 0x48}}, 0x0) 14:36:15 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000400)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-serpent-sse2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) sendto(r1, &(0x7f0000001640)="3a5753f1b260d7aeae1fcc9bdc0ce301262ed6a3f32c23b5bd332923bba0916bf4da58820251bac3a0fac400d8ccaa7790e6ac9c2b9953b2036907ac205eba27", 0x40, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000000040)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0x7ffff000}], 0x1}}], 0x1, 0x0, 0x0) 14:36:15 executing program 3: socket$inet6(0xa, 0x80003, 0x800000000000006) r0 = socket$netlink(0x10, 0x3, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") poll(&(0x7f00000000c0)=[{r0}], 0x1, 0x80) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x48, 0x15, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f000001e3d8960f65b27ee8125f42360500000015739d53d5"]}, 0x48}}, 0x0) [ 2782.685670] binder: 6255:6258 unknown command 0 [ 2782.693263] netlink: 48 bytes leftover after parsing attributes in process `syz-executor0'. [ 2782.708750] binder: 6255:6258 ioctl c0306201 20000600 returned -22 14:36:15 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00`\x00'}}}}, 0x68}}, 0x0) 14:36:15 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2630440, 0x0, 0x0}) 14:36:15 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000400)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-serpent-sse2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) sendto(r1, &(0x7f0000001640)="3a5753f1b260d7aeae1fcc9bdc0ce301262ed6a3f32c23b5bd332923bba0916bf4da58820251bac3a0fac400d8ccaa7790e6ac9c2b9953b2036907ac205eba27b449ea35e5dd248c58bd44701eed02fd8a36a7688bed69bf2573108f72122b4d", 0x60, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000000040)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0x7ffff000}], 0x1}}], 0x1, 0x0, 0x0) 14:36:15 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f0000000040)='loginuid\x00') sendfile(r0, r0, &(0x7f0000000180)=0x74000004, 0x5) 14:36:15 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x48, 0x15, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f000001e3d8960f65b27ee8125f42360500000015739d53d5"]}, 0x48}}, 0x0) [ 2782.876121] binder: 6272:6273 unknown command 0 14:36:15 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03@\x00'}}}}, 0x68}}, 0x0) [ 2782.898884] binder: 6272:6273 ioctl c0306201 20000600 returned -22 [ 2782.910875] netlink: 48 bytes leftover after parsing attributes in process `syz-executor0'. [ 2782.929775] binder: 6272:6273 unknown command 0 [ 2782.943127] binder: 6272:6273 ioctl c0306201 20000600 returned -22 14:36:15 executing program 3: socket$inet6(0xa, 0x80003, 0x800000000000006) r0 = socket$netlink(0x10, 0x3, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") poll(&(0x7f00000000c0)=[{r0, 0x2001}], 0x1, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x48, 0x15, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f000001e3d8960f65b27ee8125f42360500000015739d53d5"]}, 0x48}}, 0x0) 14:36:15 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x40106308, 0x0, 0x0}) 14:36:15 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00'}}}}, 0x68}}, 0x0) 14:36:15 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000400)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-serpent-sse2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) sendto(r1, &(0x7f0000001640)="3a5753f1b260d7aeae1fcc9bdc0ce301262ed6a3f32c23b5bd332923bba0916bf4da58820251bac3a0fac400d8ccaa7790e6ac9c2b9953b2036907ac205eba27b449ea35e5dd248c58bd44701eed02fd8a36a7688bed69bf2573108f72122b4d", 0x60, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000000040)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0x7ffff000}], 0x1}}], 0x1, 0x0, 0x0) 14:36:16 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x48, 0x15, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f000001e3d8960f65b27ee8125f42360500000015739d53d5"]}, 0x48}}, 0x0) [ 2783.091121] binder: 6287:6292 unknown command 0 14:36:16 executing program 3: socket$inet6(0xa, 0x80003, 0x800000000000006) r0 = socket$netlink(0x10, 0x3, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") poll(&(0x7f00000000c0)=[{r0, 0x2001}], 0x1, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x48, 0x15, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f000001e3d8960f65b27ee8125f42360500000015739d53d5"]}, 0x48}}, 0x0) [ 2783.115917] binder: 6287:6292 ioctl c0306201 20000600 returned -22 [ 2783.132260] netlink: 48 bytes leftover after parsing attributes in process `syz-executor0'. 14:36:16 executing program 4: sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000180)=0x74000004, 0x5) 14:36:16 executing program 0: socket$netlink(0x10, 0x3, 0x4) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x48, 0x15, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f000001e3d8960f65b27ee8125f42360500000015739d53d5"]}, 0x48}}, 0x0) 14:36:16 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0f\x00'}}}}, 0x68}}, 0x0) 14:36:16 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x40406301, 0x0, 0x0}) 14:36:16 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000400)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-serpent-sse2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) sendto(r1, &(0x7f0000001640)="3a5753f1b260d7aeae1fcc9bdc0ce301262ed6a3f32c23b5bd332923bba0916bf4da58820251bac3a0fac400d8ccaa7790e6ac9c2b9953b2036907ac205eba27b449ea35e5dd248c58bd44701eed02fd8a36a7688bed69bf2573108f72122b4d", 0x60, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000000040)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0x7ffff000}], 0x1}}], 0x1, 0x0, 0x0) 14:36:16 executing program 3: socket$inet6(0xa, 0x80003, 0x800000000000006) r0 = socket$netlink(0x10, 0x3, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") poll(&(0x7f00000000c0)=[{r0, 0x2001}], 0x1, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x48, 0x15, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f000001e3d8960f65b27ee8125f42360500000015739d53d5"]}, 0x48}}, 0x0) [ 2783.314383] binder: 6307:6311 unknown command 0 [ 2783.329072] binder: 6307:6311 ioctl c0306201 20000600 returned -22 14:36:16 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x4) sendmsg$nl_generic(r0, 0x0, 0x0) 14:36:16 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000400)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-serpent-sse2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) sendto(r1, &(0x7f0000001640)="3a5753f1b260d7aeae1fcc9bdc0ce301262ed6a3f32c23b5bd332923bba0916bf4da58820251bac3a0fac400d8ccaa7790e6ac9c2b9953b2036907ac205eba27b449ea35e5dd248c58bd44701eed02fd8a36a7688bed69bf2573108f72122b4de877c8e1c0739e7e4523c7c0683f0b71", 0x70, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000000040)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0x7ffff000}], 0x1}}], 0x1, 0x0, 0x0) 14:36:16 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\n\x00'}}}}, 0x68}}, 0x0) 14:36:16 executing program 3: socket$inet6(0xa, 0x80003, 0x800000000000006) r0 = socket$netlink(0x10, 0x3, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") poll(&(0x7f00000000c0)=[{r0, 0x2001}], 0x1, 0x80) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x48, 0x15, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f000001e3d8960f65b27ee8125f42360500000015739d53d5"]}, 0x48}}, 0x0) 14:36:16 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x6800, 0x0, 0x0}) 14:36:16 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000400)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-serpent-sse2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) sendto(r1, &(0x7f0000001640)="3a5753f1b260d7aeae1fcc9bdc0ce301262ed6a3f32c23b5bd332923bba0916bf4da58820251bac3a0fac400d8ccaa7790e6ac9c2b9953b2036907ac205eba27b449ea35e5dd248c58bd44701eed02fd8a36a7688bed69bf2573108f72122b4de877c8e1c0739e7e4523c7c0683f0b71", 0x70, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000000040)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0x7ffff000}], 0x1}}], 0x1, 0x0, 0x0) 14:36:16 executing program 4: r0 = syz_open_procfs(0x0, 0x0) sendfile(r0, r0, &(0x7f0000000180)=0x74000004, 0x5) 14:36:16 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x4) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, 0x0}, 0x0) 14:36:16 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00'}}}}, 0x68}}, 0x0) [ 2783.543677] binder: 6327:6329 unknown command 0 [ 2783.561358] binder: 6327:6329 ioctl c0306201 20000600 returned -22 14:36:16 executing program 3: socket$inet6(0xa, 0x80003, 0x800000000000006) r0 = socket$netlink(0x10, 0x3, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") poll(&(0x7f00000000c0)=[{r0, 0x2001}], 0x1, 0x80) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x48, 0x15, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f000001e3d8960f65b27ee8125f42360500000015739d53d5"]}, 0x48}}, 0x0) 14:36:16 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x4) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={0x0}}, 0x0) 14:36:16 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x1200000000000000, 0x0, 0x0}) 14:36:16 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000400)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-serpent-sse2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) sendto(r1, &(0x7f0000001640)="3a5753f1b260d7aeae1fcc9bdc0ce301262ed6a3f32c23b5bd332923bba0916bf4da58820251bac3a0fac400d8ccaa7790e6ac9c2b9953b2036907ac205eba27b449ea35e5dd248c58bd44701eed02fd8a36a7688bed69bf2573108f72122b4de877c8e1c0739e7e4523c7c0683f0b71", 0x70, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000000040)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0x7ffff000}], 0x1}}], 0x1, 0x0, 0x0) 14:36:16 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x04\x00'}}}}, 0x68}}, 0x0) [ 2783.728183] binder: 6343:6344 unknown command 0 [ 2783.759853] binder: 6343:6344 ioctl c0306201 20000600 returned -22 14:36:16 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x4) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={0x0}}, 0x0) 14:36:16 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x20000000, 0x0, 0x0}) 14:36:16 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000400)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-serpent-sse2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) sendto(r1, &(0x7f0000001640)="3a5753f1b260d7aeae1fcc9bdc0ce301262ed6a3f32c23b5bd332923bba0916bf4da58820251bac3a0fac400d8ccaa7790e6ac9c2b9953b2036907ac205eba27b449ea35e5dd248c58bd44701eed02fd8a36a7688bed69bf2573108f72122b4de877c8e1c0739e7e4523c7c0683f0b7184b014a148f96c57", 0x78, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000000040)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0x7ffff000}], 0x1}}], 0x1, 0x0, 0x0) 14:36:16 executing program 3: socket$inet6(0xa, 0x80003, 0x800000000000006) r0 = socket$netlink(0x10, 0x3, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") poll(&(0x7f00000000c0)=[{r0, 0x2001}], 0x1, 0x80) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x48, 0x15, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f000001e3d8960f65b27ee8125f42360500000015739d53d5"]}, 0x48}}, 0x0) [ 2783.904656] binder: 6357:6358 unknown command 0 [ 2783.909657] binder: 6357:6358 ioctl c0306201 20000600 returned -22 14:36:16 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f0000000040)='loginuid\x00') sendfile(0xffffffffffffffff, r0, &(0x7f0000000180)=0x74000004, 0x5) 14:36:16 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xfc\x00'}}}}, 0x68}}, 0x0) 14:36:16 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x4) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={0x0}}, 0x0) 14:36:16 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000400)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-serpent-sse2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) sendto(r1, &(0x7f0000001640)="3a5753f1b260d7aeae1fcc9bdc0ce301262ed6a3f32c23b5bd332923bba0916bf4da58820251bac3a0fac400d8ccaa7790e6ac9c2b9953b2036907ac205eba27b449ea35e5dd248c58bd44701eed02fd8a36a7688bed69bf2573108f72122b4de877c8e1c0739e7e4523c7c0683f0b7184b014a148f96c57f61020c2", 0x7c, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000000040)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0x7ffff000}], 0x1}}], 0x1, 0x0, 0x0) 14:36:16 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x1000000, 0x0, 0x0}) 14:36:16 executing program 3: socket$inet6(0xa, 0x80003, 0x800000000000006) r0 = socket$netlink(0x10, 0x3, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") poll(&(0x7f00000000c0)=[{r0, 0x2001}], 0x1, 0x80) sendmsg$TEAM_CMD_OPTIONS_SET(r0, 0x0, 0x0) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x48, 0x15, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f000001e3d8960f65b27ee8125f42360500000015739d53d5"]}, 0x48}}, 0x0) [ 2784.063675] binder: 6373:6374 unknown command 0 14:36:17 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000400)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-serpent-sse2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) sendto(r1, &(0x7f0000001640)="3a5753f1b260d7aeae1fcc9bdc0ce301262ed6a3f32c23b5bd332923bba0916bf4da58820251bac3a0fac400d8ccaa7790e6ac9c2b9953b2036907ac205eba27b449ea35e5dd248c58bd44701eed02fd8a36a7688bed69bf2573108f72122b4de877c8e1c0739e7e4523c7c0683f0b7184b014a148f96c57f61020c28bd6", 0x7e, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000000040)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0x7ffff000}], 0x1}}], 0x1, 0x0, 0x0) [ 2784.089695] binder: 6373:6374 ioctl c0306201 20000600 returned -22 14:36:17 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x4) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x48, 0x0, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f000001e3d8960f65b27ee8125f42360500000015739d53d5"]}, 0x48}}, 0x0) 14:36:17 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x10, 0x0, 0x0}) 14:36:17 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x004\x8c\x00'}}}}, 0x68}}, 0x0) [ 2784.193678] binder: 6386:6387 unknown command 0 14:36:17 executing program 3: socket$inet6(0xa, 0x80003, 0x800000000000006) r0 = socket$netlink(0x10, 0x3, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") poll(&(0x7f00000000c0)=[{r0, 0x2001}], 0x1, 0x80) sendmsg$TEAM_CMD_OPTIONS_SET(r0, 0x0, 0x0) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x48, 0x15, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f000001e3d8960f65b27ee8125f42360500000015739d53d5"]}, 0x48}}, 0x0) [ 2784.230903] binder: 6386:6387 ioctl c0306201 20000600 returned -22 14:36:17 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000400)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-serpent-sse2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) sendto(r1, &(0x7f0000001640)="3a5753f1b260d7aeae1fcc9bdc0ce301262ed6a3f32c23b5bd332923bba0916bf4da58820251bac3a0fac400d8ccaa7790e6ac9c2b9953b2036907ac205eba27b449ea35e5dd248c58bd44701eed02fd8a36a7688bed69bf2573108f72122b4de877c8e1c0739e7e4523c7c0683f0b7184b014a148f96c57f61020c28bd65e", 0x7f, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000000040)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0x7ffff000}], 0x1}}], 0x1, 0x0, 0x0) 14:36:17 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f0000000040)='loginuid\x00') sendfile(r0, 0xffffffffffffffff, &(0x7f0000000180)=0x74000004, 0x5) 14:36:17 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x4) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x48, 0x0, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f000001e3d8960f65b27ee8125f42360500000015739d53d5"]}, 0x48}}, 0x0) 14:36:17 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x68, 0x0, 0x0}) 14:36:17 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xa1\xff\xff\xff\x00'}}}}, 0x68}}, 0x0) 14:36:17 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000400)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-serpent-sse2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) sendto(r1, &(0x7f0000001640)="3a5753f1b260d7aeae1fcc9bdc0ce301262ed6a3f32c23b5bd332923bba0916bf4da58820251bac3a0fac400d8ccaa7790e6ac9c2b9953b2036907ac205eba27b449ea35e5dd248c58bd44701eed02fd8a36a7688bed69bf2573108f72122b4de877c8e1c0739e7e4523c7c0683f0b7184b014a148f96c57f61020c28bd65eba", 0x80, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000000040)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0x7ffff000}], 0x1}}], 0x1, 0x0, 0x0) 14:36:17 executing program 3: socket$inet6(0xa, 0x80003, 0x800000000000006) r0 = socket$netlink(0x10, 0x3, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") poll(&(0x7f00000000c0)=[{r0, 0x2001}], 0x1, 0x80) sendmsg$TEAM_CMD_OPTIONS_SET(r0, 0x0, 0x0) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x48, 0x15, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f000001e3d8960f65b27ee8125f42360500000015739d53d5"]}, 0x48}}, 0x0) [ 2784.433678] binder: 6401:6402 unknown command 0 [ 2784.464736] binder: 6401:6402 ioctl c0306201 20000600 returned -22 14:36:17 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000400)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-serpent-sse2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) sendto(r1, &(0x7f0000001640)="3a5753f1b260d7aeae1fcc9bdc0ce301262ed6a3f32c23b5bd332923bba0916bf4da58820251bac3a0fac400d8ccaa7790e6ac9c2b9953b2036907ac205eba27b449ea35e5dd248c58bd44701eed02fd8a36a7688bed69bf2573108f72122b4de877c8e1c0739e7e4523c7c0683f0b7184b014a148f96c57f61020c28bd65eba", 0x80, 0x0, 0x0, 0x0) recvmmsg(r1, 0x0, 0x0, 0x0, 0x0) 14:36:17 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x4) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x48, 0x0, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f000001e3d8960f65b27ee8125f42360500000015739d53d5"]}, 0x48}}, 0x0) 14:36:17 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xa1\x00'}}}}, 0x68}}, 0x0) 14:36:17 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x3630840, 0x0, 0x0}) 14:36:17 executing program 3: socket$inet6(0xa, 0x80003, 0x800000000000006) r0 = socket$netlink(0x10, 0x3, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") poll(&(0x7f00000000c0)=[{r0, 0x2001}], 0x1, 0x80) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000007680)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x48, 0x15, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f000001e3d8960f65b27ee8125f42360500000015739d53d5"]}, 0x48}}, 0x0) 14:36:17 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000400)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-serpent-sse2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) sendto(r1, &(0x7f0000001640)="3a5753f1b260d7aeae1fcc9bdc0ce301262ed6a3f32c23b5bd332923bba0916bf4da58820251bac3a0fac400d8ccaa7790e6ac9c2b9953b2036907ac205eba27b449ea35e5dd248c58bd44701eed02fd8a36a7688bed69bf2573108f72122b4de877c8e1c0739e7e4523c7c0683f0b7184b014a148f96c57f61020c28bd65eba", 0x80, 0x0, 0x0, 0x0) recvmmsg(r1, 0x0, 0x0, 0x0, 0x0) [ 2784.677441] binder: 6424:6426 unknown command 0 [ 2784.682367] binder: 6424:6426 ioctl c0306201 20000600 returned -22 14:36:17 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f0000000040)='loginuid\x00') sendfile(r0, r0, 0x0, 0x5) 14:36:17 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0f\x00'}}}}, 0x68}}, 0x0) 14:36:17 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x4) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x48, 0x15, 0x0, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f000001e3d8960f65b27ee8125f42360500000015739d53d5"]}, 0x48}}, 0x0) 14:36:17 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000400)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-serpent-sse2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) sendto(r1, &(0x7f0000001640)="3a5753f1b260d7aeae1fcc9bdc0ce301262ed6a3f32c23b5bd332923bba0916bf4da58820251bac3a0fac400d8ccaa7790e6ac9c2b9953b2036907ac205eba27b449ea35e5dd248c58bd44701eed02fd8a36a7688bed69bf2573108f72122b4de877c8e1c0739e7e4523c7c0683f0b7184b014a148f96c57f61020c28bd65eba", 0x80, 0x0, 0x0, 0x0) recvmmsg(r1, 0x0, 0x0, 0x0, 0x0) 14:36:17 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48000000, 0x0, 0x0}) 14:36:17 executing program 3: socket$inet6(0xa, 0x80003, 0x800000000000006) r0 = socket$netlink(0x10, 0x3, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") poll(&(0x7f00000000c0)=[{r0, 0x2001}], 0x1, 0x80) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000007680)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x48, 0x15, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f000001e3d8960f65b27ee8125f42360500000015739d53d5"]}, 0x48}}, 0x0) 14:36:17 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x4) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x48, 0x15, 0x0, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f000001e3d8960f65b27ee8125f42360500000015739d53d5"]}, 0x48}}, 0x0) 14:36:17 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000400)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-serpent-sse2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) sendto(r1, &(0x7f0000001640)="3a5753f1b260d7aeae1fcc9bdc0ce301262ed6a3f32c23b5bd332923bba0916bf4da58820251bac3a0fac400d8ccaa7790e6ac9c2b9953b2036907ac205eba27b449ea35e5dd248c58bd44701eed02fd8a36a7688bed69bf2573108f72122b4de877c8e1c0739e7e4523c7c0683f0b7184b014a148f96c57f61020c28bd65eba", 0x80, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000000040), 0x0, 0x0, 0x0) 14:36:17 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00'}}}}, 0x68}}, 0x0) [ 2784.897450] binder_thread_write: 19 callbacks suppressed [ 2784.897488] binder: 6443:6445 BC_ACQUIRE_DONE u0000000000000000 no match 14:36:17 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000400)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-serpent-sse2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) sendto(r1, &(0x7f0000001640)="3a5753f1b260d7aeae1fcc9bdc0ce301262ed6a3f32c23b5bd332923bba0916bf4da58820251bac3a0fac400d8ccaa7790e6ac9c2b9953b2036907ac205eba27b449ea35e5dd248c58bd44701eed02fd8a36a7688bed69bf2573108f72122b4de877c8e1c0739e7e4523c7c0683f0b7184b014a148f96c57f61020c28bd65eba", 0x80, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000000040), 0x0, 0x0, 0x0) [ 2784.993189] binder: 6443:6445 unknown command 0 14:36:17 executing program 3: socket$inet6(0xa, 0x80003, 0x800000000000006) r0 = socket$netlink(0x10, 0x3, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") poll(&(0x7f00000000c0)=[{r0, 0x2001}], 0x1, 0x80) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000007680)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x48, 0x15, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f000001e3d8960f65b27ee8125f42360500000015739d53d5"]}, 0x48}}, 0x0) 14:36:18 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x4) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x48, 0x15, 0x0, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f000001e3d8960f65b27ee8125f42360500000015739d53d5"]}, 0x48}}, 0x0) [ 2785.021553] binder: 6443:6445 ioctl c0306201 20000600 returned -22 14:36:18 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f0000000040)='loginuid\x00') sendfile(r0, r0, &(0x7f0000000180), 0x5) 14:36:18 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0e\x00'}}}}, 0x68}}, 0x0) 14:36:18 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000400)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-serpent-sse2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) sendto(r1, &(0x7f0000001640)="3a5753f1b260d7aeae1fcc9bdc0ce301262ed6a3f32c23b5bd332923bba0916bf4da58820251bac3a0fac400d8ccaa7790e6ac9c2b9953b2036907ac205eba27b449ea35e5dd248c58bd44701eed02fd8a36a7688bed69bf2573108f72122b4de877c8e1c0739e7e4523c7c0683f0b7184b014a148f96c57f61020c28bd65eba", 0x80, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000000040), 0x0, 0x0, 0x0) [ 2785.076750] binder: 6443:6445 BC_ACQUIRE_DONE u0000000000000000 no match [ 2785.102041] binder: 6443:6445 unknown command 0 14:36:18 executing program 3: socket$inet6(0xa, 0x80003, 0x800000000000006) r0 = socket$netlink(0x10, 0x3, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") poll(&(0x7f00000000c0)=[{r0, 0x2001}], 0x1, 0x80) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x48, 0x15, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f000001e3d8960f65b27ee8125f42360500000015739d53d5"]}, 0x48}}, 0x0) [ 2785.157313] binder: 6443:6445 ioctl c0306201 20000600 returned -22 14:36:18 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x74000000, 0x0, 0x0}) 14:36:18 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x4) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x48, 0x15, 0x7, 0x0, 0x0, {0x0, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f000001e3d8960f65b27ee8125f42360500000015739d53d5"]}, 0x48}}, 0x0) 14:36:18 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000400)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-serpent-sse2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) sendto(r1, &(0x7f0000001640)="3a5753f1b260d7aeae1fcc9bdc0ce301262ed6a3f32c23b5bd332923bba0916bf4da58820251bac3a0fac400d8ccaa7790e6ac9c2b9953b2036907ac205eba27b449ea35e5dd248c58bd44701eed02fd8a36a7688bed69bf2573108f72122b4de877c8e1c0739e7e4523c7c0683f0b7184b014a148f96c57f61020c28bd65eba", 0x80, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000000040)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) 14:36:18 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x7f\xff\xff\xff\x00'}}}}, 0x68}}, 0x0) [ 2785.301318] binder: 6478:6482 BC_ACQUIRE_DONE u0000000000000000 no match 14:36:18 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x4) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x48, 0x15, 0x7, 0x0, 0x0, {0x0, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f000001e3d8960f65b27ee8125f42360500000015739d53d5"]}, 0x48}}, 0x0) [ 2785.350301] binder: 6478:6482 unknown command 0 14:36:18 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000400)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-serpent-sse2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) sendto(r1, &(0x7f0000001640)="3a5753f1b260d7aeae1fcc9bdc0ce301262ed6a3f32c23b5bd332923bba0916bf4da58820251bac3a0fac400d8ccaa7790e6ac9c2b9953b2036907ac205eba27b449ea35e5dd248c58bd44701eed02fd8a36a7688bed69bf2573108f72122b4de877c8e1c0739e7e4523c7c0683f0b7184b014a148f96c57f61020c28bd65eba", 0x80, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000000040)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) 14:36:18 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xf0\x00'}}}}, 0x68}}, 0x0) [ 2785.371344] binder: 6478:6482 ioctl c0306201 20000600 returned -22 14:36:18 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x40046307, 0x0, 0x0}) [ 2785.548621] binder: 6497:6498 BC_ACQUIRE_DONE u0000000000000000 no match [ 2785.555992] binder: 6497:6498 unknown command 0 [ 2785.560876] binder: 6497:6498 ioctl c0306201 20000600 returned -22 14:36:18 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f0000000040)='loginuid\x00') sendfile(r0, r0, &(0x7f0000000180)=0x74000004, 0x0) 14:36:18 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x4) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x48, 0x15, 0x7, 0x0, 0x0, {0x0, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f000001e3d8960f65b27ee8125f42360500000015739d53d5"]}, 0x48}}, 0x0) 14:36:18 executing program 3: socket$inet6(0xa, 0x80003, 0x800000000000006) r0 = socket$netlink(0x10, 0x3, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") poll(&(0x7f00000000c0)=[{r0, 0x2001}], 0x1, 0x80) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x48, 0x15, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f000001e3d8960f65b27ee8125f42360500000015739d53d5"]}, 0x48}}, 0x0) 14:36:18 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000400)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-serpent-sse2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) sendto(r1, &(0x7f0000001640)="3a5753f1b260d7aeae1fcc9bdc0ce301262ed6a3f32c23b5bd332923bba0916bf4da58820251bac3a0fac400d8ccaa7790e6ac9c2b9953b2036907ac205eba27b449ea35e5dd248c58bd44701eed02fd8a36a7688bed69bf2573108f72122b4de877c8e1c0739e7e4523c7c0683f0b7184b014a148f96c57f61020c28bd65eba", 0x80, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000000040)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) 14:36:18 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00'}}}}, 0x68}}, 0x0) 14:36:18 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x40486311, 0x0, 0x0}) 14:36:18 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x4) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x14, 0x15, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}}, 0x14}}, 0x0) 14:36:18 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00'}}}}, 0x68}}, 0x0) 14:36:18 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000400)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-serpent-sse2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) sendto(r1, &(0x7f0000001640)="3a5753f1b260d7aeae1fcc9bdc0ce301262ed6a3f32c23b5bd332923bba0916bf4da58820251bac3a0fac400d8ccaa7790e6ac9c2b9953b2036907ac205eba27b449ea35e5dd248c58bd44701eed02fd8a36a7688bed69bf2573108f72122b4de877c8e1c0739e7e4523c7c0683f0b7184b014a148f96c57f61020c28bd65eba", 0x80, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000000040)=[{{0x0, 0x0, &(0x7f0000001600)}}], 0x1, 0x0, 0x0) [ 2785.683491] binder: 6510:6511 BC_ACQUIRE_DONE u0000000000000000 no match [ 2785.706113] binder: 6510:6511 unknown command 0 [ 2785.725370] binder: 6510:6511 ioctl c0306201 20000600 returned -22 14:36:18 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xd63, 0x0, 0x0}) 14:36:18 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x4) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x14, 0x15, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}}, 0x14}}, 0x0) 14:36:18 executing program 3: socket$inet6(0xa, 0x80003, 0x800000000000006) r0 = socket$netlink(0x10, 0x3, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") poll(&(0x7f00000000c0)=[{r0, 0x2001}], 0x1, 0x80) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x48, 0x15, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f000001e3d8960f65b27ee8125f42360500000015739d53d5"]}, 0x48}}, 0x0) [ 2785.928026] binder: 6529:6530 BC_ACQUIRE_DONE u0000000000000000 no match [ 2785.952447] binder: 6529:6530 unknown command 0 [ 2785.957789] binder: 6529:6530 ioctl c0306201 20000600 returned -22 14:36:18 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xa00000000000000, 0x0, 0x0}) 14:36:18 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xa1\x00'}}}}, 0x68}}, 0x0) 14:36:18 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000400)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-serpent-sse2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) sendto(r1, &(0x7f0000001640)="3a5753f1b260d7aeae1fcc9bdc0ce301262ed6a3f32c23b5bd332923bba0916bf4da58820251bac3a0fac400d8ccaa7790e6ac9c2b9953b2036907ac205eba27b449ea35e5dd248c58bd44701eed02fd8a36a7688bed69bf2573108f72122b4de877c8e1c0739e7e4523c7c0683f0b7184b014a148f96c57f61020c28bd65eba", 0x80, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000000040)=[{{0x0, 0x0, &(0x7f0000001600)}}], 0x1, 0x0, 0x0) 14:36:18 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x4) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x14, 0x15, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}}, 0x14}}, 0x0) 14:36:18 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_dev$mice(0x0, 0x0, 0x0) write$FUSE_INIT(r1, &(0x7f0000000040)={0x50, 0x0, 0x5, {0x7, 0x1c, 0x0, 0x0, 0x2, 0x0, 0x0, 0x9}}, 0x50) r2 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000380)=0x6) r3 = syz_open_procfs(0x0, &(0x7f00000001c0)='mounts\x00') sendfile(r3, r3, &(0x7f0000000180)=0x74000000, 0x5) 14:36:19 executing program 3: socket$inet6(0xa, 0x80003, 0x800000000000006) r0 = socket$netlink(0x10, 0x3, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") poll(&(0x7f00000000c0)=[{r0, 0x2001}], 0x1, 0x80) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) sendmsg$nl_generic(r0, 0x0, 0x0) [ 2786.041582] binder: 6539:6540 BC_ACQUIRE_DONE u0000000000000000 no match [ 2786.076289] binder: 6539:6540 unknown command 0 14:36:19 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x4) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x14, 0x15, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic]}, 0x14}}, 0x0) 14:36:19 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00'}}}}, 0x68}}, 0x0) [ 2786.114239] binder: 6539:6540 ioctl c0306201 20000600 returned -22 14:36:19 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x8631040, 0x0, 0x0}) 14:36:19 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000400)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-serpent-sse2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) sendto(r1, &(0x7f0000001640)="3a5753f1b260d7aeae1fcc9bdc0ce301262ed6a3f32c23b5bd332923bba0916bf4da58820251bac3a0fac400d8ccaa7790e6ac9c2b9953b2036907ac205eba27b449ea35e5dd248c58bd44701eed02fd8a36a7688bed69bf2573108f72122b4de877c8e1c0739e7e4523c7c0683f0b7184b014a148f96c57f61020c28bd65eba", 0x80, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000000040)=[{{0x0, 0x0, &(0x7f0000001600)}}], 0x1, 0x0, 0x0) 14:36:19 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x4) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x14, 0x15, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic]}, 0x14}}, 0x0) [ 2786.234901] binder: 6555:6556 BC_ACQUIRE_DONE u0000000000000000 no match [ 2786.267032] binder: 6555:6556 unknown command 0 14:36:19 executing program 3: socket$inet6(0xa, 0x80003, 0x800000000000006) r0 = socket$netlink(0x10, 0x3, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") poll(&(0x7f00000000c0)=[{r0, 0x2001}], 0x1, 0x80) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, 0x0}, 0x0) 14:36:19 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@\x03\x00'}}}}, 0x68}}, 0x0) [ 2786.296813] binder: 6555:6556 ioctl c0306201 20000600 returned -22 [ 2786.323248] binder: 6555:6556 BC_ACQUIRE_DONE u0000000000000000 no match [ 2786.365723] binder: 6555:6556 unknown command 0 14:36:19 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000400)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-serpent-sse2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) sendto(r1, &(0x7f0000001640)="3a5753f1b260d7aeae1fcc9bdc0ce301262ed6a3f32c23b5bd332923bba0916bf4da58820251bac3a0fac400d8ccaa7790e6ac9c2b9953b2036907ac205eba27b449ea35e5dd248c58bd44701eed02fd8a36a7688bed69bf2573108f72122b4de877c8e1c0739e7e4523c7c0683f0b7184b014a148f96c57f61020c28bd65eba", 0x80, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000000040)=[{{0x0, 0x0, &(0x7f0000001600)=[{0x0}], 0x1}}], 0x1, 0x0, 0x0) 14:36:19 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x4) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x14, 0x15, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic]}, 0x14}}, 0x0) [ 2786.391879] binder: 6555:6556 ioctl c0306201 20000600 returned -22 14:36:19 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x6, 0x0, 0x0}) [ 2786.538030] binder: 6576:6578 BC_ACQUIRE_DONE u0000000000000000 no match [ 2786.563986] binder: 6576:6578 unknown command 0 [ 2786.568874] binder: 6576:6578 ioctl c0306201 20000600 returned -22 14:36:19 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_dev$mice(0x0, 0x0, 0x0) write$FUSE_INIT(r1, &(0x7f0000000040)={0x50, 0x0, 0x5, {0x7, 0x1c, 0x0, 0x0, 0x2, 0x0, 0x0, 0x9}}, 0x50) r2 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000380)=0x6) r3 = syz_open_procfs(0x0, &(0x7f00000001c0)='mounts\x00') sendfile(r3, r3, &(0x7f0000000180)=0x74000000, 0x5) 14:36:19 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000400)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-serpent-sse2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) sendto(r1, &(0x7f0000001640)="3a5753f1b260d7aeae1fcc9bdc0ce301262ed6a3f32c23b5bd332923bba0916bf4da58820251bac3a0fac400d8ccaa7790e6ac9c2b9953b2036907ac205eba27b449ea35e5dd248c58bd44701eed02fd8a36a7688bed69bf2573108f72122b4de877c8e1c0739e7e4523c7c0683f0b7184b014a148f96c57f61020c28bd65eba", 0x80, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000000040)=[{{0x0, 0x0, &(0x7f0000001600)=[{0x0}], 0x1}}], 0x1, 0x0, 0x0) 14:36:19 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xfc\x00'}}}}, 0x68}}, 0x0) 14:36:19 executing program 3: socket$inet6(0xa, 0x80003, 0x800000000000006) r0 = socket$netlink(0x10, 0x3, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") poll(&(0x7f00000000c0)=[{r0, 0x2001}], 0x1, 0x80) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={0x0}}, 0x0) 14:36:19 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x4) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x30, 0x15, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f"]}, 0x30}}, 0x0) 14:36:19 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x200000000000000, 0x0, 0x0}) [ 2786.741834] binder: 6586:6587 unknown command 0 [ 2786.759383] binder: 6586:6587 ioctl c0306201 20000600 returned -22 14:36:19 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000400)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-serpent-sse2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) sendto(r1, &(0x7f0000001640)="3a5753f1b260d7aeae1fcc9bdc0ce301262ed6a3f32c23b5bd332923bba0916bf4da58820251bac3a0fac400d8ccaa7790e6ac9c2b9953b2036907ac205eba27b449ea35e5dd248c58bd44701eed02fd8a36a7688bed69bf2573108f72122b4de877c8e1c0739e7e4523c7c0683f0b7184b014a148f96c57f61020c28bd65eba", 0x80, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000000040)=[{{0x0, 0x0, &(0x7f0000001600)=[{0x0}], 0x1}}], 0x1, 0x0, 0x0) 14:36:19 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x4) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x30, 0x15, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f"]}, 0x30}}, 0x0) 14:36:19 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xf630c4000000000, 0x0, 0x0}) 14:36:19 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00'}}}}, 0x68}}, 0x0) 14:36:19 executing program 3: socket$inet6(0xa, 0x80003, 0x800000000000006) r0 = socket$netlink(0x10, 0x3, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") poll(&(0x7f00000000c0)=[{r0, 0x2001}], 0x1, 0x80) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={0x0}}, 0x0) [ 2786.935095] binder: 6605:6606 unknown command 0 [ 2786.978695] binder: 6605:6606 ioctl c0306201 20000600 returned -22 14:36:19 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x4) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x30, 0x15, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f"]}, 0x30}}, 0x0) 14:36:20 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_dev$mice(0x0, 0x0, 0x0) write$FUSE_INIT(r1, &(0x7f0000000040)={0x50, 0x0, 0x5, {0x7, 0x1c, 0x0, 0x0, 0x2, 0x0, 0x0, 0x9}}, 0x50) r2 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000380)=0x6) r3 = syz_open_procfs(0x0, &(0x7f00000001c0)='mounts\x00') sendfile(r3, r3, &(0x7f0000000180)=0x74000000, 0x5) 14:36:20 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_dev$mice(0x0, 0x0, 0x0) write$FUSE_INIT(r1, &(0x7f0000000040)={0x50, 0x0, 0x5, {0x7, 0x1c, 0x0, 0x0, 0x2, 0x0, 0x0, 0x9}}, 0x50) r2 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000380)=0x6) r3 = syz_open_procfs(0x0, &(0x7f00000001c0)='mounts\x00') sendfile(r3, r3, &(0x7f0000000180)=0x74000000, 0x5) 14:36:20 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xea\x00'}}}}, 0x68}}, 0x0) 14:36:20 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x6000000, 0x0, 0x0}) 14:36:20 executing program 3: socket$inet6(0xa, 0x80003, 0x800000000000006) r0 = socket$netlink(0x10, 0x3, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") poll(&(0x7f00000000c0)=[{r0, 0x2001}], 0x1, 0x80) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={0x0}}, 0x0) 14:36:20 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x4) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x3c, 0x15, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f000001e3d8960f65b27ee812"]}, 0x3c}}, 0x0) [ 2787.446625] binder: 6623:6624 unknown command 0 14:36:20 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x4) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x3c, 0x15, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f000001e3d8960f65b27ee812"]}, 0x3c}}, 0x0) [ 2787.481220] binder: 6623:6624 ioctl c0306201 20000600 returned -22 14:36:20 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x40086310, 0x0, 0x0}) [ 2787.591315] binder: 6636:6637 unknown command 0 14:36:20 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xfc\xff\xff\xff\x00'}}}}, 0x68}}, 0x0) 14:36:20 executing program 3: socket$inet6(0xa, 0x80003, 0x800000000000006) r0 = socket$netlink(0x10, 0x3, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") poll(&(0x7f00000000c0)=[{r0, 0x2001}], 0x1, 0x80) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x48, 0x0, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f000001e3d8960f65b27ee8125f42360500000015739d53d5"]}, 0x48}}, 0x0) [ 2787.613114] binder: 6636:6637 ioctl c0306201 20000600 returned -22 14:36:20 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x4) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x3c, 0x15, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f000001e3d8960f65b27ee812"]}, 0x3c}}, 0x0) 14:36:20 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x400c630e, 0x0, 0x0}) [ 2787.825923] binder: 6653:6654 unknown command 0 [ 2787.830852] binder: 6653:6654 ioctl c0306201 20000600 returned -22 14:36:21 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_dev$mice(0x0, 0x0, 0x0) write$FUSE_INIT(r1, &(0x7f0000000040)={0x50, 0x0, 0x5, {0x7, 0x1c, 0x0, 0x0, 0x2, 0x0, 0x0, 0x9}}, 0x50) r2 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000380)=0x6) r3 = syz_open_procfs(0x0, &(0x7f00000001c0)='mounts\x00') sendfile(r3, r3, &(0x7f0000000180)=0x74000000, 0x5) 14:36:21 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x9e\xff\xff\xff\x00'}}}}, 0x68}}, 0x0) 14:36:21 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_dev$mice(0x0, 0x0, 0x0) write$FUSE_INIT(r1, &(0x7f0000000040)={0x50, 0x0, 0x5, {0x7, 0x1c, 0x0, 0x0, 0x2, 0x0, 0x0, 0x9}}, 0x50) r2 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000380)=0x6) r3 = syz_open_procfs(0x0, &(0x7f00000001c0)='mounts\x00') sendfile(r3, r3, &(0x7f0000000180)=0x74000000, 0x5) 14:36:21 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x4) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x40, 0x15, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f000001e3d8960f65b27ee8125f4236050000"]}, 0x40}}, 0x0) 14:36:21 executing program 3: socket$inet6(0xa, 0x80003, 0x800000000000006) r0 = socket$netlink(0x10, 0x3, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") poll(&(0x7f00000000c0)=[{r0, 0x2001}], 0x1, 0x80) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x48, 0x0, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f000001e3d8960f65b27ee8125f42360500000015739d53d5"]}, 0x48}}, 0x0) 14:36:21 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x60, 0x0, 0x0}) [ 2788.128219] binder: 6665:6666 unknown command 0 [ 2788.164927] binder: 6665:6666 ioctl c0306201 20000600 returned -22 14:36:21 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x4) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x40, 0x15, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f000001e3d8960f65b27ee8125f4236050000"]}, 0x40}}, 0x0) 14:36:21 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00'}}}}, 0x68}}, 0x0) 14:36:21 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x4, 0x0, 0x0}) 14:36:21 executing program 3: socket$inet6(0xa, 0x80003, 0x800000000000006) r0 = socket$netlink(0x10, 0x3, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") poll(&(0x7f00000000c0)=[{r0, 0x2001}], 0x1, 0x80) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x48, 0x0, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f000001e3d8960f65b27ee8125f42360500000015739d53d5"]}, 0x48}}, 0x0) 14:36:21 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xf0\xff\xff\xff\x00'}}}}, 0x68}}, 0x0) 14:36:21 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x4) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x40, 0x15, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f000001e3d8960f65b27ee8125f4236050000"]}, 0x40}}, 0x0) [ 2788.390387] binder: 6681:6684 unknown command 0 [ 2788.417629] binder: 6681:6684 ioctl c0306201 20000600 returned -22 14:36:21 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_dev$mice(0x0, 0x0, 0x0) write$FUSE_INIT(r1, &(0x7f0000000040)={0x50, 0x0, 0x5, {0x7, 0x1c, 0x0, 0x0, 0x2, 0x0, 0x0, 0x9}}, 0x50) r2 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000380)=0x6) syz_open_procfs(0x0, &(0x7f00000001c0)='mounts\x00') 14:36:21 executing program 3: socket$inet6(0xa, 0x80003, 0x800000000000006) r0 = socket$netlink(0x10, 0x3, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") poll(&(0x7f00000000c0)=[{r0, 0x2001}], 0x1, 0x80) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x48, 0x15, 0x0, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f000001e3d8960f65b27ee8125f42360500000015739d53d5"]}, 0x48}}, 0x0) 14:36:21 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x4) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x44, 0x15, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f000001e3d8960f65b27ee8125f4236050000001573"]}, 0x44}}, 0x0) 14:36:21 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\n\x00'}}}}, 0x68}}, 0x0) 14:36:21 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x100000000000000, 0x0, 0x0}) 14:36:21 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_dev$mice(0x0, 0x0, 0x0) write$FUSE_INIT(r1, &(0x7f0000000040)={0x50, 0x0, 0x5, {0x7, 0x1c, 0x0, 0x0, 0x2, 0x0, 0x0, 0x9}}, 0x50) r2 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000380)=0x6) r3 = syz_open_procfs(0x0, &(0x7f00000001c0)='mounts\x00') sendfile(r3, r3, &(0x7f0000000180)=0x74000000, 0x5) [ 2788.772175] binder: 6698:6699 unknown command 0 14:36:21 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x4) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x44, 0x15, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f000001e3d8960f65b27ee8125f4236050000001573"]}, 0x44}}, 0x0) [ 2788.824291] binder: 6698:6699 ioctl c0306201 20000600 returned -22 14:36:21 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xf0\xff\xff\x00'}}}}, 0x68}}, 0x0) 14:36:21 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x5000000, 0x0, 0x0}) 14:36:21 executing program 3: socket$inet6(0xa, 0x80003, 0x800000000000006) r0 = socket$netlink(0x10, 0x3, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") poll(&(0x7f00000000c0)=[{r0, 0x2001}], 0x1, 0x80) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x48, 0x15, 0x0, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f000001e3d8960f65b27ee8125f42360500000015739d53d5"]}, 0x48}}, 0x0) 14:36:21 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x4) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x44, 0x15, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f000001e3d8960f65b27ee8125f4236050000001573"]}, 0x44}}, 0x0) 14:36:21 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_dev$mice(0x0, 0x0, 0x0) write$FUSE_INIT(r1, &(0x7f0000000040)={0x50, 0x0, 0x5, {0x7, 0x1c, 0x0, 0x0, 0x2, 0x0, 0x0, 0x9}}, 0x50) r2 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000380)=0x6) syz_open_procfs(0x0, &(0x7f00000001c0)='mounts\x00') [ 2789.027338] binder: 6721:6722 unknown command 0 [ 2789.032165] binder: 6721:6722 ioctl c0306201 20000600 returned -22 14:36:22 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_dev$mice(0x0, 0x0, 0x0) write$FUSE_INIT(r1, &(0x7f0000000040)={0x50, 0x0, 0x5, {0x7, 0x1c, 0x0, 0x0, 0x2, 0x0, 0x0, 0x9}}, 0x50) r2 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000380)=0x6) 14:36:22 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x4800, 0x0, 0x0}) 14:36:22 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00'}}}}, 0x68}}, 0x0) 14:36:22 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x4) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x44, 0x15, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f000001e3d8960f65b27ee8125f42360500000015739d53"]}, 0x44}}, 0x0) 14:36:22 executing program 3: socket$inet6(0xa, 0x80003, 0x800000000000006) r0 = socket$netlink(0x10, 0x3, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") poll(&(0x7f00000000c0)=[{r0, 0x2001}], 0x1, 0x80) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x48, 0x15, 0x0, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f000001e3d8960f65b27ee8125f42360500000015739d53d5"]}, 0x48}}, 0x0) [ 2789.370972] binder: 6733:6734 unknown command 0 [ 2789.386586] binder: 6733:6734 ioctl c0306201 20000600 returned -22 14:36:22 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 14:36:22 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0e\x00'}}}}, 0x68}}, 0x0) 14:36:22 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x4) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x44, 0x15, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f000001e3d8960f65b27ee8125f42360500000015739d53"]}, 0x44}}, 0x0) 14:36:22 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_dev$mice(0x0, 0x0, 0x0) write$FUSE_INIT(r1, &(0x7f0000000040)={0x50, 0x0, 0x5, {0x7, 0x1c, 0x0, 0x0, 0x2, 0x0, 0x0, 0x9}}, 0x50) r2 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000380)=0x6) 14:36:22 executing program 3: socket$inet6(0xa, 0x80003, 0x800000000000006) r0 = socket$netlink(0x10, 0x3, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") poll(&(0x7f00000000c0)=[{r0, 0x2001}], 0x1, 0x80) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x48, 0x15, 0x7, 0x0, 0x0, {0x0, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f000001e3d8960f65b27ee8125f42360500000015739d53d5"]}, 0x48}}, 0x0) [ 2789.543914] binder: 6743:6749 unknown command 0 [ 2789.548760] binder: 6743:6749 ioctl c0306201 20000600 returned -22 14:36:22 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x4) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x44, 0x15, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f000001e3d8960f65b27ee8125f42360500000015739d53"]}, 0x44}}, 0x0) 14:36:22 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\n\x00'}}}}, 0x68}}, 0x0) 14:36:22 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_dev$mice(0x0, 0x0, 0x0) write$FUSE_INIT(r1, &(0x7f0000000040)={0x50, 0x0, 0x5, {0x7, 0x1c, 0x0, 0x0, 0x2, 0x0, 0x0, 0x9}}, 0x50) r2 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000380)=0x6) 14:36:22 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x7a, 0x0, 0x0}) 14:36:22 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_dev$mice(0x0, 0x0, 0x0) write$FUSE_INIT(r1, &(0x7f0000000040)={0x50, 0x0, 0x5, {0x7, 0x1c, 0x0, 0x0, 0x2, 0x0, 0x0, 0x9}}, 0x50) r2 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000380)=0x6) syz_open_procfs(0x0, &(0x7f00000001c0)='mounts\x00') 14:36:22 executing program 3: socket$inet6(0xa, 0x80003, 0x800000000000006) r0 = socket$netlink(0x10, 0x3, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") poll(&(0x7f00000000c0)=[{r0, 0x2001}], 0x1, 0x80) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x48, 0x15, 0x7, 0x0, 0x0, {0x0, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f000001e3d8960f65b27ee8125f42360500000015739d53d5"]}, 0x48}}, 0x0) 14:36:22 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x7f\xff\xff\xff\x00'}}}}, 0x68}}, 0x0) 14:36:22 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_dev$mice(0x0, 0x0, 0x0) write$FUSE_INIT(r1, &(0x7f0000000040)={0x50, 0x0, 0x5, {0x7, 0x1c, 0x0, 0x0, 0x2, 0x0, 0x0, 0x9}}, 0x50) r2 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000001140)=0xd) [ 2790.049237] binder_thread_write: 11 callbacks suppressed [ 2790.049251] binder: 6781:6782 BC_ACQUIRE_DONE u0000000000000000 no match [ 2790.075549] binder: 6781:6782 unknown command 0 14:36:23 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00'}}}}, 0x68}}, 0x0) 14:36:23 executing program 3: socket$inet6(0xa, 0x80003, 0x800000000000006) r0 = socket$netlink(0x10, 0x3, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") poll(&(0x7f00000000c0)=[{r0, 0x2001}], 0x1, 0x80) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x48, 0x15, 0x7, 0x0, 0x0, {0x0, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f000001e3d8960f65b27ee8125f42360500000015739d53d5"]}, 0x48}}, 0x0) [ 2790.106942] binder: 6781:6782 ioctl c0306201 20000600 returned -22 14:36:23 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xb63, 0x0, 0x0}) 14:36:23 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_dev$mice(0x0, 0x0, 0x0) write$FUSE_INIT(r1, &(0x7f0000000040)={0x50, 0x0, 0x5, {0x7, 0x1c, 0x0, 0x0, 0x2, 0x0, 0x0, 0x9}}, 0x50) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000380)=0x6) 14:36:23 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xf0\x00'}}}}, 0x68}}, 0x0) 14:36:23 executing program 3: socket$inet6(0xa, 0x80003, 0x800000000000006) r0 = socket$netlink(0x10, 0x3, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") poll(&(0x7f00000000c0)=[{r0, 0x2001}], 0x1, 0x80) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x14, 0x15, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}}, 0x14}}, 0x0) [ 2790.317773] binder: 6801:6802 BC_ACQUIRE_DONE u0000000000000000 no match [ 2790.386562] binder: 6801:6802 unknown command 0 [ 2790.408840] binder: 6801:6802 ioctl c0306201 20000600 returned -22 14:36:23 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_dev$mice(0x0, 0x0, 0x0) write$FUSE_INIT(r1, &(0x7f0000000040)={0x50, 0x0, 0x5, {0x7, 0x1c, 0x0, 0x0, 0x2, 0x0, 0x0, 0x9}}, 0x50) r2 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000380)=0x6) 14:36:23 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x700000000000000, 0x0, 0x0}) 14:36:23 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_dev$mice(0x0, 0x0, 0x0) write$FUSE_INIT(r1, &(0x7f0000000040)={0x50, 0x0, 0x5, {0x7, 0x1c, 0x0, 0x0, 0x2, 0x0, 0x0, 0x9}}, 0x50) r2 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000380)=0x6) syz_open_procfs(0x0, &(0x7f00000001c0)='mounts\x00') 14:36:23 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) syz_open_dev$mice(0x0, 0x0, 0x0) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) 14:36:23 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xff\x00'}}}}, 0x68}}, 0x0) 14:36:23 executing program 3: socket$inet6(0xa, 0x80003, 0x800000000000006) r0 = socket$netlink(0x10, 0x3, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") poll(&(0x7f00000000c0)=[{r0, 0x2001}], 0x1, 0x80) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x14, 0x15, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}}, 0x14}}, 0x0) [ 2790.901918] binder: 6817:6818 BC_ACQUIRE_DONE u0000000000000000 no match [ 2790.951311] binder: 6817:6818 unknown command 0 14:36:23 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00'}}}}, 0x68}}, 0x0) [ 2790.973025] binder: 6817:6818 ioctl c0306201 20000600 returned -22 14:36:24 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xe630c4000000000, 0x0, 0x0}) 14:36:24 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x004\x8c\x00'}}}}, 0x68}}, 0x0) 14:36:24 executing program 3: socket$inet6(0xa, 0x80003, 0x800000000000006) r0 = socket$netlink(0x10, 0x3, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") poll(&(0x7f00000000c0)=[{r0, 0x2001}], 0x1, 0x80) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x14, 0x15, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}}, 0x14}}, 0x0) 14:36:24 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) write$FUSE_INIT(0xffffffffffffffff, &(0x7f0000000040)={0x50, 0x0, 0x5, {0x7, 0x1c, 0x0, 0x0, 0x2, 0x0, 0x0, 0x9}}, 0x50) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) [ 2791.156881] binder: 6842:6843 BC_ACQUIRE_DONE u0000000000000000 no match [ 2791.181884] binder: 6842:6843 unknown command 0 14:36:24 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xf0\x00'}}}}, 0x68}}, 0x0) [ 2791.205951] binder: 6842:6843 ioctl c0306201 20000600 returned -22 14:36:24 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_dev$mice(0x0, 0x0, 0x0) write$FUSE_INIT(r1, &(0x7f0000000040)={0x50, 0x0, 0x5, {0x7, 0x1c, 0x0, 0x0, 0x2, 0x0, 0x0, 0x9}}, 0x50) r2 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000380)=0x6) 14:36:24 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_dev$mice(0x0, 0x0, 0x0) write$FUSE_INIT(r1, &(0x7f0000000040)={0x50, 0x0, 0x5, {0x7, 0x1c, 0x0, 0x0, 0x2, 0x0, 0x0, 0x9}}, 0x50) r2 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000380)=0x6) syz_open_procfs(0x0, &(0x7f00000001c0)='mounts\x00') 14:36:24 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xd63000000000000, 0x0, 0x0}) 14:36:24 executing program 3: socket$inet6(0xa, 0x80003, 0x800000000000006) r0 = socket$netlink(0x10, 0x3, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") poll(&(0x7f00000000c0)=[{r0, 0x2001}], 0x1, 0x80) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x14, 0x15, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic]}, 0x14}}, 0x0) 14:36:24 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xea\x00'}}}}, 0x68}}, 0x0) 14:36:24 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) write$FUSE_INIT(0xffffffffffffffff, &(0x7f0000000040)={0x50, 0x0, 0x5, {0x7, 0x1c, 0x0, 0x0, 0x2, 0x0, 0x0, 0x9}}, 0x50) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) [ 2791.488863] binder: 6863:6866 BC_ACQUIRE_DONE u0000000000000000 no match 14:36:24 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0f\x00'}}}}, 0x68}}, 0x0) [ 2791.534252] binder: 6863:6866 unknown command 0 [ 2791.539056] binder: 6863:6866 ioctl c0306201 20000600 returned -22 14:36:24 executing program 3: socket$inet6(0xa, 0x80003, 0x800000000000006) r0 = socket$netlink(0x10, 0x3, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") poll(&(0x7f00000000c0)=[{r0, 0x2001}], 0x1, 0x80) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x14, 0x15, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic]}, 0x14}}, 0x0) 14:36:24 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x6c00000000000000, 0x0, 0x0}) 14:36:24 executing program 3: socket$inet6(0xa, 0x80003, 0x800000000000006) r0 = socket$netlink(0x10, 0x3, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") poll(&(0x7f00000000c0)=[{r0, 0x2001}], 0x1, 0x80) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x14, 0x15, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic]}, 0x14}}, 0x0) 14:36:24 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xea\xff\xff\xff\x00'}}}}, 0x68}}, 0x0) 14:36:24 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) write$FUSE_INIT(0xffffffffffffffff, &(0x7f0000000040)={0x50, 0x0, 0x5, {0x7, 0x1c, 0x0, 0x0, 0x2, 0x0, 0x0, 0x9}}, 0x50) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) [ 2791.778625] binder: 6885:6886 BC_ACQUIRE_DONE u0000000000000000 no match [ 2791.815482] binder: 6885:6886 unknown command 0 [ 2791.820332] binder: 6885:6886 ioctl c0306201 20000600 returned -22 14:36:25 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_dev$mice(0x0, 0x0, 0x0) write$FUSE_INIT(r1, &(0x7f0000000040)={0x50, 0x0, 0x5, {0x7, 0x1c, 0x0, 0x0, 0x2, 0x0, 0x0, 0x9}}, 0x50) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000380)=0x6) 14:36:25 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x7a00000000000000, 0x0, 0x0}) 14:36:25 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_dev$mice(0x0, 0x0, 0x0) write$FUSE_INIT(r1, &(0x7f0000000040)={0x50, 0x0, 0x5, {0x7, 0x1c, 0x0, 0x0, 0x2, 0x0, 0x0, 0x9}}, 0x50) r2 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000380)=0x6) 14:36:25 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00'}}}}, 0x68}}, 0x0) 14:36:25 executing program 3: socket$inet6(0xa, 0x80003, 0x800000000000006) r0 = socket$netlink(0x10, 0x3, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") poll(&(0x7f00000000c0)=[{r0, 0x2001}], 0x1, 0x80) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x30, 0x15, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f"]}, 0x30}}, 0x0) 14:36:25 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$TCSETS(0xffffffffffffffff, 0x40045431, &(0x7f00005befdc)) write$FUSE_INIT(0xffffffffffffffff, &(0x7f0000000040)={0x50, 0x0, 0x5, {0x7, 0x1c, 0x0, 0x0, 0x2, 0x0, 0x0, 0x9}}, 0x50) r0 = syz_open_pts(0xffffffffffffffff, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000380)=0x6) [ 2792.249751] binder: 6907:6911 BC_ACQUIRE_DONE u0000000000000000 no match 14:36:25 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x04\x00'}}}}, 0x68}}, 0x0) [ 2792.305491] binder: 6907:6911 unknown command 0 [ 2792.310298] binder: 6907:6911 ioctl c0306201 20000600 returned -22 14:36:25 executing program 3: socket$inet6(0xa, 0x80003, 0x800000000000006) r0 = socket$netlink(0x10, 0x3, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") poll(&(0x7f00000000c0)=[{r0, 0x2001}], 0x1, 0x80) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x30, 0x15, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f"]}, 0x30}}, 0x0) [ 2792.396608] binder: 6907:6911 BC_ACQUIRE_DONE u0000000000000000 no match [ 2792.436517] binder: 6907:6911 unknown command 0 14:36:25 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c4\x00'}}}}, 0x68}}, 0x0) 14:36:25 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$TCSETS(0xffffffffffffffff, 0x40045431, &(0x7f00005befdc)) write$FUSE_INIT(0xffffffffffffffff, &(0x7f0000000040)={0x50, 0x0, 0x5, {0x7, 0x1c, 0x0, 0x0, 0x2, 0x0, 0x0, 0x9}}, 0x50) r0 = syz_open_pts(0xffffffffffffffff, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000380)=0x6) [ 2792.460042] binder: 6907:6911 ioctl c0306201 20000600 returned -22 14:36:25 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xf630c40, 0x0, 0x0}) 14:36:25 executing program 3: socket$inet6(0xa, 0x80003, 0x800000000000006) r0 = socket$netlink(0x10, 0x3, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") poll(&(0x7f00000000c0)=[{r0, 0x2001}], 0x1, 0x80) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x30, 0x15, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f"]}, 0x30}}, 0x0) [ 2792.591555] binder: 6936:6938 BC_ACQUIRE_DONE u0000000000000000 no match [ 2792.629808] binder: 6936:6938 unknown command 0 [ 2792.659132] binder: 6936:6938 ioctl c0306201 20000600 returned -22 14:36:25 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_dev$mice(0x0, 0x0, 0x0) write$FUSE_INIT(r1, &(0x7f0000000040)={0x50, 0x0, 0x5, {0x7, 0x1c, 0x0, 0x0, 0x2, 0x0, 0x0, 0x9}}, 0x50) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000380)=0x6) 14:36:25 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_dev$mice(0x0, 0x0, 0x0) write$FUSE_INIT(r1, &(0x7f0000000040)={0x50, 0x0, 0x5, {0x7, 0x1c, 0x0, 0x0, 0x2, 0x0, 0x0, 0x9}}, 0x50) r2 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000380)=0x6) 14:36:25 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\x9e\x00'}}}}, 0x68}}, 0x0) 14:36:25 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x1200, 0x0, 0x0}) 14:36:25 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$TCSETS(0xffffffffffffffff, 0x40045431, &(0x7f00005befdc)) write$FUSE_INIT(0xffffffffffffffff, &(0x7f0000000040)={0x50, 0x0, 0x5, {0x7, 0x1c, 0x0, 0x0, 0x2, 0x0, 0x0, 0x9}}, 0x50) r0 = syz_open_pts(0xffffffffffffffff, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000380)=0x6) 14:36:25 executing program 3: socket$inet6(0xa, 0x80003, 0x800000000000006) r0 = socket$netlink(0x10, 0x3, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") poll(&(0x7f00000000c0)=[{r0, 0x2001}], 0x1, 0x80) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x3c, 0x15, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f000001e3d8960f65b27ee812"]}, 0x3c}}, 0x0) [ 2792.942031] binder: 6953:6959 BC_ACQUIRE_DONE u0000000000000000 no match [ 2792.970343] binder: 6953:6959 unknown command 0 14:36:25 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00'}}}}, 0x68}}, 0x0) [ 2792.992990] binder: 6953:6959 ioctl c0306201 20000600 returned -22 14:36:26 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_dev$mice(0x0, 0x0, 0x0) write$FUSE_INIT(r1, &(0x7f0000000040)={0x50, 0x0, 0x5, {0x7, 0x1c, 0x0, 0x0, 0x2, 0x0, 0x0, 0x9}}, 0x50) r2 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000380)=0x6) 14:36:26 executing program 3: socket$inet6(0xa, 0x80003, 0x800000000000006) r0 = socket$netlink(0x10, 0x3, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") poll(&(0x7f00000000c0)=[{r0, 0x2001}], 0x1, 0x80) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x3c, 0x15, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f000001e3d8960f65b27ee812"]}, 0x3c}}, 0x0) 14:36:26 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) write$FUSE_INIT(0xffffffffffffffff, &(0x7f0000000040)={0x50, 0x0, 0x5, {0x7, 0x1c, 0x0, 0x0, 0x2, 0x0, 0x0, 0x9}}, 0x50) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) 14:36:26 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x40486312, 0x0, 0x0}) 14:36:26 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xff\xff\xff\xf0\x00'}}}}, 0x68}}, 0x0) [ 2793.252554] binder: 6981:6982 unknown command 0 [ 2793.296750] binder: 6981:6982 ioctl c0306201 20000600 returned -22 14:36:26 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_dev$mice(0x0, 0x0, 0x0) write$FUSE_INIT(r1, &(0x7f0000000040)={0x50, 0x0, 0x5, {0x7, 0x1c, 0x0, 0x0, 0x2, 0x0, 0x0, 0x9}}, 0x50) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000380)=0x6) 14:36:26 executing program 3: socket$inet6(0xa, 0x80003, 0x800000000000006) r0 = socket$netlink(0x10, 0x3, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") poll(&(0x7f00000000c0)=[{r0, 0x2001}], 0x1, 0x80) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x3c, 0x15, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f000001e3d8960f65b27ee812"]}, 0x3c}}, 0x0) 14:36:26 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) write$FUSE_INIT(0xffffffffffffffff, &(0x7f0000000040)={0x50, 0x0, 0x5, {0x7, 0x1c, 0x0, 0x0, 0x2, 0x0, 0x0, 0x9}}, 0x50) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) 14:36:26 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_dev$mice(0x0, 0x0, 0x0) write$FUSE_INIT(r1, &(0x7f0000000040)={0x50, 0x0, 0x5, {0x7, 0x1c, 0x0, 0x0, 0x2, 0x0, 0x0, 0x9}}, 0x50) r2 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000380)=0x6) 14:36:26 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xc63000000000000, 0x0, 0x0}) 14:36:26 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00'}}}}, 0x68}}, 0x0) [ 2793.526463] binder: 6992:7000 unknown command 0 [ 2793.531202] binder: 6992:7000 ioctl c0306201 20000600 returned -22 14:36:26 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) write$FUSE_INIT(0xffffffffffffffff, &(0x7f0000000040)={0x50, 0x0, 0x5, {0x7, 0x1c, 0x0, 0x0, 0x2, 0x0, 0x0, 0x9}}, 0x50) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) 14:36:26 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xff\xff\xff\xf0\x00'}}}}, 0x68}}, 0x0) 14:36:26 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x463044000000000, 0x0, 0x0}) 14:36:26 executing program 3: socket$inet6(0xa, 0x80003, 0x800000000000006) r0 = socket$netlink(0x10, 0x3, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") poll(&(0x7f00000000c0)=[{r0, 0x2001}], 0x1, 0x80) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x40, 0x15, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f000001e3d8960f65b27ee8125f4236050000"]}, 0x40}}, 0x0) [ 2793.652810] syz-executor0 invoked oom-killer: gfp_mask=0x6000c0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 2793.683053] binder: 7012:7013 unknown command 0 [ 2793.701412] CPU: 1 PID: 6993 Comm: syz-executor0 Not tainted 4.20.0+ #5 [ 2793.708302] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2793.717770] Call Trace: [ 2793.720377] dump_stack+0x1db/0x2d0 [ 2793.720674] binder: 7012:7013 ioctl c0306201 20000600 returned -22 [ 2793.724014] ? dump_stack_print_info.cold+0x20/0x20 [ 2793.724116] ? perf_trace_lock+0x12f/0x750 [ 2793.724142] dump_header+0x1e6/0x116c [ 2793.724157] ? add_lock_to_list.isra.0+0x450/0x450 [ 2793.748539] ? print_usage_bug+0xd0/0xd0 [ 2793.752652] ? pagefault_out_of_memory+0x1a1/0x1a1 [ 2793.757594] ? ___ratelimit+0x37c/0x686 [ 2793.761587] ? mark_held_locks+0xb1/0x100 [ 2793.765748] ? _raw_spin_unlock_irqrestore+0x6b/0xe0 [ 2793.770874] ? _raw_spin_unlock_irqrestore+0x6b/0xe0 [ 2793.775987] ? lockdep_hardirqs_on+0x415/0x5d0 [ 2793.780576] ? trace_hardirqs_on+0xbd/0x310 [ 2793.784910] ? kasan_check_read+0x11/0x20 [ 2793.789070] ? ___ratelimit+0x37c/0x686 [ 2793.793051] ? trace_hardirqs_off_caller+0x300/0x300 [ 2793.798252] ? do_raw_spin_trylock+0x270/0x270 [ 2793.802852] ? trace_hardirqs_on_caller+0x310/0x310 [ 2793.807879] ? lock_acquire+0x1db/0x570 [ 2793.811881] ? _raw_spin_unlock_irqrestore+0xa4/0xe0 [ 2793.816995] ? ___ratelimit+0xac/0x686 [ 2793.820897] ? idr_get_free+0xee0/0xee0 [ 2793.824893] ? lockdep_hardirqs_on+0x415/0x5d0 [ 2793.829497] oom_kill_process.cold+0x10/0x9d4 [ 2793.834006] ? cgroup_procs_next+0x70/0x70 [ 2793.838256] ? _raw_spin_unlock_irq+0x5e/0x90 [ 2793.842760] ? oom_badness+0xa50/0xa50 [ 2793.846781] ? oom_evaluate_task+0x540/0x540 14:36:26 executing program 3: socket$inet6(0xa, 0x80003, 0x800000000000006) r0 = socket$netlink(0x10, 0x3, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") poll(&(0x7f00000000c0)=[{r0, 0x2001}], 0x1, 0x80) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x40, 0x15, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f000001e3d8960f65b27ee8125f4236050000"]}, 0x40}}, 0x0) 14:36:26 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) write$FUSE_INIT(0xffffffffffffffff, &(0x7f0000000040)={0x50, 0x0, 0x5, {0x7, 0x1c, 0x0, 0x0, 0x2, 0x0, 0x0, 0x9}}, 0x50) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) [ 2793.851207] ? mem_cgroup_iter_break+0x30/0x30 [ 2793.855799] ? mutex_trylock+0x2d0/0x2d0 [ 2793.859881] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 2793.865447] ? rcu_read_unlock_special+0x380/0x380 [ 2793.870859] out_of_memory+0x885/0x1420 [ 2793.874867] ? oom_killer_disable+0x340/0x340 [ 2793.879370] ? mem_cgroup_unmark_under_oom+0x8d/0xb0 [ 2793.884467] ? lock_acquire+0x1db/0x570 [ 2793.884491] mem_cgroup_out_of_memory+0x160/0x210 [ 2793.884503] ? do_raw_spin_unlock+0xa0/0x330 [ 2793.884517] ? memcg_memory_event+0x40/0x40 [ 2793.884530] ? do_raw_spin_trylock+0x270/0x270 [ 2793.884554] ? _raw_spin_unlock+0x2d/0x50 [ 2793.884571] try_charge+0x12a9/0x19b0 [ 2793.884585] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 2793.884605] ? mem_cgroup_oom_trylock+0x1a0/0x1a0 [ 2793.925024] ? rcu_read_unlock_special+0x380/0x380 [ 2793.929980] ? get_mem_cgroup_from_mm+0x1ea/0x420 [ 2793.934845] ? get_mem_cgroup_from_page+0x190/0x190 [ 2793.939880] ? rcu_read_lock_sched_held+0x110/0x130 [ 2793.944915] mem_cgroup_try_charge+0x43a/0xdb0 [ 2793.949524] ? mem_cgroup_protected+0xa10/0xa10 [ 2793.954215] ? swap_duplicate+0x80/0x80 [ 2793.958206] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 2793.963750] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 2793.969308] mem_cgroup_try_charge_delay+0x1f/0xa0 [ 2793.974270] do_huge_pmd_wp_page_fallback+0x267/0x1a90 [ 2793.979561] ? __alloc_pages_nodemask+0xaca/0xdc0 [ 2793.984432] ? remap_page+0x200/0x200 [ 2793.988253] ? do_raw_spin_unlock+0xa0/0x330 [ 2793.992667] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 2793.998216] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 2794.003774] ? alloc_pages_vma+0x142/0x540 [ 2794.008050] do_huge_pmd_wp_page+0x960/0x2430 [ 2794.012573] ? __split_huge_pmd+0xc10/0xc10 [ 2794.016912] ? print_usage_bug+0xd0/0xd0 [ 2794.020985] ? __lock_acquire+0x572/0x4a30 [ 2794.025261] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 2794.031186] ? mark_held_locks+0x100/0x100 [ 2794.035435] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 2794.040202] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 2794.045746] ? pmd_val+0x85/0x100 [ 2794.049209] ? add_mm_counter_fast.part.0+0x40/0x40 [ 2794.054243] ? debug_smp_processor_id+0x1c/0x20 [ 2794.058936] __handle_mm_fault+0x1b25/0x5690 [ 2794.063483] ? vmf_insert_mixed_mkwrite+0x40/0x40 [ 2794.068344] ? check_preemption_disabled+0x48/0x290 [ 2794.073588] ? handle_mm_fault+0x3cc/0xc80 [ 2794.077862] ? lock_downgrade+0x910/0x910 [ 2794.082025] ? kasan_check_read+0x11/0x20 [ 2794.086188] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 2794.091608] ? rcu_read_unlock_special+0x380/0x380 [ 2794.096660] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 2794.102211] ? check_preemption_disabled+0x48/0x290 [ 2794.107247] handle_mm_fault+0x4ec/0xc80 [ 2794.111343] ? __handle_mm_fault+0x5690/0x5690 [ 2794.115955] __do_page_fault+0x5da/0xd60 [ 2794.120027] ? do_futex+0x2910/0x2910 [ 2794.123854] do_page_fault+0xe6/0x7d8 [ 2794.127663] ? trace_hardirqs_on_caller+0xc0/0x310 [ 2794.132610] ? vmalloc_sync_all+0x30/0x30 [ 2794.136767] ? __bpf_trace_preemptirq_template+0x30/0x30 [ 2794.142255] ? syscall_return_slowpath+0x5f0/0x5f0 [ 2794.147203] ? prepare_exit_to_usermode+0x232/0x3b0 [ 2794.152231] ? page_fault+0x8/0x30 [ 2794.155783] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 2794.160651] ? page_fault+0x8/0x30 [ 2794.164201] page_fault+0x1e/0x30 [ 2794.167662] RIP: 0033:0x400590 [ 2794.170879] Code: 06 e9 49 01 00 00 48 8b 44 24 10 48 0b 44 24 28 75 1f 48 8b 14 24 48 8b 7c 24 20 be 04 00 00 00 e8 e5 4a 00 00 48 8b 74 24 08 <89> 06 e9 1e 01 00 00 48 8b 44 24 08 48 8b 14 24 be 04 00 00 00 8b [ 2794.189794] RSP: 002b:0000000000a4fbc0 EFLAGS: 00010206 [ 2794.195185] RAX: 0000000000000050 RBX: 000000000073c900 RCX: 0000000000000000 [ 2794.202463] RDX: 0000000000000000 RSI: 0000000020000040 RDI: 0000000000000050 [ 2794.209744] RBP: 000000000073c900 R08: 0000000000000000 R09: 0000000000000000 [ 2794.217026] R10: 0000000000a4fcc0 R11: 0000000000000246 R12: 00000000000003e8 [ 2794.224321] R13: fffffffffffffffe R14: 00000000002aa086 R15: 000000000073bfac [ 2794.252668] memory: usage 307200kB, limit 307200kB, failcnt 105 [ 2794.259391] memory+swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 2794.280783] kmem: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 2794.300261] Memory cgroup stats for /syz0: cache:28KB rss:263932KB rss_huge:243712KB shmem:24KB mapped_file:0KB dirty:0KB writeback:0KB swap:0KB inactive_anon:0KB active_anon:264028KB inactive_file:0KB active_file:0KB unevictable:0KB [ 2794.323076] oom-kill:constraint=CONSTRAINT_NONE,nodemask=(null),cpuset=syz0,mems_allowed=0-1,oom_memcg=/syz0,task_memcg=/syz0,task=syz-executor0,pid=17892,uid=0 [ 2794.344945] Memory cgroup out of memory: Kill process 17892 (syz-executor0) score 1113 or sacrifice child [ 2794.360743] Killed process 17892 (syz-executor0) total-vm:70796kB, anon-rss:4276kB, file-rss:33748kB, shmem-rss:0kB 14:36:27 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) syz_open_dev$mice(0x0, 0x0, 0x0) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) 14:36:27 executing program 3: socket$inet6(0xa, 0x80003, 0x800000000000006) r0 = socket$netlink(0x10, 0x3, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") poll(&(0x7f00000000c0)=[{r0, 0x2001}], 0x1, 0x80) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x40, 0x15, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f000001e3d8960f65b27ee8125f4236050000"]}, 0x40}}, 0x0) 14:36:27 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xb63000000000000, 0x0, 0x0}) 14:36:27 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) write$FUSE_INIT(0xffffffffffffffff, &(0x7f0000000040)={0x50, 0x0, 0x5, {0x7, 0x1c, 0x0, 0x0, 0x2, 0x0, 0x0, 0x9}}, 0x50) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) 14:36:27 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00'}}}}, 0x68}}, 0x0) 14:36:27 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_dev$mice(0x0, 0x0, 0x0) write$FUSE_INIT(r1, &(0x7f0000000040)={0x50, 0x0, 0x5, {0x7, 0x1c, 0x0, 0x0, 0x2, 0x0, 0x0, 0x9}}, 0x50) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000380)=0x6) [ 2794.485104] binder: 7039:7040 unknown command 0 [ 2794.489935] binder: 7039:7040 ioctl c0306201 20000600 returned -22 14:36:27 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00'}}}}, 0x68}}, 0x0) 14:36:27 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) write$FUSE_INIT(0xffffffffffffffff, &(0x7f0000000040)={0x50, 0x0, 0x5, {0x7, 0x1c, 0x0, 0x0, 0x2, 0x0, 0x0, 0x9}}, 0x50) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) 14:36:27 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x10630840, 0x0, 0x0}) 14:36:27 executing program 3: socket$inet6(0xa, 0x80003, 0x800000000000006) r0 = socket$netlink(0x10, 0x3, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") poll(&(0x7f00000000c0)=[{r0, 0x2001}], 0x1, 0x80) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x44, 0x15, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f000001e3d8960f65b27ee8125f4236050000001573"]}, 0x44}}, 0x0) [ 2794.681545] binder: 7057:7059 unknown command 0 14:36:27 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x500000000000000, 0x0, 0x0}) [ 2794.704047] binder: 7057:7059 ioctl c0306201 20000600 returned -22 14:36:27 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\n\x00'}}}}, 0x68}}, 0x0) [ 2794.816253] binder: 7065:7066 unknown command 0 [ 2794.821129] binder: 7065:7066 ioctl c0306201 20000600 returned -22 14:36:27 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) syz_open_dev$mice(0x0, 0x0, 0x0) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) 14:36:27 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(0xffffffffffffffff, 0x40045431, &(0x7f00005befdc)) write$FUSE_INIT(0xffffffffffffffff, &(0x7f0000000040)={0x50, 0x0, 0x5, {0x7, 0x1c, 0x0, 0x0, 0x2, 0x0, 0x0, 0x9}}, 0x50) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) 14:36:27 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) syz_open_dev$mice(0x0, 0x0, 0x0) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) 14:36:27 executing program 3: socket$inet6(0xa, 0x80003, 0x800000000000006) r0 = socket$netlink(0x10, 0x3, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") poll(&(0x7f00000000c0)=[{r0, 0x2001}], 0x1, 0x80) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x44, 0x15, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f000001e3d8960f65b27ee8125f4236050000001573"]}, 0x44}}, 0x0) 14:36:27 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0e\x00'}}}}, 0x68}}, 0x0) 14:36:27 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x1263484000000000, 0x0, 0x0}) [ 2795.047620] binder: 7082:7083 unknown command 0 [ 2795.070768] binder: 7082:7083 ioctl c0306201 20000600 returned -22 14:36:28 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(0xffffffffffffffff, 0x40045431, &(0x7f00005befdc)) write$FUSE_INIT(0xffffffffffffffff, &(0x7f0000000040)={0x50, 0x0, 0x5, {0x7, 0x1c, 0x0, 0x0, 0x2, 0x0, 0x0, 0x9}}, 0x50) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) 14:36:28 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x63404000000000, 0x0, 0x0}) 14:36:28 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xf0\xff\xff\xff\x00'}}}}, 0x68}}, 0x0) 14:36:28 executing program 3: socket$inet6(0xa, 0x80003, 0x800000000000006) r0 = socket$netlink(0x10, 0x3, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") poll(&(0x7f00000000c0)=[{r0, 0x2001}], 0x1, 0x80) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x44, 0x15, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f000001e3d8960f65b27ee8125f4236050000001573"]}, 0x44}}, 0x0) [ 2795.244693] binder_thread_write: 7 callbacks suppressed [ 2795.244706] binder: 7093:7094 BC_ACQUIRE_DONE u0000000000000000 no match [ 2795.263956] binder: 7093:7094 unknown command 0 14:36:28 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(0xffffffffffffffff, 0x40045431, &(0x7f00005befdc)) write$FUSE_INIT(0xffffffffffffffff, &(0x7f0000000040)={0x50, 0x0, 0x5, {0x7, 0x1c, 0x0, 0x0, 0x2, 0x0, 0x0, 0x9}}, 0x50) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) [ 2795.291623] binder: 7093:7094 ioctl c0306201 20000600 returned -22 14:36:28 executing program 3: socket$inet6(0xa, 0x80003, 0x800000000000006) r0 = socket$netlink(0x10, 0x3, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") poll(&(0x7f00000000c0)=[{r0, 0x2001}], 0x1, 0x80) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x44, 0x15, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f000001e3d8960f65b27ee8125f42360500000015739d53"]}, 0x44}}, 0x0) 14:36:28 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x1000000000000000, 0x0, 0x0}) 14:36:28 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x04\x00'}}}}, 0x68}}, 0x0) 14:36:28 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, 0x0) write$FUSE_INIT(0xffffffffffffffff, &(0x7f0000000040)={0x50, 0x0, 0x5, {0x7, 0x1c, 0x0, 0x0, 0x2, 0x0, 0x0, 0x9}}, 0x50) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) 14:36:28 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) 14:36:28 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) 14:36:28 executing program 3: socket$inet6(0xa, 0x80003, 0x800000000000006) r0 = socket$netlink(0x10, 0x3, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") poll(&(0x7f00000000c0)=[{r0, 0x2001}], 0x1, 0x80) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x44, 0x15, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f000001e3d8960f65b27ee8125f42360500000015739d53"]}, 0x44}}, 0x0) [ 2795.633347] binder: 7113:7114 BC_ACQUIRE_DONE u0000000000000000 no match 14:36:28 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x04\x00'}}}}, 0x68}}, 0x0) 14:36:28 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) write$FUSE_INIT(0xffffffffffffffff, 0x0, 0x0) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) [ 2795.704137] binder: 7113:7114 unknown command 0 14:36:28 executing program 3: socket$inet6(0xa, 0x80003, 0x800000000000006) r0 = socket$netlink(0x10, 0x3, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") poll(&(0x7f00000000c0)=[{r0, 0x2001}], 0x1, 0x80) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x44, 0x15, 0x7, 0x0, 0x0, {0xa, 0xf0ffff, 0x600}, [@generic="667e279639a91d7b7f0000017daf4204a00b32eadc2828417f000001e3d8960f65b27ee8125f42360500000015739d53"]}, 0x44}}, 0x0) [ 2795.753852] binder: 7113:7114 ioctl c0306201 20000600 returned -22 14:36:28 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x4c00000000000000, 0x0, 0x0}) 14:36:28 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00'}}}}, 0x68}}, 0x0) [ 2795.893608] binder: 7140:7141 BC_ACQUIRE_DONE u0000000000000000 no match 14:36:28 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) write$FUSE_INIT(0xffffffffffffffff, 0x0, 0x0) r1 = syz_open_pts(0xffffffffffffffff, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) 14:36:28 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) [ 2795.934650] binder: 7140:7141 unknown command 0 [ 2795.939437] binder: 7140:7141 ioctl c0306201 20000600 returned -22 14:36:28 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) syz_open_dev$mice(0x0, 0x0, 0x0) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) [ 2796.014562] binder: 7140:7141 BC_ACQUIRE_DONE u0000000000000000 no match 14:36:29 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0e\x00'}}}}, 0x68}}, 0x0) [ 2796.084671] binder: 7140:7141 unknown command 0 [ 2796.089436] binder: 7140:7141 ioctl c0306201 20000600 returned -22 14:36:29 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) write$FUSE_INIT(0xffffffffffffffff, 0x0, 0x0) r1 = syz_open_pts(0xffffffffffffffff, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) 14:36:29 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) 14:36:29 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x10000000, 0x0, 0x0}) 14:36:29 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xea\xff\xff\xff\x00'}}}}, 0x68}}, 0x0) 14:36:29 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) write$FUSE_INIT(0xffffffffffffffff, 0x0, 0x0) r1 = syz_open_pts(0xffffffffffffffff, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) 14:36:29 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$TCSETS(0xffffffffffffffff, 0x40045431, &(0x7f00005befdc)) r0 = syz_open_pts(0xffffffffffffffff, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000380)=0x6) [ 2796.363686] binder: 7166:7167 BC_ACQUIRE_DONE u0000000000000000 no match [ 2796.386015] binder: 7166:7167 unknown command 0 [ 2796.403948] binder: 7166:7167 ioctl c0306201 20000600 returned -22 14:36:29 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xf0\xff\xff\x00'}}}}, 0x68}}, 0x0) 14:36:29 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) write$FUSE_INIT(0xffffffffffffffff, 0x0, 0x0) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) 14:36:29 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x12000000, 0x0, 0x0}) 14:36:29 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) syz_open_dev$mice(0x0, 0x0, 0x0) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) [ 2796.555053] binder: 7179:7180 BC_ACQUIRE_DONE u0000000000000000 no match [ 2796.562110] binder: 7179:7180 unknown command 0 14:36:29 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) write$FUSE_INIT(0xffffffffffffffff, 0x0, 0x0) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) 14:36:29 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0e\x00'}}}}, 0x68}}, 0x0) [ 2796.674070] binder: 7179:7180 ioctl c0306201 20000600 returned -22 14:36:29 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x40046302, 0x0, 0x0}) [ 2796.900541] binder: 7201:7202 BC_ACQUIRE_DONE u0000000000000000 no match [ 2796.934433] binder: 7201:7202 unknown command 0 [ 2796.939169] binder: 7201:7202 ioctl c0306201 20000600 returned -22 [ 2796.967423] binder: 7201:7202 BC_ACQUIRE_DONE u0000000000000000 no match [ 2796.975342] binder: 7201:7202 unknown command 0 [ 2796.980099] binder: 7201:7202 ioctl c0306201 20000600 returned -22 14:36:29 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00`\x00'}}}}, 0x68}}, 0x0) 14:36:29 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) 14:36:29 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) syz_open_dev$mice(0x0, 0x0, 0x0) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) 14:36:29 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x363084000000000, 0x0, 0x0}) 14:36:29 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) 14:36:29 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) write$FUSE_INIT(0xffffffffffffffff, 0x0, 0x0) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) [ 2797.060926] binder: 7208:7211 BC_ACQUIRE_DONE u0000000000000000 no match 14:36:30 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0f\x00'}}}}, 0x68}}, 0x0) [ 2797.104299] binder: 7208:7211 unknown command 0 [ 2797.110560] binder: 7208:7211 ioctl c0306201 20000600 returned -22 14:36:30 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) 14:36:30 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) write$FUSE_INIT(0xffffffffffffffff, 0x0, 0x0) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) [ 2797.156839] binder: 7208:7211 BC_ACQUIRE_DONE u0000000000000000 no match [ 2797.199389] binder: 7208:7211 unknown command 0 [ 2797.229665] binder: 7208:7211 ioctl c0306201 20000600 returned -22 14:36:30 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) 14:36:30 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00'}}}}, 0x68}}, 0x0) 14:36:30 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) write$FUSE_INIT(0xffffffffffffffff, 0x0, 0x0) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) 14:36:30 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x60000000, 0x0, 0x0}) 14:36:30 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) [ 2797.396184] binder: 7232:7234 unknown command 0 [ 2797.401019] binder: 7232:7234 ioctl c0306201 20000600 returned -22 14:36:30 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) 14:36:30 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00'}}}}, 0x68}}, 0x0) 14:36:30 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) write$FUSE_INIT(0xffffffffffffffff, 0x0, 0x0) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000380)=0x6) 14:36:30 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) syz_open_dev$mice(0x0, 0x0, 0x0) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) 14:36:30 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) 14:36:30 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x4c00, 0x0, 0x0}) [ 2797.614668] binder: 7245:7246 unknown command 0 14:36:30 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(0xffffffffffffffff, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) [ 2797.652075] binder: 7245:7246 ioctl c0306201 20000600 returned -22 14:36:30 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\n\x00'}}}}, 0x68}}, 0x0) 14:36:30 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x6000, 0x0, 0x0}) 14:36:30 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) write$FUSE_INIT(0xffffffffffffffff, 0x0, 0x0) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, 0x0) 14:36:30 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(0xffffffffffffffff, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) 14:36:30 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x004\x8c\x00'}}}}, 0x68}}, 0x0) [ 2797.837025] binder: 7267:7268 unknown command 0 [ 2797.841948] binder: 7267:7268 ioctl c0306201 20000600 returned -22 14:36:31 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$TCSETS(0xffffffffffffffff, 0x40045431, &(0x7f00005befdc)) r0 = syz_open_pts(0xffffffffffffffff, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000380)=0x6) 14:36:31 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) syz_open_dev$mice(0x0, 0x0, 0x0) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) 14:36:31 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x400c630f, 0x0, 0x0}) 14:36:31 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(0xffffffffffffffff, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) 14:36:31 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00'}}}}, 0x68}}, 0x0) 14:36:31 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) syz_open_dev$mice(0x0, 0x0, 0x0) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) [ 2798.164611] binder: 7284:7286 unknown command 0 [ 2798.189442] binder: 7284:7286 ioctl c0306201 20000600 returned -22 14:36:31 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\x9e\x00'}}}}, 0x68}}, 0x0) 14:36:31 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, 0x0) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) 14:36:31 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x600000000000000, 0x0, 0x0}) 14:36:31 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) syz_open_dev$mice(0x0, 0x0, 0x0) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) [ 2798.373592] binder: 7300:7301 unknown command 0 [ 2798.391570] binder: 7300:7301 ioctl c0306201 20000600 returned -22 14:36:31 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xf0\x00'}}}}, 0x68}}, 0x0) [ 2798.421384] binder: 7300:7301 unknown command 0 14:36:31 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, 0x0) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) [ 2798.451394] binder: 7300:7301 ioctl c0306201 20000600 returned -22 14:36:31 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$TCSETS(0xffffffffffffffff, 0x40045431, &(0x7f00005befdc)) r0 = syz_open_pts(0xffffffffffffffff, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000380)=0x6) 14:36:31 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) syz_open_dev$mice(0x0, 0x0, 0x0) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) 14:36:31 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) syz_open_dev$mice(0x0, 0x0, 0x0) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000380)=0x6) 14:36:31 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x7a000000, 0x0, 0x0}) 14:36:31 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, 0x0) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) 14:36:31 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\n\x00'}}}}, 0x68}}, 0x0) [ 2798.690920] binder: 7321:7322 unknown command 0 [ 2798.712416] binder: 7321:7322 ioctl c0306201 20000600 returned -22 14:36:31 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x004\x8c\x00'}}}}, 0x68}}, 0x0) 14:36:31 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(0xffffffffffffffff, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) [ 2798.760013] binder: 7321:7322 unknown command 0 [ 2798.773984] binder: 7321:7322 ioctl c0306201 20000600 returned -22 14:36:31 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) syz_open_dev$mice(0x0, 0x0, 0x0) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000380)=0x6) 14:36:31 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x6800000000000000, 0x0, 0x0}) 14:36:31 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00'}}}}, 0x68}}, 0x0) 14:36:31 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(0xffffffffffffffff, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) [ 2798.964258] binder: 7345:7346 unknown command 0 [ 2798.992681] binder: 7345:7346 ioctl c0306201 20000600 returned -22 [ 2799.044200] binder: 7345:7346 unknown command 0 [ 2799.074634] binder: 7345:7346 ioctl c0306201 20000600 returned -22 14:36:32 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) 14:36:32 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) syz_open_dev$mice(0x0, 0x0, 0x0) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) 14:36:32 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00'}}}}, 0x68}}, 0x0) 14:36:32 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(0xffffffffffffffff, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) 14:36:32 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x6c000000, 0x0, 0x0}) 14:36:32 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) syz_open_dev$mice(0x0, 0x0, 0x0) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000380)=0x6) [ 2799.273894] binder: 7365:7366 unknown command 0 [ 2799.278645] binder: 7365:7366 ioctl c0306201 20000600 returned -22 14:36:32 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00'}}}}, 0x68}}, 0x0) 14:36:32 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) 14:36:32 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x6c, 0x0, 0x0}) 14:36:32 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xa1\x00'}}}}, 0x68}}, 0x0) 14:36:32 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) syz_open_dev$mice(0x0, 0x0, 0x0) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) 14:36:32 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) [ 2799.573035] binder: 7389:7392 unknown command 0 [ 2799.578501] binder: 7389:7392 ioctl c0306201 20000600 returned -22 14:36:32 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) 14:36:32 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x763044000000000, 0x0, 0x0}) 14:36:32 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x04\x00'}}}}, 0x68}}, 0x0) 14:36:32 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) 14:36:32 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) [ 2799.784779] binder: 7399:7404 unknown command 0 [ 2799.818422] binder: 7399:7404 ioctl c0306201 20000600 returned -22 14:36:32 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) 14:36:32 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00`\x00'}}}}, 0x68}}, 0x0) 14:36:32 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) syz_open_dev$mice(0x0, 0x0, 0x0) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) 14:36:32 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x300000000000000, 0x0, 0x0}) 14:36:32 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@\x03\x00'}}}}, 0x68}}, 0x0) 14:36:33 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) [ 2800.093637] binder: 7423:7424 unknown command 0 14:36:33 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) syz_open_dev$mice(0x0, 0x0, 0x0) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) [ 2800.137588] binder: 7423:7424 ioctl c0306201 20000600 returned -22 14:36:33 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) 14:36:33 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x963104000000000, 0x0, 0x0}) 14:36:33 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xfc\xff\xff\xff\x00'}}}}, 0x68}}, 0x0) 14:36:33 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) 14:36:33 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) 14:36:33 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) syz_open_dev$mice(0x0, 0x0, 0x0) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000380)=0x6) [ 2800.437223] binder_thread_write: 14 callbacks suppressed [ 2800.437236] binder: 7448:7450 BC_ACQUIRE_DONE u0000000000000000 no match 14:36:33 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) 14:36:33 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00'}}}}, 0x68}}, 0x0) [ 2800.497744] binder: 7448:7450 unknown command 0 [ 2800.542781] binder: 7448:7450 ioctl c0306201 20000600 returned -22 14:36:33 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00'}}}}, 0x68}}, 0x0) 14:36:33 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x1634040, 0x0, 0x0}) 14:36:33 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) [ 2800.729294] binder: 7464:7468 BC_ACQUIRE_DONE u0000000000000000 no match [ 2800.753477] binder: 7464:7468 unknown command 0 14:36:33 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) 14:36:33 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xfc\x00'}}}}, 0x68}}, 0x0) [ 2800.847787] binder: 7464:7468 ioctl c0306201 20000600 returned -22 14:36:33 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) 14:36:33 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x9631040, 0x0, 0x0}) 14:36:33 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00'}}}}, 0x68}}, 0x0) 14:36:33 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) 14:36:34 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) syz_open_dev$mice(0x0, 0x0, 0x0) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000380)=0x6) [ 2801.042617] binder: 7481:7482 BC_ACQUIRE_DONE u0000000000000000 no match [ 2801.099658] binder: 7481:7482 unknown command 0 [ 2801.131639] binder: 7481:7482 ioctl c0306201 20000600 returned -22 14:36:34 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xff\x00'}}}}, 0x68}}, 0x0) 14:36:34 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x40046304, 0x0, 0x0}) 14:36:34 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000380)=0x6) 14:36:34 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) [ 2801.323368] binder: 7499:7503 BC_ACQUIRE_DONE u0000000000000000 no match 14:36:34 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xea\x00'}}}}, 0x68}}, 0x0) 14:36:34 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$TCSETS(0xffffffffffffffff, 0x40045431, &(0x7f00005befdc)) r0 = syz_open_pts(0xffffffffffffffff, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000380)=0x6) [ 2801.371783] binder: 7499:7503 unknown command 0 14:36:34 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, 0x0) [ 2801.425233] binder: 7499:7503 ioctl c0306201 20000600 returned -22 14:36:34 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) 14:36:34 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x3, 0x0, 0x0}) 14:36:34 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0f\x00'}}}}, 0x68}}, 0x0) 14:36:34 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$TCSETS(0xffffffffffffffff, 0x40045431, &(0x7f00005befdc)) r0 = syz_open_pts(0xffffffffffffffff, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000380)=0x6) 14:36:34 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)) [ 2801.575751] binder: 7529:7530 BC_ACQUIRE_DONE u0000000000000000 no match [ 2801.595718] binder: 7529:7530 unknown command 0 [ 2801.620979] binder: 7529:7530 ioctl c0306201 20000600 returned -22 14:36:34 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(0xffffffffffffffff, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) 14:36:34 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xf0\xff\xff\xff\xff\xff\xff\x00'}}}}, 0x68}}, 0x0) 14:36:34 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)) 14:36:34 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x6000000000000000, 0x0, 0x0}) 14:36:34 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$TCSETS(0xffffffffffffffff, 0x40045431, &(0x7f00005befdc)) r0 = syz_open_pts(0xffffffffffffffff, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000380)=0x6) 14:36:34 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00'}}}}, 0x68}}, 0x0) [ 2801.864736] binder: 7554:7563 BC_ACQUIRE_DONE u0000000000000000 no match [ 2801.871869] binder: 7554:7563 unknown command 0 14:36:34 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)) [ 2801.941327] binder: 7554:7563 ioctl c0306201 20000600 returned -22 14:36:34 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) 14:36:34 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c4\x00'}}}}, 0x68}}, 0x0) 14:36:35 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(0xffffffffffffffff, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) 14:36:35 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x4000000, 0x0, 0x0}) 14:36:35 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) [ 2802.177699] binder: 7609:7610 BC_ACQUIRE_DONE u0000000000000000 no match [ 2802.237862] binder: 7609:7610 unknown command 0 14:36:35 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xa1\xff\xff\xff\x00'}}}}, 0x68}}, 0x0) 14:36:35 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) [ 2802.319717] binder: 7609:7610 ioctl c0306201 20000600 returned -22 14:36:35 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) [ 2802.367803] binder: 7609:7610 BC_ACQUIRE_DONE u0000000000000000 no match [ 2802.393809] binder: 7609:7610 unknown command 0 [ 2802.416114] binder: 7609:7610 ioctl c0306201 20000600 returned -22 14:36:35 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x7000000, 0x0, 0x0}) 14:36:35 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xfc\x00'}}}}, 0x68}}, 0x0) 14:36:35 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) 14:36:35 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) [ 2802.526839] binder: 7625:7626 BC_ACQUIRE_DONE u0000000000000000 no match 14:36:35 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) [ 2802.572120] binder: 7625:7626 unknown command 0 [ 2802.587835] binder: 7625:7626 ioctl c0306201 20000600 returned -22 14:36:35 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0f\x00'}}}}, 0x68}}, 0x0) 14:36:35 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(0xffffffffffffffff, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) 14:36:35 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x5, 0x0, 0x0}) 14:36:35 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) 14:36:35 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0e\x00'}}}}, 0x68}}, 0x0) 14:36:35 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$TCSETS(0xffffffffffffffff, 0x40045431, &(0x7f00005befdc)) r0 = syz_open_pts(0xffffffffffffffff, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000380)=0x6) 14:36:35 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) [ 2802.866027] binder: 7658:7659 BC_ACQUIRE_DONE u0000000000000000 no match 14:36:35 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$TCSETS(0xffffffffffffffff, 0x40045431, &(0x7f00005befdc)) r0 = syz_open_pts(0xffffffffffffffff, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000380)=0x6) 14:36:35 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) [ 2802.917304] binder: 7658:7659 unknown command 0 [ 2802.922060] binder: 7658:7659 ioctl c0306201 20000600 returned -22 14:36:35 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00'}}}}, 0x68}}, 0x0) 14:36:36 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xa63084000000000, 0x0, 0x0}) 14:36:36 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) 14:36:36 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03@\x00'}}}}, 0x68}}, 0x0) [ 2803.151264] binder: 7677:7680 unknown command 0 [ 2803.184074] binder: 7677:7680 ioctl c0306201 20000600 returned -22 14:36:36 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(0xffffffffffffffff, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) 14:36:36 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$TCSETS(0xffffffffffffffff, 0x40045431, &(0x7f00005befdc)) r0 = syz_open_pts(0xffffffffffffffff, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000380)=0x6) 14:36:36 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, 0x0) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) 14:36:36 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) 14:36:36 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x4800000000000000, 0x0, 0x0}) 14:36:36 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00`\x00'}}}}, 0x68}}, 0x0) [ 2803.368766] binder: 7692:7694 unknown command 0 14:36:36 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(0xffffffffffffffff, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) [ 2803.389280] binder: 7692:7694 ioctl c0306201 20000600 returned -22 [ 2803.415182] binder: 7692:7694 unknown command 0 [ 2803.427323] binder: 7692:7694 ioctl c0306201 20000600 returned -22 14:36:36 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) syz_open_dev$mice(0x0, 0x0, 0x0) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000380)=0x6) 14:36:36 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\x9e\x00'}}}}, 0x68}}, 0x0) 14:36:36 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) 14:36:36 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2000, 0x0, 0x0}) 14:36:36 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(0xffffffffffffffff, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) 14:36:36 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00'}}}}, 0x68}}, 0x0) [ 2803.610839] binder: 7718:7719 unknown command 0 [ 2803.657390] binder: 7718:7719 ioctl c0306201 20000600 returned -22 14:36:36 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xb630000, 0x0, 0x0}) 14:36:36 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, 0x0) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) 14:36:36 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) 14:36:36 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xea\x00'}}}}, 0x68}}, 0x0) 14:36:36 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) 14:36:36 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, 0x0) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) [ 2803.864731] binder: 7729:7733 unknown command 0 [ 2803.889089] binder: 7729:7733 ioctl c0306201 20000600 returned -22 14:36:36 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x7a00, 0x0, 0x0}) 14:36:36 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) 14:36:36 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, 0x0) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) 14:36:36 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00`\x00'}}}}, 0x68}}, 0x0) [ 2803.970638] binder: 7747:7748 unknown command 0 14:36:36 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) [ 2804.028620] binder: 7747:7748 ioctl c0306201 20000600 returned -22 14:36:37 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xc63, 0x0, 0x0}) 14:36:37 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, 0x0) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) [ 2804.157141] binder: 7763:7764 unknown command 0 14:36:37 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, 0x0) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) 14:36:37 executing program 2: clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) 14:36:37 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xa1\x00'}}}}, 0x68}}, 0x0) 14:36:37 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) [ 2804.179597] binder: 7763:7764 ioctl c0306201 20000600 returned -22 14:36:37 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xa, 0x0, 0x0}) 14:36:37 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(0xffffffffffffffff, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) [ 2804.328800] binder: 7781:7782 unknown command 0 14:36:37 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xf0\x00'}}}}, 0x68}}, 0x0) [ 2804.358131] binder: 7781:7782 ioctl c0306201 20000600 returned -22 14:36:37 executing program 2: clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) 14:36:37 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x40106309, 0x0, 0x0}) 14:36:37 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(0xffffffffffffffff, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) 14:36:37 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00'}}}}, 0x68}}, 0x0) [ 2804.483402] binder: 7791:7792 unknown command 0 [ 2804.499642] binder: 7791:7792 ioctl c0306201 20000600 returned -22 14:36:37 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) 14:36:37 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(0xffffffffffffffff, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) 14:36:37 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x40086303, 0x0, 0x0}) 14:36:37 executing program 2: clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) 14:36:37 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x9e\xff\xff\xff\x00'}}}}, 0x68}}, 0x0) [ 2804.686246] binder: 7810:7811 unknown command 0 14:36:37 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(0xffffffffffffffff, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) [ 2804.715560] binder: 7810:7811 ioctl c0306201 20000600 returned -22 14:36:37 executing program 2: clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) 14:36:37 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x4c00000000000000, 0x0}) 14:36:37 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x7f\xff\xff\xff\x00'}}}}, 0x68}}, 0x0) [ 2804.856113] syz-executor0 invoked oom-killer: gfp_mask=0x7080c0(GFP_KERNEL_ACCOUNT|__GFP_ZERO), order=0, oom_score_adj=1000 [ 2804.881371] binder: 7822:7823 unknown command 0 [ 2804.889854] binder: 7822:7823 ioctl c0306201 20000600 returned -22 [ 2804.900868] CPU: 0 PID: 7807 Comm: syz-executor0 Not tainted 4.20.0+ #5 [ 2804.907639] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2804.917084] Call Trace: [ 2804.919686] dump_stack+0x1db/0x2d0 [ 2804.923332] ? dump_stack_print_info.cold+0x20/0x20 [ 2804.928463] dump_header+0x1e6/0x116c [ 2804.932283] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 2804.937052] ? lockdep_hardirqs_on+0x415/0x5d0 [ 2804.941656] ? retint_kernel+0x2d/0x2d [ 2804.945559] ? trace_hardirqs_on_caller+0xc0/0x310 [ 2804.950507] ? pagefault_out_of_memory+0x1a1/0x1a1 [ 2804.955450] ? __bpf_trace_preemptirq_template+0x30/0x30 [ 2804.960918] ? ___ratelimit+0x37c/0x686 [ 2804.964927] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 2804.969984] ? retint_kernel+0x2d/0x2d [ 2804.973895] ? _raw_spin_unlock_irqrestore+0x95/0xe0 [ 2804.979014] ? _raw_spin_unlock_irqrestore+0xa4/0xe0 [ 2804.984137] ? ___ratelimit+0xac/0x686 [ 2804.988036] ? idr_get_free+0xee0/0xee0 [ 2804.992036] oom_kill_process.cold+0x10/0x9d4 [ 2804.996547] ? cgroup_procs_next+0x70/0x70 [ 2805.000794] ? _raw_spin_unlock_irq+0x5e/0x90 [ 2805.005299] ? oom_badness+0xa50/0xa50 [ 2805.009203] ? oom_evaluate_task+0x540/0x540 [ 2805.013624] ? mem_cgroup_iter_break+0x30/0x30 [ 2805.018242] out_of_memory+0x885/0x1420 [ 2805.022231] ? mem_cgroup_unmark_under_oom+0x8d/0xb0 [ 2805.027354] ? oom_killer_disable+0x340/0x340 [ 2805.031862] ? lock_release+0x546/0xc40 [ 2805.035865] ? lock_acquire+0x1db/0x570 [ 2805.039868] mem_cgroup_out_of_memory+0x160/0x210 [ 2805.044808] ? do_raw_spin_unlock+0xa0/0x330 [ 2805.049228] ? memcg_memory_event+0x40/0x40 [ 2805.053562] ? do_raw_spin_trylock+0x270/0x270 [ 2805.058171] ? _raw_spin_unlock+0x2d/0x50 [ 2805.062351] try_charge+0x12a9/0x19b0 [ 2805.066161] ? lock_downgrade+0x910/0x910 [ 2805.070323] ? kasan_check_read+0x11/0x20 [ 2805.074493] ? mem_cgroup_oom_trylock+0x1a0/0x1a0 [ 2805.079455] ? get_mem_cgroup_from_mm+0x1cd/0x420 [ 2805.084317] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 2805.089878] ? lock_downgrade+0x910/0x910 [ 2805.094039] ? kasan_check_read+0x11/0x20 [ 2805.098210] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 2805.103499] ? rcu_read_unlock_special+0x380/0x380 [ 2805.108454] ? get_mem_cgroup_from_mm+0x1ea/0x420 [ 2805.113317] memcg_kmem_charge_memcg+0x7c/0x130 [ 2805.117991] ? memcg_kmem_put_cache+0xb0/0xb0 [ 2805.122493] ? lock_release+0xc40/0xc40 [ 2805.126492] memcg_kmem_charge+0x13b/0x340 [ 2805.130746] __alloc_pages_nodemask+0x7b8/0xdc0 [ 2805.135448] ? add_lock_to_list.isra.0+0x450/0x450 [ 2805.140396] ? __alloc_pages_slowpath+0x2cc0/0x2cc0 [ 2805.145425] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 2805.150197] ? copy_page_range+0x157c/0x2850 [ 2805.154627] ? __lock_is_held+0xb6/0x140 [ 2805.158711] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 2805.164265] alloc_pages_current+0x107/0x210 [ 2805.168711] pte_alloc_one+0x1b/0x1a0 [ 2805.172520] __pte_alloc+0x26/0x320 [ 2805.176160] copy_page_range+0x18d8/0x2850 [ 2805.180519] ? __pmd_alloc+0x460/0x460 [ 2805.184419] ? lockdep_hardirqs_on+0x415/0x5d0 [ 2805.189009] ? retint_kernel+0x2d/0x2d [ 2805.192902] ? trace_hardirqs_on_caller+0xc0/0x310 [ 2805.197860] ? __bpf_trace_preemptirq_template+0x30/0x30 [ 2805.203332] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 2805.208104] ? retint_kernel+0x2d/0x2d [ 2805.212029] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 2805.217059] ? vma_compute_subtree_gap+0x158/0x230 [ 2805.222005] ? __vma_link_rb+0x279/0x370 [ 2805.226083] copy_process+0x4291/0x8730 [ 2805.230128] ? __cleanup_sighand+0x70/0x70 [ 2805.234395] ? futex_wait_queue_me+0x539/0x810 [ 2805.238991] ? refill_pi_state_cache.part.0+0x310/0x310 [ 2805.244374] ? handle_futex_death+0x230/0x230 [ 2805.248885] ? fixup_owner+0x250/0x250 [ 2805.252794] ? __sanitizer_cov_trace_switch+0x49/0x80 14:36:37 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) 14:36:37 executing program 2: clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(0xffffffffffffffff, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) 14:36:37 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) [ 2805.258024] ? drop_futex_key_refs.isra.0+0x6f/0xf0 [ 2805.263514] ? __lock_acquire+0x572/0x4a30 [ 2805.267777] ? mark_held_locks+0x100/0x100 [ 2805.272019] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 2805.277564] ? check_preemption_disabled+0x48/0x290 [ 2805.282636] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 2805.288177] ? check_preemption_disabled+0x48/0x290 [ 2805.288196] ? debug_smp_processor_id+0x1c/0x20 [ 2805.288209] ? perf_trace_lock+0x12f/0x750 [ 2805.288231] ? add_lock_to_list.isra.0+0x450/0x450 [ 2805.288277] ? __might_fault+0x12b/0x1e0 [ 2805.288292] ? find_held_lock+0x35/0x120 [ 2805.288308] ? __might_fault+0x12b/0x1e0 [ 2805.302185] ? lock_acquire+0x1db/0x570 [ 2805.302207] ? lock_downgrade+0x910/0x910 [ 2805.302223] ? lock_release+0xc40/0xc40 [ 2805.302251] _do_fork+0x1a9/0x1170 [ 2805.311229] ? retint_kernel+0x2d/0x2d [ 2805.311252] ? fork_idle+0x1d0/0x1d0 [ 2805.311267] ? __bpf_trace_preemptirq_template+0x30/0x30 [ 2805.311281] ? kasan_check_read+0x11/0x20 [ 2805.311295] ? _copy_to_user+0xc9/0x120 [ 2805.319412] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 2805.319427] ? do_syscall_64+0x8c/0x800 [ 2805.319440] ? do_syscall_64+0x8c/0x800 [ 2805.319455] ? lockdep_hardirqs_on+0x415/0x5d0 [ 2805.319469] ? trace_hardirqs_on+0xbd/0x310 [ 2805.319485] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 2805.327573] ? trace_hardirqs_off_caller+0x300/0x300 [ 2805.327597] __x64_sys_clone+0xbf/0x150 [ 2805.327618] do_syscall_64+0x1a3/0x800 [ 2805.327638] ? syscall_return_slowpath+0x5f0/0x5f0 [ 2805.327657] ? prepare_exit_to_usermode+0x232/0x3b0 [ 2805.327678] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 2805.327701] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 2805.416505] RIP: 0033:0x457ec9 [ 2805.419687] Code: 6d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 3b b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 2805.438595] RSP: 002b:00007f5b118dec78 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 [ 2805.446289] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000000457ec9 [ 2805.453545] RDX: 9999999999999999 RSI: 0000000000000000 RDI: 0000000000000000 [ 2805.460813] RBP: 000000000073bf00 R08: ffffffffffffffff R09: 0000000000000000 [ 2805.468075] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f5b118df6d4 [ 2805.475461] R13: 00000000004be2a0 R14: 00000000004ce480 R15: 00000000ffffffff [ 2805.484337] memory: usage 307200kB, limit 307200kB, failcnt 131 [ 2805.490607] memory+swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 2805.497739] kmem: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 2805.504202] Memory cgroup stats for /syz0: cache:28KB rss:262684KB rss_huge:241664KB shmem:24KB mapped_file:0KB dirty:0KB writeback:0KB swap:0KB inactive_anon:0KB active_anon:262852KB inactive_file:0KB active_file:0KB unevictable:0KB [ 2805.526217] oom-kill:constraint=CONSTRAINT_NONE,nodemask=(null),cpuset=syz0,mems_allowed=0-1,oom_memcg=/syz0,task_memcg=/syz0,task=syz-executor0,pid=14175,uid=0 [ 2805.541542] Memory cgroup out of memory: Kill process 14175 (syz-executor0) score 1113 or sacrifice child [ 2805.553213] Killed process 14175 (syz-executor0) total-vm:70400kB, anon-rss:4252kB, file-rss:33764kB, shmem-rss:0kB [ 2805.573332] oom_reaper: reaped process 14175 (syz-executor0), now anon-rss:0kB, file-rss:32804kB, shmem-rss:0kB 14:36:38 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) syz_open_dev$mice(0x0, 0x0, 0x0) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) 14:36:38 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) 14:36:38 executing program 2: clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(0xffffffffffffffff, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) 14:36:38 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(0xffffffffffffffff, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) 14:36:38 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x2000000000000000, 0x0}) 14:36:38 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\n\x00'}}}}, 0x68}}, 0x0) [ 2805.662644] binder_thread_write: 11 callbacks suppressed [ 2805.662656] binder: 7846:7847 BC_ACQUIRE_DONE u0000000000000000 no match [ 2805.700817] binder: 7846:7847 unknown command 0 14:36:38 executing program 2: clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(0xffffffffffffffff, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) 14:36:38 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) [ 2805.715384] binder: 7846:7847 ioctl c0306201 20000600 returned -22 14:36:38 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x40106309, 0x0}) 14:36:38 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03@\x00'}}}}, 0x68}}, 0x0) [ 2805.826406] binder: 7858:7859 BC_ACQUIRE_DONE u0000000000000000 no match 14:36:38 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00'}}}}, 0x68}}, 0x0) [ 2805.884310] binder: 7858:7859 unknown command 0 [ 2805.889144] binder: 7858:7859 ioctl c0306201 20000600 returned -22 14:36:38 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) 14:36:39 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) 14:36:39 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x10, 0x0}) 14:36:39 executing program 2: clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, 0x0) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) [ 2806.169538] binder: 7878:7879 BC_ACQUIRE_DONE u0000000000000000 no match [ 2806.186369] binder: 7878:7879 unknown command 0 [ 2806.209544] binder: 7878:7879 ioctl c0306201 20000600 returned -22 14:36:39 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x004\x8c\x00'}}}}, 0x68}}, 0x0) 14:36:39 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(0xffffffffffffffff, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) 14:36:39 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) 14:36:39 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x4800000000000000, 0x0}) 14:36:39 executing program 2: clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, 0x0) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) 14:36:39 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) [ 2806.364800] binder: 7895:7897 BC_ACQUIRE_DONE u0000000000000000 no match [ 2806.392250] binder: 7895:7897 unknown command 0 14:36:39 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00'}}}}, 0x68}}, 0x0) [ 2806.419207] binder: 7895:7897 ioctl c0306201 20000600 returned -22 14:36:39 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) 14:36:39 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x1263484000000000, 0x0}) 14:36:39 executing program 2: clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, 0x0) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) 14:36:39 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xf0\x00'}}}}, 0x68}}, 0x0) [ 2806.634300] binder: 7915:7916 BC_ACQUIRE_DONE u0000000000000000 no match 14:36:39 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) [ 2806.686216] binder: 7915:7916 unknown command 0 [ 2806.691032] binder: 7915:7916 ioctl c0306201 20000600 returned -22 14:36:39 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0f\x00'}}}}, 0x68}}, 0x0) 14:36:39 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) 14:36:39 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_dev$mice(0x0, 0x0, 0x0) write$FUSE_INIT(r1, &(0x7f0000000040)={0x50, 0x0, 0x5, {0x7, 0x1c, 0x0, 0x0, 0x2, 0x0, 0x0, 0x9}}, 0x50) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000380)=0x6) 14:36:39 executing program 2: clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(0xffffffffffffffff, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) 14:36:39 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x963104000000000, 0x0}) 14:36:39 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00'}}}}, 0x68}}, 0x0) 14:36:39 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) [ 2806.954591] binder: 7930:7941 BC_ACQUIRE_DONE u0000000000000000 no match 14:36:39 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000380)=0x6) 14:36:39 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xf0\x00'}}}}, 0x68}}, 0x0) [ 2807.026136] binder: 7930:7941 unknown command 0 14:36:40 executing program 2: clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(0xffffffffffffffff, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) [ 2807.113447] binder: 7930:7941 ioctl c0306201 20000600 returned -22 14:36:40 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00'}}}}, 0x68}}, 0x0) 14:36:40 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, 0x0) [ 2807.162803] binder: 7930:7941 BC_ACQUIRE_DONE u0000000000000000 no match [ 2807.198926] binder: 7930:7941 unknown command 0 [ 2807.203660] binder: 7930:7941 ioctl c0306201 20000600 returned -22 14:36:40 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0xa, 0x0}) [ 2807.314957] syz-executor0 invoked oom-killer: gfp_mask=0x6000c0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 2807.358015] CPU: 0 PID: 7931 Comm: syz-executor0 Not tainted 4.20.0+ #5 [ 2807.364821] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2807.374174] Call Trace: [ 2807.376781] dump_stack+0x1db/0x2d0 [ 2807.380412] ? dump_stack_print_info.cold+0x20/0x20 [ 2807.383672] binder: 7964:7966 BC_ACQUIRE_DONE u0000000000000000 no match [ 2807.385432] ? perf_trace_lock+0x12f/0x750 [ 2807.385462] dump_header+0x1e6/0x116c [ 2807.385479] ? add_lock_to_list.isra.0+0x450/0x450 [ 2807.385497] ? print_usage_bug+0xd0/0xd0 [ 2807.385516] ? pagefault_out_of_memory+0x1a1/0x1a1 [ 2807.385534] ? ___ratelimit+0x37c/0x686 [ 2807.385553] ? mark_held_locks+0xb1/0x100 [ 2807.392685] binder: 7964:7966 unknown command 0 [ 2807.396612] ? _raw_spin_unlock_irqrestore+0x6b/0xe0 [ 2807.396627] ? _raw_spin_unlock_irqrestore+0x6b/0xe0 [ 2807.396642] ? lockdep_hardirqs_on+0x415/0x5d0 [ 2807.396669] ? trace_hardirqs_on+0xbd/0x310 [ 2807.396687] ? kasan_check_read+0x11/0x20 [ 2807.396707] ? ___ratelimit+0x37c/0x686 [ 2807.396722] ? trace_hardirqs_off_caller+0x300/0x300 [ 2807.396736] ? do_raw_spin_trylock+0x270/0x270 [ 2807.396763] ? trace_hardirqs_on_caller+0x310/0x310 [ 2807.396779] ? lock_acquire+0x1db/0x570 [ 2807.396801] ? _raw_spin_unlock_irqrestore+0xa4/0xe0 [ 2807.396816] ? ___ratelimit+0xac/0x686 [ 2807.396836] ? idr_get_free+0xee0/0xee0 [ 2807.408398] binder: 7964:7966 ioctl c0306201 20000600 returned -22 [ 2807.409595] ? lockdep_hardirqs_on+0x415/0x5d0 [ 2807.409624] oom_kill_process.cold+0x10/0x9d4 [ 2807.409643] ? cgroup_procs_next+0x70/0x70 [ 2807.409661] ? _raw_spin_unlock_irq+0x5e/0x90 [ 2807.418106] binder: 7964:7966 BC_ACQUIRE_DONE u0000000000000000 no match [ 2807.418542] ? oom_badness+0xa50/0xa50 [ 2807.418563] ? oom_evaluate_task+0x540/0x540 [ 2807.418578] ? mem_cgroup_iter_break+0x30/0x30 [ 2807.418592] ? mutex_trylock+0x2d0/0x2d0 [ 2807.430104] binder: 7964:7966 unknown command 0 [ 2807.432491] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 2807.432520] ? rcu_read_unlock_special+0x380/0x380 [ 2807.432546] out_of_memory+0x885/0x1420 [ 2807.432572] ? oom_killer_disable+0x340/0x340 [ 2807.432589] ? mem_cgroup_unmark_under_oom+0x8d/0xb0 [ 2807.440784] binder: 7964:7966 ioctl c0306201 20000600 returned -22 [ 2807.442253] ? lock_acquire+0x1db/0x570 [ 2807.442284] mem_cgroup_out_of_memory+0x160/0x210 [ 2807.442299] ? do_raw_spin_unlock+0xa0/0x330 [ 2807.442313] ? memcg_memory_event+0x40/0x40 [ 2807.442328] ? do_raw_spin_trylock+0x270/0x270 [ 2807.549208] ? _raw_spin_unlock+0x2d/0x50 [ 2807.549230] try_charge+0x12a9/0x19b0 [ 2807.549247] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 14:36:40 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) [ 2807.549271] ? mem_cgroup_oom_trylock+0x1a0/0x1a0 [ 2807.549286] ? rcu_read_unlock_special+0x380/0x380 [ 2807.549312] ? get_mem_cgroup_from_mm+0x1ea/0x420 [ 2807.562947] ? get_mem_cgroup_from_page+0x190/0x190 [ 2807.562972] ? rcu_read_lock_sched_held+0x110/0x130 [ 2807.562989] mem_cgroup_try_charge+0x43a/0xdb0 [ 2807.634119] ? mem_cgroup_protected+0xa10/0xa10 [ 2807.638813] ? swap_duplicate+0x80/0x80 [ 2807.642803] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 2807.648352] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 2807.653909] mem_cgroup_try_charge_delay+0x1f/0xa0 [ 2807.658851] do_huge_pmd_wp_page_fallback+0x267/0x1a90 [ 2807.664256] ? __alloc_pages_nodemask+0xaca/0xdc0 [ 2807.669117] ? remap_page+0x200/0x200 [ 2807.672943] ? do_raw_spin_unlock+0xa0/0x330 [ 2807.677357] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 2807.682908] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 2807.688463] ? alloc_pages_vma+0x142/0x540 [ 2807.692718] do_huge_pmd_wp_page+0x960/0x2430 [ 2807.697748] ? __split_huge_pmd+0xc10/0xc10 [ 2807.702097] ? __lock_acquire+0x572/0x4a30 [ 2807.706340] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 2807.711885] ? page_rmapping+0xcf/0x160 [ 2807.715872] ? vm_mmap+0xc0/0xc0 [ 2807.719258] ? mark_held_locks+0x100/0x100 [ 2807.723525] ? mark_held_locks+0x100/0x100 [ 2807.727774] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 2807.733319] ? pmd_val+0x85/0x100 [ 2807.736780] ? add_mm_counter_fast.part.0+0x40/0x40 [ 2807.741810] ? debug_smp_processor_id+0x1c/0x20 [ 2807.746491] __handle_mm_fault+0x1b25/0x5690 [ 2807.751057] ? vmf_insert_mixed_mkwrite+0x40/0x40 [ 2807.751074] ? check_preemption_disabled+0x48/0x290 [ 2807.761038] ? handle_mm_fault+0x3cc/0xc80 [ 2807.765293] ? lock_downgrade+0x910/0x910 [ 2807.765309] ? kasan_check_read+0x11/0x20 [ 2807.765324] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 2807.765340] ? rcu_read_unlock_special+0x380/0x380 [ 2807.765356] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 2807.765371] ? check_preemption_disabled+0x48/0x290 [ 2807.765393] handle_mm_fault+0x4ec/0xc80 [ 2807.765411] ? __handle_mm_fault+0x5690/0x5690 [ 2807.765438] __do_page_fault+0x5da/0xd60 [ 2807.807101] ? do_futex+0x2910/0x2910 [ 2807.811215] do_page_fault+0xe6/0x7d8 [ 2807.815149] ? trace_hardirqs_on_caller+0xc0/0x310 [ 2807.820092] ? vmalloc_sync_all+0x30/0x30 [ 2807.824254] ? __bpf_trace_preemptirq_template+0x30/0x30 [ 2807.829750] ? syscall_return_slowpath+0x5f0/0x5f0 [ 2807.834680] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 2807.840226] ? prepare_exit_to_usermode+0x232/0x3b0 [ 2807.845242] ? page_fault+0x8/0x30 [ 2807.848802] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 2807.853634] ? page_fault+0x8/0x30 [ 2807.857177] page_fault+0x1e/0x30 [ 2807.860627] RIP: 0033:0x400590 [ 2807.863815] Code: 06 e9 49 01 00 00 48 8b 44 24 10 48 0b 44 24 28 75 1f 48 8b 14 24 48 8b 7c 24 20 be 04 00 00 00 e8 e5 4a 00 00 48 8b 74 24 08 <89> 06 e9 1e 01 00 00 48 8b 44 24 08 48 8b 14 24 be 04 00 00 00 8b [ 2807.882724] RSP: 002b:0000000000a4fbc0 EFLAGS: 00010206 [ 2807.888076] RAX: 0000000000000050 RBX: 000000000073c900 RCX: 0000000000000000 [ 2807.895340] RDX: 0000000000000000 RSI: 0000000020000040 RDI: 0000000000000050 [ 2807.902603] RBP: 000000000073c900 R08: 0000000000000000 R09: 0000000000000000 [ 2807.909858] R10: 0000000000a4fcc0 R11: 0000000000000246 R12: 00000000000003e8 [ 2807.917122] R13: fffffffffffffffe R14: 00000000002ad5bf R15: 000000000073bf0c [ 2807.929405] memory: usage 307200kB, limit 307200kB, failcnt 161 [ 2807.936182] memory+swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 2807.943032] kmem: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 2807.949312] Memory cgroup stats for /syz0: cache:28KB rss:261036KB rss_huge:239616KB shmem:24KB mapped_file:0KB dirty:0KB writeback:0KB swap:0KB inactive_anon:0KB active_anon:261080KB inactive_file:0KB active_file:0KB unevictable:0KB [ 2807.970790] oom-kill:constraint=CONSTRAINT_NONE,nodemask=(null),cpuset=syz0,mems_allowed=0-1,oom_memcg=/syz0,task_memcg=/syz0,task=syz-executor0,pid=18118,uid=0 [ 2807.985411] Memory cgroup out of memory: Kill process 18118 (syz-executor0) score 1113 or sacrifice child [ 2807.995227] Killed process 18118 (syz-executor0) total-vm:70796kB, anon-rss:4276kB, file-rss:33740kB, shmem-rss:0kB 14:36:40 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_dev$mice(0x0, 0x0, 0x0) write$FUSE_INIT(r1, &(0x7f0000000040)={0x50, 0x0, 0x5, {0x7, 0x1c, 0x0, 0x0, 0x2, 0x0, 0x0, 0x9}}, 0x50) r2 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000380)=0x6) 14:36:40 executing program 2: clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(0xffffffffffffffff, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) 14:36:40 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x7f\xff\xff\xff\x00'}}}}, 0x68}}, 0x0) 14:36:40 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x40486312, 0x0}) 14:36:40 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) 14:36:40 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)) [ 2808.009776] oom_reaper: reaped process 18118 (syz-executor0), now anon-rss:0kB, file-rss:32780kB, shmem-rss:0kB [ 2808.092172] binder: 7981:7983 BC_ACQUIRE_DONE u0000000000000000 no match [ 2808.123128] binder: 7981:7983 unknown command 0 [ 2808.143067] binder: 7981:7983 ioctl c0306201 20000600 returned -22 [ 2808.171488] binder: 7981:7983 unknown command 0 14:36:41 executing program 2: clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) 14:36:41 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xf0\x00'}}}}, 0x68}}, 0x0) [ 2808.188547] binder: 7981:7983 ioctl c0306201 20000600 returned -22 14:36:41 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)) 14:36:41 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x60, 0x0}) 14:36:41 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\x9e\x00'}}}}, 0x68}}, 0x0) 14:36:41 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)) [ 2808.363494] binder: 7998:8000 unknown command 0 [ 2808.379833] binder: 7998:8000 ioctl c0306201 20000600 returned -22 14:36:41 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_dev$mice(0x0, 0x0, 0x0) write$FUSE_INIT(r1, &(0x7f0000000040)={0x50, 0x0, 0x5, {0x7, 0x1c, 0x0, 0x0, 0x2, 0x0, 0x0, 0x9}}, 0x50) r2 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000380)=0x6) 14:36:41 executing program 2: clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) 14:36:41 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x400c630e, 0x0}) 14:36:41 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03@\x00'}}}}, 0x68}}, 0x0) [ 2808.616214] binder: 8014:8019 unknown command 0 [ 2808.635226] binder: 8014:8019 ioctl c0306201 20000600 returned -22 14:36:41 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) 14:36:41 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_dev$mice(0x0, 0x0, 0x0) write$FUSE_INIT(r1, &(0x7f0000000040)={0x50, 0x0, 0x5, {0x7, 0x1c, 0x0, 0x0, 0x2, 0x0, 0x0, 0x9}}, 0x50) r2 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000380)=0x6) 14:36:41 executing program 2: clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) 14:36:41 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x7630440, 0x0}) 14:36:41 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00'}}}}, 0x68}}, 0x0) 14:36:41 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) write$FUSE_INIT(0xffffffffffffffff, &(0x7f0000000040)={0x50, 0x0, 0x5, {0x7, 0x1c, 0x0, 0x0, 0x2, 0x0, 0x0, 0x9}}, 0x50) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) [ 2808.824735] binder: 8031:8032 unknown command 0 14:36:41 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\x9e\x00'}}}}, 0x68}}, 0x0) [ 2808.854378] binder: 8031:8032 ioctl c0306201 20000600 returned -22 14:36:41 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x7a00, 0x0}) 14:36:41 executing program 2: clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) 14:36:42 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x7f\xff\xff\xff\x00'}}}}, 0x68}}, 0x0) [ 2809.036281] binder: 8053:8054 unknown command 0 [ 2809.049215] binder: 8053:8054 ioctl c0306201 20000600 returned -22 14:36:42 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x40046302, 0x0}) 14:36:42 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00'}}}}, 0x68}}, 0x0) [ 2809.274738] binder: 8065:8066 unknown command 0 [ 2809.299137] binder: 8065:8066 ioctl c0306201 20000600 returned -22 14:36:42 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) 14:36:42 executing program 2: clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) 14:36:42 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) write$FUSE_INIT(0xffffffffffffffff, &(0x7f0000000040)={0x50, 0x0, 0x5, {0x7, 0x1c, 0x0, 0x0, 0x2, 0x0, 0x0, 0x9}}, 0x50) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) 14:36:42 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_dev$mice(0x0, 0x0, 0x0) write$FUSE_INIT(r1, &(0x7f0000000040)={0x50, 0x0, 0x5, {0x7, 0x1c, 0x0, 0x0, 0x2, 0x0, 0x0, 0x9}}, 0x50) r2 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000380)=0x6) 14:36:42 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xf0\xff\xff\xff\xff\xff\xff\x00'}}}}, 0x68}}, 0x0) 14:36:42 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x40406301, 0x0}) [ 2809.442663] binder: 8075:8077 unknown command 0 [ 2809.469550] binder: 8075:8077 ioctl c0306201 20000600 returned -22 14:36:42 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x60000000, 0x0}) 14:36:42 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xa1\x00'}}}}, 0x68}}, 0x0) [ 2809.609671] binder: 8094:8097 unknown command 0 14:36:42 executing program 2: clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) 14:36:42 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$netlink(0x10, 0x3, 0x0) write(r1, &(0x7f0000000040)="220000002000070700be0000090007010a00001e00003c0000ff040405000c008000", 0x22) r2 = syz_open_procfs(0x0, &(0x7f00000001c0)='mounts\x00') setsockopt$IP6T_SO_SET_ADD_COUNTERS(r2, 0x29, 0x41, &(0x7f0000000000)={'mangle\x00', 0x2, [{}, {}]}, 0x48) sendfile(r2, r2, &(0x7f0000000080), 0x5) [ 2809.642062] binder: 8094:8097 ioctl c0306201 20000600 returned -22 14:36:42 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00'}}}}, 0x68}}, 0x0) 14:36:42 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x700000000000000, 0x0}) 14:36:42 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) 14:36:42 executing program 0: syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, 0x0, 0x0) setsockopt$IP_VS_SO_SET_DELDEST(0xffffffffffffffff, 0x0, 0x488, 0x0, 0x0) r1 = syz_open_dev$radio(&(0x7f0000000000)='/dev/radio#\x00', 0x2, 0x2) accept4$inet(r1, &(0x7f0000000040)={0x2, 0x0, @multicast1}, &(0x7f0000000080)=0x10, 0x0) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000000)={'vet\x00\x00\x00\x00\x00\x00\x00\x00\x00\xbdh\x00', 0x43732e5398416f1a}) r3 = socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = shmget$private(0x0, 0x7000, 0x800, &(0x7f0000ff9000/0x7000)=nil) shmctl$IPC_STAT(r4, 0x2, &(0x7f0000000080)=""/19) r5 = socket$inet(0x2, 0x3, 0x2) r6 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000340)='/dev/sequencer2\x00', 0x0, 0x0) ioctl$SIOCSIFMTU(r6, 0x8922, &(0x7f0000000200)={'veth0\x00', 0x1f2}) getsockname(r6, &(0x7f0000000140)=@ipx, &(0x7f00000001c0)=0x80) syz_genetlink_get_family_id$ipvs(&(0x7f0000000500)='IPVS\x00') sendmsg$IPVS_CMD_SET_CONFIG(r6, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x10000800}, 0xc, &(0x7f0000000580)={&(0x7f00000003c0)=ANY=[@ANYBLOB="000229d95c8ff4e2c041d353b2475de4b5bb5aae0000000000000c0000000c0003000800040008000000"], 0x1}, 0x1, 0x0, 0x0, 0x80}, 0x2000c811) setsockopt$SO_VM_SOCKETS_BUFFER_SIZE(r6, 0x28, 0x0, &(0x7f0000000100)=0x1, 0x8) setsockopt$inet_int(r5, 0x0, 0xca, &(0x7f0000000000)=0x10001, 0x10) dup2(r3, r5) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x3e7, 0x0, 0x0, 0x3, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BLKGETSIZE64(0xffffffffffffffff, 0x80081272, &(0x7f0000000240)) r7 = syz_open_procfs(0x0, &(0x7f00000001c0)='clear_refs\x00') openat$vnet(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vhost-net\x00', 0x2, 0x0) lsetxattr$security_ima(&(0x7f0000000280)='./file0\x00', &(0x7f00000002c0)='security.ima\x00', &(0x7f0000000700)=ANY=[@ANYBLOB="070097f69b0c0e8b14dd3ab6f89bd0e535604ac1731be4323883ad3ddfa2affd1f0e828d08c7807640352786ce813bd1c7f477cf1fd5378dbbe925a27a180600da73874f839bb74f8a8b93efd91a631d869fb2ebf2a5a3e1e35d86a66f1efeba786c37636b57557cecc8fa7c0a5f3e1ebd3dee7774d79f382b4f2f4c19c25f9da7d74a8edaa8cd120000d653f229421871677024600e51f6c14e41de81f734830dc45c90a78b72b194bd5d6ffc22bed7fdcca32c505a6006d74a1748dc04d43fa8df522e4566d18067e39d6400ea9bdca43e2a405a897f9f066b760606a280e1f56627f9d914620bd4c8f4efffa03df86c70917cf5ffb45dae"], 0x1, 0x3) setxattr$security_capability(&(0x7f0000000540)='./file0\x00', &(0x7f0000000380)='security.capability\x00', &(0x7f0000000440)=@v1={0x1000000, [{0x4f83, 0x4}]}, 0x0, 0x2) pwritev(r7, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) 14:36:42 executing program 2: clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) [ 2809.831489] binder: 8112:8113 unknown command 0 [ 2809.857933] binder: 8112:8113 ioctl c0306201 20000600 returned -22 14:36:43 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_dev$mice(0x0, 0x0, 0x0) write$FUSE_INIT(r1, &(0x7f0000000040)={0x50, 0x0, 0x5, {0x7, 0x1c, 0x0, 0x0, 0x2, 0x0, 0x0, 0x9}}, 0x50) r2 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000380)=0x6) 14:36:43 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xfc\x00'}}}}, 0x68}}, 0x0) 14:36:43 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x3630840, 0x0}) 14:36:43 executing program 2: clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) [ 2810.174386] binder: 8137:8139 unknown command 0 14:36:43 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00'}}}}, 0x68}}, 0x0) [ 2810.199707] binder: 8137:8139 ioctl c0306201 20000600 returned -22 14:36:43 executing program 2: clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) 14:36:43 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0xa000000, 0x0}) 14:36:43 executing program 0: syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, 0x0, 0x0) setsockopt$IP_VS_SO_SET_DELDEST(0xffffffffffffffff, 0x0, 0x488, 0x0, 0x0) r1 = syz_open_dev$radio(&(0x7f0000000000)='/dev/radio#\x00', 0x2, 0x2) accept4$inet(r1, &(0x7f0000000040)={0x2, 0x0, @multicast1}, &(0x7f0000000080)=0x10, 0x0) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000000)={'vet\x00\x00\x00\x00\x00\x00\x00\x00\x00\xbdh\x00', 0x43732e5398416f1a}) r3 = socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = shmget$private(0x0, 0x7000, 0x800, &(0x7f0000ff9000/0x7000)=nil) shmctl$IPC_STAT(r4, 0x2, &(0x7f0000000080)=""/19) r5 = socket$inet(0x2, 0x3, 0x2) r6 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000340)='/dev/sequencer2\x00', 0x0, 0x0) ioctl$SIOCSIFMTU(r6, 0x8922, &(0x7f0000000200)={'veth0\x00', 0x1f2}) getsockname(r6, &(0x7f0000000140)=@ipx, &(0x7f00000001c0)=0x80) syz_genetlink_get_family_id$ipvs(&(0x7f0000000500)='IPVS\x00') sendmsg$IPVS_CMD_SET_CONFIG(r6, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x10000800}, 0xc, &(0x7f0000000580)={&(0x7f00000003c0)=ANY=[@ANYBLOB="000229d95c8ff4e2c041d353b2475de4b5bb5aae0000000000000c0000000c0003000800040008000000"], 0x1}, 0x1, 0x0, 0x0, 0x80}, 0x2000c811) setsockopt$SO_VM_SOCKETS_BUFFER_SIZE(r6, 0x28, 0x0, &(0x7f0000000100)=0x1, 0x8) setsockopt$inet_int(r5, 0x0, 0xca, &(0x7f0000000000)=0x10001, 0x10) dup2(r3, r5) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x3e7, 0x0, 0x0, 0x3, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BLKGETSIZE64(0xffffffffffffffff, 0x80081272, &(0x7f0000000240)) r7 = syz_open_procfs(0x0, &(0x7f00000001c0)='clear_refs\x00') openat$vnet(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vhost-net\x00', 0x2, 0x0) lsetxattr$security_ima(&(0x7f0000000280)='./file0\x00', &(0x7f00000002c0)='security.ima\x00', &(0x7f0000000700)=ANY=[@ANYBLOB="070097f69b0c0e8b14dd3ab6f89bd0e535604ac1731be4323883ad3ddfa2affd1f0e828d08c7807640352786ce813bd1c7f477cf1fd5378dbbe925a27a180600da73874f839bb74f8a8b93efd91a631d869fb2ebf2a5a3e1e35d86a66f1efeba786c37636b57557cecc8fa7c0a5f3e1ebd3dee7774d79f382b4f2f4c19c25f9da7d74a8edaa8cd120000d653f229421871677024600e51f6c14e41de81f734830dc45c90a78b72b194bd5d6ffc22bed7fdcca32c505a6006d74a1748dc04d43fa8df522e4566d18067e39d6400ea9bdca43e2a405a897f9f066b760606a280e1f56627f9d914620bd4c8f4efffa03df86c70917cf5ffb45dae"], 0x1, 0x3) setxattr$security_capability(&(0x7f0000000540)='./file0\x00', &(0x7f0000000380)='security.capability\x00', &(0x7f0000000440)=@v1={0x1000000, [{0x4f83, 0x4}]}, 0x0, 0x2) pwritev(r7, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) 14:36:43 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c4\x00'}}}}, 0x68}}, 0x0) [ 2810.378135] binder: 8153:8154 unknown command 0 [ 2810.414104] binder: 8153:8154 ioctl c0306201 20000600 returned -22 14:36:43 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) 14:36:43 executing program 3: r0 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) fcntl$F_GET_RW_HINT(r0, 0x40b, &(0x7f0000000080)) getpid() r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sequencer2\x00', 0x0, 0x0) ioctl$LOOP_CTL_GET_FREE(r1, 0x4c82) getpid() ioctl$UDMABUF_CREATE(r1, 0x40187542, &(0x7f0000000100)={r1, 0x0, 0x2000, 0x1000000}) clock_nanosleep(0x5, 0x1, &(0x7f0000000140)={0x0, 0x1c9c380}, &(0x7f00000001c0)) ioctl$TIOCGPGRP(0xffffffffffffff9c, 0x540f, &(0x7f0000000000)=0x0) r3 = syz_open_procfs(r2, &(0x7f0000000040)='cgroup\x00') sendfile(r3, r3, &(0x7f0000000180)=0x74000000, 0x5) 14:36:43 executing program 2: clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000380)=0x6) 14:36:43 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00'}}}}, 0x68}}, 0x0) 14:36:43 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x4, 0x0}) 14:36:43 executing program 3: r0 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) fcntl$F_GET_RW_HINT(r0, 0x40b, &(0x7f0000000080)) getpid() r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sequencer2\x00', 0x0, 0x0) ioctl$LOOP_CTL_GET_FREE(r1, 0x4c82) getpid() ioctl$UDMABUF_CREATE(r1, 0x40187542, &(0x7f0000000100)={r1, 0x0, 0x2000, 0x1000000}) clock_nanosleep(0x5, 0x1, &(0x7f0000000140)={0x0, 0x1c9c380}, &(0x7f00000001c0)) ioctl$TIOCGPGRP(0xffffffffffffff9c, 0x540f, &(0x7f0000000000)=0x0) r3 = syz_open_procfs(r2, &(0x7f0000000040)='cgroup\x00') sendfile(r3, r3, &(0x7f0000000180)=0x74000000, 0x5) [ 2810.661815] binder: 8177:8178 unknown command 0 14:36:43 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00'}}}}, 0x68}}, 0x0) [ 2810.702417] binder: 8177:8178 ioctl c0306201 20000600 returned -22 14:36:43 executing program 2: clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, 0x0) 14:36:43 executing program 0: syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, 0x0, 0x0) setsockopt$IP_VS_SO_SET_DELDEST(0xffffffffffffffff, 0x0, 0x488, 0x0, 0x0) r1 = syz_open_dev$radio(&(0x7f0000000000)='/dev/radio#\x00', 0x2, 0x2) accept4$inet(r1, &(0x7f0000000040)={0x2, 0x0, @multicast1}, &(0x7f0000000080)=0x10, 0x0) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000000)={'vet\x00\x00\x00\x00\x00\x00\x00\x00\x00\xbdh\x00', 0x43732e5398416f1a}) r3 = socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = shmget$private(0x0, 0x7000, 0x800, &(0x7f0000ff9000/0x7000)=nil) shmctl$IPC_STAT(r4, 0x2, &(0x7f0000000080)=""/19) r5 = socket$inet(0x2, 0x3, 0x2) r6 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000340)='/dev/sequencer2\x00', 0x0, 0x0) ioctl$SIOCSIFMTU(r6, 0x8922, &(0x7f0000000200)={'veth0\x00', 0x1f2}) getsockname(r6, &(0x7f0000000140)=@ipx, &(0x7f00000001c0)=0x80) syz_genetlink_get_family_id$ipvs(&(0x7f0000000500)='IPVS\x00') sendmsg$IPVS_CMD_SET_CONFIG(r6, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x10000800}, 0xc, &(0x7f0000000580)={&(0x7f00000003c0)=ANY=[@ANYBLOB="000229d95c8ff4e2c041d353b2475de4b5bb5aae0000000000000c0000000c0003000800040008000000"], 0x1}, 0x1, 0x0, 0x0, 0x80}, 0x2000c811) setsockopt$SO_VM_SOCKETS_BUFFER_SIZE(r6, 0x28, 0x0, &(0x7f0000000100)=0x1, 0x8) setsockopt$inet_int(r5, 0x0, 0xca, &(0x7f0000000000)=0x10001, 0x10) dup2(r3, r5) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x3e7, 0x0, 0x0, 0x3, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BLKGETSIZE64(0xffffffffffffffff, 0x80081272, &(0x7f0000000240)) r7 = syz_open_procfs(0x0, &(0x7f00000001c0)='clear_refs\x00') openat$vnet(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vhost-net\x00', 0x2, 0x0) lsetxattr$security_ima(&(0x7f0000000280)='./file0\x00', &(0x7f00000002c0)='security.ima\x00', &(0x7f0000000700)=ANY=[@ANYBLOB="070097f69b0c0e8b14dd3ab6f89bd0e535604ac1731be4323883ad3ddfa2affd1f0e828d08c7807640352786ce813bd1c7f477cf1fd5378dbbe925a27a180600da73874f839bb74f8a8b93efd91a631d869fb2ebf2a5a3e1e35d86a66f1efeba786c37636b57557cecc8fa7c0a5f3e1ebd3dee7774d79f382b4f2f4c19c25f9da7d74a8edaa8cd120000d653f229421871677024600e51f6c14e41de81f734830dc45c90a78b72b194bd5d6ffc22bed7fdcca32c505a6006d74a1748dc04d43fa8df522e4566d18067e39d6400ea9bdca43e2a405a897f9f066b760606a280e1f56627f9d914620bd4c8f4efffa03df86c70917cf5ffb45dae"], 0x1, 0x3) setxattr$security_capability(&(0x7f0000000540)='./file0\x00', &(0x7f0000000380)='security.capability\x00', &(0x7f0000000440)=@v1={0x1000000, [{0x4f83, 0x4}]}, 0x0, 0x2) pwritev(r7, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) 14:36:43 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x1200000000000000, 0x0}) 14:36:43 executing program 3: r0 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) fcntl$F_GET_RW_HINT(r0, 0x40b, &(0x7f0000000080)) getpid() r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sequencer2\x00', 0x0, 0x0) ioctl$LOOP_CTL_GET_FREE(r1, 0x4c82) getpid() ioctl$UDMABUF_CREATE(r1, 0x40187542, &(0x7f0000000100)={r1, 0x0, 0x2000, 0x1000000}) clock_nanosleep(0x5, 0x1, &(0x7f0000000140)={0x0, 0x1c9c380}, &(0x7f00000001c0)) ioctl$TIOCGPGRP(0xffffffffffffff9c, 0x540f, &(0x7f0000000000)=0x0) r3 = syz_open_procfs(r2, &(0x7f0000000040)='cgroup\x00') sendfile(r3, r3, &(0x7f0000000180)=0x74000000, 0x5) 14:36:43 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x9e\xff\xff\xff\x00'}}}}, 0x68}}, 0x0) [ 2810.914618] binder_thread_write: 12 callbacks suppressed [ 2810.914631] binder: 8194:8197 BC_ACQUIRE_DONE u0000000000000000 no match [ 2810.994690] binder: 8194:8197 unknown command 0 [ 2810.999805] binder: 8194:8197 ioctl c0306201 20000600 returned -22 14:36:44 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) 14:36:44 executing program 2: clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)) 14:36:44 executing program 3: r0 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) fcntl$F_GET_RW_HINT(r0, 0x40b, &(0x7f0000000080)) getpid() r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sequencer2\x00', 0x0, 0x0) ioctl$LOOP_CTL_GET_FREE(r1, 0x4c82) getpid() ioctl$UDMABUF_CREATE(r1, 0x40187542, &(0x7f0000000100)={r1, 0x0, 0x2000, 0x1000000}) clock_nanosleep(0x5, 0x1, &(0x7f0000000140)={0x0, 0x1c9c380}, &(0x7f00000001c0)) ioctl$TIOCGPGRP(0xffffffffffffff9c, 0x540f, &(0x7f0000000000)) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000180)=0x74000000, 0x5) 14:36:44 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\n\x00'}}}}, 0x68}}, 0x0) 14:36:44 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0xc63, 0x0}) 14:36:44 executing program 3: r0 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) fcntl$F_GET_RW_HINT(r0, 0x40b, &(0x7f0000000080)) getpid() r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sequencer2\x00', 0x0, 0x0) ioctl$LOOP_CTL_GET_FREE(r1, 0x4c82) getpid() ioctl$UDMABUF_CREATE(r1, 0x40187542, &(0x7f0000000100)={r1, 0x0, 0x2000, 0x1000000}) clock_nanosleep(0x5, 0x1, &(0x7f0000000140)={0x0, 0x1c9c380}, &(0x7f00000001c0)) r2 = syz_open_procfs(0x0, &(0x7f0000000040)='cgroup\x00') sendfile(r2, r2, &(0x7f0000000180)=0x74000000, 0x5) 14:36:44 executing program 0: syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, 0x0, 0x0) setsockopt$IP_VS_SO_SET_DELDEST(0xffffffffffffffff, 0x0, 0x488, 0x0, 0x0) r1 = syz_open_dev$radio(&(0x7f0000000000)='/dev/radio#\x00', 0x2, 0x2) accept4$inet(r1, &(0x7f0000000040)={0x2, 0x0, @multicast1}, &(0x7f0000000080)=0x10, 0x0) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000000)={'vet\x00\x00\x00\x00\x00\x00\x00\x00\x00\xbdh\x00', 0x43732e5398416f1a}) r3 = socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = shmget$private(0x0, 0x7000, 0x800, &(0x7f0000ff9000/0x7000)=nil) shmctl$IPC_STAT(r4, 0x2, &(0x7f0000000080)=""/19) r5 = socket$inet(0x2, 0x3, 0x2) r6 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000340)='/dev/sequencer2\x00', 0x0, 0x0) ioctl$SIOCSIFMTU(r6, 0x8922, &(0x7f0000000200)={'veth0\x00', 0x1f2}) getsockname(r6, &(0x7f0000000140)=@ipx, &(0x7f00000001c0)=0x80) syz_genetlink_get_family_id$ipvs(&(0x7f0000000500)='IPVS\x00') sendmsg$IPVS_CMD_SET_CONFIG(r6, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x10000800}, 0xc, &(0x7f0000000580)={&(0x7f00000003c0)=ANY=[@ANYBLOB="000229d95c8ff4e2c041d353b2475de4b5bb5aae0000000000000c0000000c0003000800040008000000"], 0x1}, 0x1, 0x0, 0x0, 0x80}, 0x2000c811) setsockopt$SO_VM_SOCKETS_BUFFER_SIZE(r6, 0x28, 0x0, &(0x7f0000000100)=0x1, 0x8) setsockopt$inet_int(r5, 0x0, 0xca, &(0x7f0000000000)=0x10001, 0x10) dup2(r3, r5) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x3e7, 0x0, 0x0, 0x3, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BLKGETSIZE64(0xffffffffffffffff, 0x80081272, &(0x7f0000000240)) r7 = syz_open_procfs(0x0, &(0x7f00000001c0)='clear_refs\x00') openat$vnet(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vhost-net\x00', 0x2, 0x0) lsetxattr$security_ima(&(0x7f0000000280)='./file0\x00', &(0x7f00000002c0)='security.ima\x00', &(0x7f0000000700)=ANY=[@ANYBLOB="070097f69b0c0e8b14dd3ab6f89bd0e535604ac1731be4323883ad3ddfa2affd1f0e828d08c7807640352786ce813bd1c7f477cf1fd5378dbbe925a27a180600da73874f839bb74f8a8b93efd91a631d869fb2ebf2a5a3e1e35d86a66f1efeba786c37636b57557cecc8fa7c0a5f3e1ebd3dee7774d79f382b4f2f4c19c25f9da7d74a8edaa8cd120000d653f229421871677024600e51f6c14e41de81f734830dc45c90a78b72b194bd5d6ffc22bed7fdcca32c505a6006d74a1748dc04d43fa8df522e4566d18067e39d6400ea9bdca43e2a405a897f9f066b760606a280e1f56627f9d914620bd4c8f4efffa03df86c70917cf5ffb45dae"], 0x1, 0x3) setxattr$security_capability(&(0x7f0000000540)='./file0\x00', &(0x7f0000000380)='security.capability\x00', &(0x7f0000000440)=@v1={0x1000000, [{0x4f83, 0x4}]}, 0x0, 0x2) pwritev(r7, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) [ 2811.218287] binder: 8218:8219 BC_ACQUIRE_DONE u0000000000000000 no match 14:36:44 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0f\x00'}}}}, 0x68}}, 0x0) [ 2811.285980] binder: 8218:8219 unknown command 0 14:36:44 executing program 2: clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)) [ 2811.320935] binder: 8218:8219 ioctl c0306201 20000600 returned -22 14:36:44 executing program 3: r0 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) fcntl$F_GET_RW_HINT(r0, 0x40b, &(0x7f0000000080)) getpid() r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sequencer2\x00', 0x0, 0x0) ioctl$LOOP_CTL_GET_FREE(r1, 0x4c82) getpid() ioctl$UDMABUF_CREATE(r1, 0x40187542, &(0x7f0000000100)={r1, 0x0, 0x2000, 0x1000000}) r2 = syz_open_procfs(0x0, &(0x7f0000000040)='cgroup\x00') sendfile(r2, r2, &(0x7f0000000180)=0x74000000, 0x5) 14:36:44 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xff\x00'}}}}, 0x68}}, 0x0) 14:36:44 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x7400000000000000, 0x0}) [ 2811.484774] binder: 8235:8237 BC_ACQUIRE_DONE u0000000000000000 no match [ 2811.491711] binder: 8235:8237 unknown command 0 [ 2811.541244] binder: 8235:8237 ioctl c0306201 20000600 returned -22 14:36:44 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) 14:36:44 executing program 3: r0 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) fcntl$F_GET_RW_HINT(r0, 0x40b, &(0x7f0000000080)) getpid() r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sequencer2\x00', 0x0, 0x0) ioctl$LOOP_CTL_GET_FREE(r1, 0x4c82) getpid() r2 = syz_open_procfs(0x0, &(0x7f0000000040)='cgroup\x00') sendfile(r2, r2, &(0x7f0000000180)=0x74000000, 0x5) 14:36:44 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xf0\xff\xff\x00'}}}}, 0x68}}, 0x0) 14:36:44 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x4c000000, 0x0}) 14:36:44 executing program 2: clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)) [ 2811.719343] binder: 8253:8256 BC_ACQUIRE_DONE u0000000000000000 no match 14:36:44 executing program 0: syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/net\x00') pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f00000001c0)=0x115, 0x4) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000240)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_GET(r0, &(0x7f0000000400)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000ec0)=ANY=[@ANYBLOB="5a7a2d589b7127ac19fcd9ae2c0092811857ae59490a3536874d559e3e01bc610c6835d16151ed69daafac7874546fa7ef5de820f1619bb7def0c7abb87208e7cd9eff964c79166348037b405227dd4ff81ee7ea53a9385a44968b8b6dc5b356ad92316c5b639e3de2f9208865a3c9d88e73a840", @ANYRES16=r2, @ANYBLOB="000025bd7000fbdbdf2504000000880001002c000200080001001a00000008000100130000000800020009000000080001000e0000000800020004200000380004001400010002004e24e00000020000000000000000200002000a004e21cd45000000000000000000000000000000000001030000001400020008000300040000000800030002000000260002000800020003000000240009000800020002000000080001000400000008000900040000000800020002010000480007000c000400faffffffffffe96f00d434904129117ebd9effff0c00030000000000000000b808000200660000000800010000d40e00080001001500000008000100070000000c0004000104000000000000"], 0x108}, 0x1, 0x0, 0x0, 0x80}, 0xc010) r3 = getpid() r4 = syz_open_procfs$namespace(r3, &(0x7f0000000100)='ns/uts\x00') getsockopt$inet6_IPV6_IPSEC_POLICY(r1, 0x29, 0x22, &(0x7f0000000440)={{{@in=@remote, @in=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast1}, 0x0, @in=@loopback}}, &(0x7f0000000540)=0xe8) r6 = open(&(0x7f0000000000)='./file0\x00', 0x8e059bff475785fc, 0x100) ioctl$sock_bt_cmtp_CMTPCONNDEL(r6, 0x400443c9, &(0x7f0000000140)={{0x69, 0x3, 0x6, 0x100000000000, 0x5, 0x9}, 0xfffffffffffffc01}) bpf$OBJ_GET_PROG(0x7, &(0x7f0000000080)={&(0x7f0000000040)='./file0\x00', 0x0, 0x8}, 0x10) accept4(r1, &(0x7f0000000280)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @dev}}}, &(0x7f0000000300)=0x80, 0x80800) sendmsg$nl_generic(r6, &(0x7f0000000cc0)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000c80)={&(0x7f00000005c0)={0x694, 0x1a, 0x308, 0x70bd28, 0x25dfdbfb, {0xb}, [@typed={0x8, 0x3c, @uid=r5}, @nested={0x1d4, 0x64, [@typed={0x8, 0x89, @fd=r4}, @generic="0cc9ec535f0834dca527b4d32873c922b4e4adf4bed2aee43313fb6be0909c8102cc1fb497d8e6206954c22b", @generic="8fc69173fe27da60b4b6da56ced7df61ff13de534139707fc3e33ac65f72f1d88380372e1e5e55cabbc6ccfbe046a83c1032c3dacca6910ea4daf3ec8869d7b646016ab49c81fdc0154b5bc193f1a3a318765cfea46a36aa75a177b924816c7b47717e50adc71e01612be1e1a3beb3e6dcb1ba80167e1a56ab36373dd626a698721adc3afe32fce4ffa8fade234ac64ff6ccd9", @typed={0x8, 0x21, @ipv4=@multicast2}, @generic="101ed49d6407e9e35c92865864f04fb59b119a59e732d3dbbe92c17d6ecf222ffce0a979770f6c064a027a14590b5fd4f78fdede6b28c511d4d9da4af2723d4e51e0cc3acae439701a4f3c", @generic="f66a174cabd5eb456ffb73c3d801ae534f2896ea9b95e62b82e7b92464c8f03c46a1700bd37bee8239b6b7e0083fc453837b2b0b4d51ab1faf549b4791f76ee34684dbe1ae5e80887e78ba23f3f215069f0ff2556ef3874d7f664e984458218766373917003e0cb2253f1a126ed630841bf9a87488445655d38e1097988d429a4ab5b16cb2a2ac5f0ed0d54c225538e6cc95bcbade398cea098bfb7bb8ac9521f7b2fe7f1b5f9f08b39de525d8", @typed={0x8, 0xc, @pid=r3}]}, @typed={0xc, 0x36bad291, @u64=0x6}, @nested={0x184, 0x26, [@typed={0xc, 0x0, @str='ns/uts\x00'}, @typed={0x8, 0xf, @uid=r5}, @generic="b2fd954cd7cf97371b2c56f868a51055054c0abae1e2fb9a8f1a8646ad712cf5c3813926db6f1b0b947908c9d5c72d9a317c3eff9cfdc35266b00b670110ebf3eba0a68c72be8b39f0a737d53aa50b28e330416e45ca97570fa690c55b533f5b2c5dee37ee5df6963b90f4218da81e266586b7ec07839c65fac7ffa8733d338c86f3d1ecc5a408647cf8bb53dc8690c65351f4d25eecb58c233932a3e0c00ab4d88b9b181d367e8e09a5ef7db906327c1830d66ea534fff8aef8ffe9d0fb210674b330809930f155a2cd54c5cc93ff7b6d8faba557b3ad5121b1fbccec87b7ac955aa300da4f8925f15b2bd743af3a37ab8a2690c7bd79d2e5468fe18b", @typed={0x8, 0x8d, @str='em1\x00'}, @generic="502b464385736194f1e2483900f45d6f8ff3b297d3621fd132b036a0b4e02ee04408b45542b695ab914b0875228140e43433e433f75359a75d974af68fead229d6fcc7c57af07fe4fcd98ad174729f1fde7c43336d0d43f2c1026e5b5266b1a1c23aceef35efe5"]}, @nested={0x228, 0x29, [@typed={0x8, 0x44, @fd=r4}, @typed={0x8, 0x5, @ipv4=@dev={0xac, 0x14, 0x14, 0xc}}, @generic="eb414233396804e79123693f826ffc7e8d2d23d58d815e14e305078699cbb0742e902d9b3631c5f93ef582216021872107b11e4bebfd1656981c22668d8c052739e8f1fe63038d639d794b968781e27cf938c11c1fe2ab3964632eb9c6332643d226e8b52cd06462ee81932375886f28597bd6d6ca7bd7cc156c062a6a3573e0149f46395b6c97d5dbe3eb04886bd0907f2d90dcb02a53634d9c4c3524f80ddf2a09c1f865c00dc59327e84984466579ab1d30c666f2496ecf02fc2689f95d1251c0171c1706e0c9dc18b075e3c84ded4ff03f8d501cf4a2ffd7de9686bb0716115e", @generic="9735f0015135535c831e8a887e9f9631eee06d9b8b82e9628aeaf36dce3c51182bc75e81b20a241915a40928b5d89942e0f8ca42e462c46be05d336deb24ba101e", @generic="8c242deb1f829c7cb22d9295fe316d6d7c290fa753f273e7acba83c8e4b96a331face8b9de80d786269d7d219c3531445e84ff6f131dfa9a2fb64f25c5d129f26b96aad1f60995e90725e16324d04e32eaa2999828b9efc2896d2b7897d09c98a96c8197f9e11837c84c975b0c6864c1639a989ae30ed06aceb6b6cd0b552ba6fdd683e0af1e9ea6e78393ddac50ee5002008b92d501e19e8233cd356518212f36", @typed={0x4, 0x12}, @generic="a7a3277b9bb00c2022f0c4f1d0d5d0df1ce64adbfebeacbdf04b55b7bab731e68669388f7b71e32fdb37e0277dca40c5617eb12704db7252ca16dce9a039fda19187674d83b24d1a76db079e"]}, @generic="e4a79d935b154d18af9742e7374a00885bb72a0d760a0378c07d6b689c99ab0563f314530d4f0225ffd43d13512bc66a2f55914b54c06b18c859d6e62684c755ad9d076f6b91ab28be0544d183d9b42efaf12f75816b382616a25c13281e0f44b50b02bb1f4ac0a1e0d559298fed69b8ba0ff90d9c211a0128c6b0", @generic="05dd0df9221a7c6008082bead6987944ba8ed5b69db706f2f1c48e9daf64420e3f6fe425751402fe5b5d7559fd490c312e8e3660bd5ee0ac946fba1f0c67fb26e2b81251300ef70b1add9dfdd21a17541e721c1541df58ba28c76eb6550c627c4dde192f0baf9d08268f13f6412929"]}, 0x694}, 0x1, 0x0, 0x0, 0x20008000}, 0x4000000) 14:36:44 executing program 3: r0 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) fcntl$F_GET_RW_HINT(r0, 0x40b, &(0x7f0000000080)) getpid() r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sequencer2\x00', 0x0, 0x0) ioctl$LOOP_CTL_GET_FREE(r1, 0x4c82) r2 = syz_open_procfs(0x0, &(0x7f0000000040)='cgroup\x00') sendfile(r2, r2, &(0x7f0000000180)=0x74000000, 0x5) 14:36:44 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x04\x00'}}}}, 0x68}}, 0x0) [ 2811.793935] binder: 8253:8256 unknown command 0 [ 2811.798995] binder: 8253:8256 ioctl c0306201 20000600 returned -22 14:36:44 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000080)='/proc/capi/capi20\x00', 0x480000, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x2) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$FS_IOC_GETVERSION(r0, 0x80087601, &(0x7f0000000040)) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) pwrite64(r1, &(0x7f0000000100)="d14d6408ce9c55a4b7604c0a75448654ec0beed458e488ba643899efc021271c06a5479b787e8aaa3e8a551143eaef60441eef2f77b1c3979836a21bab5e8b20d1f84b1c67a63d9c0d1af68c7b6a5bddaf74f4cf72558bfcf020130d4fb6f30f9d96472610ab0a3c33303faf4de83621b9ec2e8446982dd4b9a7ef3b9186d820cadccbff0a8c24e5fbcd5b7d5d30c86edd23f7cf6cd7ca9e771a37a802a43597087411aad8723bf9469e68c7d5fb855f7066364c47a8264c8e63be690995b021de26939833abcce203888c8704eca333d1e014069953ce5b0dcd946caf7bf845aa2be16299168301556ceb48280f36ad99ce0e7a8bb08755279a263a5b6c7e", 0xff, 0x0) 14:36:44 executing program 2: syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/net\x00') syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns//et\x00') 14:36:44 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0xa00, 0x0}) 14:36:44 executing program 3: r0 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) fcntl$F_GET_RW_HINT(r0, 0x40b, &(0x7f0000000080)) getpid() openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sequencer2\x00', 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000040)='cgroup\x00') sendfile(r1, r1, &(0x7f0000000180)=0x74000000, 0x5) [ 2811.959157] binder: 8270:8272 ioctl 80087601 20000040 returned -22 [ 2811.980466] binder: 8273:8274 BC_ACQUIRE_DONE u0000000000000000 no match [ 2812.025236] binder: 8270:8272 got new transaction with bad transaction stack, transaction 9166 has target 8270:0 [ 2812.035857] binder: 8273:8274 unknown command 0 [ 2812.040578] binder: 8273:8274 ioctl c0306201 20000600 returned -22 [ 2812.084410] binder_transaction: 11 callbacks suppressed [ 2812.084478] binder: 8270:8272 transaction failed 29201/-71, size 0-0 line 2946 [ 2812.101268] binder: 8273:8274 BC_ACQUIRE_DONE u0000000000000000 no match [ 2812.126314] binder: 8273:8274 unknown command 0 [ 2812.144008] binder: 8273:8274 ioctl c0306201 20000600 returned -22 [ 2812.146027] binder: release 8270:8272 transaction 9166 out, still active [ 2812.192167] binder: undelivered TRANSACTION_COMPLETE 14:36:45 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000380)=0x6) 14:36:45 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00'}}}}, 0x68}}, 0x0) 14:36:45 executing program 3: r0 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) fcntl$F_GET_RW_HINT(r0, 0x40b, &(0x7f0000000080)) getpid() r1 = syz_open_procfs(0x0, &(0x7f0000000040)='cgroup\x00') sendfile(r1, r1, &(0x7f0000000180)=0x74000000, 0x5) 14:36:45 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='mounts\x00') sendfile(r0, r0, &(0x7f0000000180)=0x74000600, 0x5) 14:36:45 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0xc63000000000000, 0x0}) 14:36:45 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x6000000000000000, 0x0}) [ 2812.215309] binder_release_work: 2 callbacks suppressed [ 2812.215316] binder: undelivered TRANSACTION_ERROR: 29201 14:36:45 executing program 2 (fault-call:5 fault-nth:0): clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) [ 2812.265350] binder: 8288:8289 BC_ACQUIRE_DONE u0000000000000000 no match [ 2812.271469] binder: send failed reply for transaction 9166, target dead 14:36:45 executing program 3: r0 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) fcntl$F_GET_RW_HINT(r0, 0x40b, &(0x7f0000000080)) r1 = syz_open_procfs(0x0, &(0x7f0000000040)='cgroup\x00') sendfile(r1, r1, &(0x7f0000000180)=0x74000000, 0x5) 14:36:45 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00'}}}}, 0x68}}, 0x0) [ 2812.340378] binder: 8288:8289 unknown command 0 [ 2812.358448] binder: 8288:8289 ioctl c0306201 20000600 returned -22 [ 2812.377238] binder: 8296:8297 got new transaction with bad transaction stack, transaction 9169 has target 8296:0 [ 2812.404107] binder: 8296:8297 transaction failed 29201/-71, size 0-0 line 2946 14:36:45 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0xb63, 0x0}) [ 2812.482021] binder: release 8296:8297 transaction 9169 out, still active [ 2812.501764] binder: undelivered TRANSACTION_COMPLETE 14:36:45 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, 0x0) 14:36:45 executing program 3: ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000040)='cgroup\x00') sendfile(r0, r0, &(0x7f0000000180)=0x74000000, 0x5) 14:36:45 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00`\x00'}}}}, 0x68}}, 0x0) [ 2812.536699] binder: 8309:8310 BC_ACQUIRE_DONE u0000000000000000 no match [ 2812.545350] binder: undelivered TRANSACTION_ERROR: 29201 [ 2812.570206] binder: 8309:8310 unknown command 0 14:36:45 executing program 2: clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) [ 2812.595504] binder: 8309:8310 ioctl c0306201 20000600 returned -22 14:36:45 executing program 0 (fault-call:4 fault-nth:0): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) [ 2812.636319] binder: send failed reply for transaction 9169, target dead 14:36:45 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x68000000, 0x0}) 14:36:45 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000040)='cgroup\x00') sendfile(r0, r0, &(0x7f0000000180)=0x74000000, 0x5) [ 2812.693280] FAULT_INJECTION: forcing a failure. [ 2812.693280] name failslab, interval 1, probability 0, space 0, times 0 [ 2812.771913] binder: 8326:8327 BC_ACQUIRE_DONE u0000000000000000 no match [ 2812.775087] CPU: 1 PID: 8321 Comm: syz-executor0 Not tainted 4.20.0+ #5 [ 2812.785616] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2812.794978] Call Trace: [ 2812.797582] dump_stack+0x1db/0x2d0 [ 2812.801226] ? dump_stack_print_info.cold+0x20/0x20 [ 2812.804396] binder: 8326:8327 unknown command 0 [ 2812.806267] should_fail.cold+0xa/0x15 [ 2812.806288] ? fault_create_debugfs_attr+0x1e0/0x1e0 14:36:45 executing program 3: r0 = syz_open_procfs(0x0, 0x0) sendfile(r0, r0, &(0x7f0000000180)=0x74000000, 0x5) [ 2812.813937] binder: 8326:8327 ioctl c0306201 20000600 returned -22 [ 2812.815496] ? ___might_sleep+0x1e7/0x310 [ 2812.815513] ? arch_local_save_flags+0x50/0x50 [ 2812.815540] __should_failslab+0x121/0x190 [ 2812.835642] should_failslab+0x9/0x14 [ 2812.835656] __kmalloc+0x2dc/0x740 [ 2812.835672] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 2812.843712] ? x25_asy_open_tty+0x470/0x80b [ 2812.857092] x25_asy_open_tty+0x470/0x80b [ 2812.861257] ? x25_asy_close_tty+0x220/0x220 [ 2812.866193] ? up_write+0x7b/0x230 14:36:45 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x2630440, 0x0}) [ 2812.869747] ? down_write_nested+0x130/0x130 [ 2812.874166] ? down_read+0x120/0x120 [ 2812.877890] ? x25_asy_close_tty+0x220/0x220 [ 2812.882320] tty_ldisc_open.isra.0+0x8b/0xe0 [ 2812.886741] tty_set_ldisc+0x2d7/0x690 [ 2812.890644] tty_ioctl+0xffa/0x16c0 [ 2812.894292] ? tty_vhangup+0x30/0x30 [ 2812.898026] ? find_held_lock+0x35/0x120 [ 2812.902099] ? __fget+0x472/0x710 [ 2812.905567] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 2812.911205] ? lock_downgrade+0x910/0x910 [ 2812.915362] ? kasan_check_read+0x11/0x20 14:36:45 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000040)='cgroup\x00') sendfile(0xffffffffffffffff, r0, &(0x7f0000000180)=0x74000000, 0x5) [ 2812.919795] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 2812.924389] binder: 8333:8334 BC_ACQUIRE_DONE u0000000000000000 no match [ 2812.925083] ? rcu_read_unlock_special+0x380/0x380 [ 2812.925108] ? __fget+0x499/0x710 [ 2812.932595] binder: 8333:8334 unknown command 0 [ 2812.936962] ? iterate_fd+0x4b0/0x4b0 [ 2812.936985] ? tty_vhangup+0x30/0x30 [ 2812.936999] do_vfs_ioctl+0x107b/0x17d0 [ 2812.937015] ? wait_for_completion+0x810/0x810 [ 2812.937035] ? ioctl_preallocate+0x2f0/0x2f0 [ 2812.945148] ? __fget_light+0x2db/0x420 [ 2812.952632] ? fget_raw+0x20/0x20 [ 2812.962704] binder: 8333:8334 ioctl c0306201 20000600 returned -22 [ 2812.965557] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 2812.965573] ? fput+0x128/0x1a0 [ 2812.965589] ? do_syscall_64+0x8c/0x800 [ 2812.965607] ? do_syscall_64+0x8c/0x800 [ 2812.992482] binder: 8333:8334 unknown command 0 [ 2812.996052] ? lockdep_hardirqs_on+0x415/0x5d0 [ 2812.996074] ? security_file_ioctl+0x93/0xc0 [ 2812.996093] ksys_ioctl+0xab/0xd0 [ 2812.996111] __x64_sys_ioctl+0x73/0xb0 14:36:45 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000040)='cgroup\x00') sendfile(r0, 0xffffffffffffffff, &(0x7f0000000180)=0x74000000, 0x5) [ 2813.012924] binder: 8333:8334 ioctl c0306201 20000600 returned -22 [ 2813.013183] do_syscall_64+0x1a3/0x800 [ 2813.027252] ? syscall_return_slowpath+0x5f0/0x5f0 [ 2813.032191] ? prepare_exit_to_usermode+0x232/0x3b0 [ 2813.037225] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 2813.042080] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 2813.047284] RIP: 0033:0x457ec9 [ 2813.050490] Code: 6d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 3b b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 14:36:46 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0xd63, 0x0}) [ 2813.069517] RSP: 002b:00007f5b118dec78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2813.077241] RAX: ffffffffffffffda RBX: 00007f5b118dec90 RCX: 0000000000457ec9 [ 2813.084525] RDX: 0000000020000380 RSI: 0000000000005423 RDI: 0000000000000004 [ 2813.091808] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 2813.099088] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f5b118df6d4 [ 2813.106371] R13: 00000000004c207b R14: 00000000004d4450 R15: 0000000000000005 [ 2813.120802] binder: 8341:8342 unknown command 0 [ 2813.175083] binder: 8341:8342 ioctl c0306201 20000600 returned -22 14:36:46 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)) 14:36:46 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x004\x8c\x00'}}}}, 0x68}}, 0x0) 14:36:46 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000040)='cgroup\x00') sendfile(r0, r0, 0x0, 0x5) 14:36:46 executing program 2: clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5425, &(0x7f0000000380)=0x6) 14:36:46 executing program 0 (fault-call:4 fault-nth:1): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) 14:36:46 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0xd63000000000000, 0x0}) 14:36:46 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000040)='cgroup\x00') sendfile(r0, r0, &(0x7f0000000180), 0x5) 14:36:46 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x7f\xff\xff\xff\x00'}}}}, 0x68}}, 0x0) 14:36:46 executing program 2: clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5441, &(0x7f0000000380)=0x6) 14:36:46 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)) [ 2813.552394] binder: 8364:8365 unknown command 0 14:36:46 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000040)='cgroup\x00') sendfile(r0, r0, &(0x7f0000000180)=0x74000000, 0x0) [ 2813.581194] binder: 8364:8365 ioctl c0306201 20000600 returned -22 14:36:46 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\n\x00'}}}}, 0x68}}, 0x0) 14:36:46 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x163404000000000, 0x0}) 14:36:46 executing program 2: clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5428, &(0x7f0000000380)=0x6) 14:36:46 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000040)='cgroup\x00') sendfile(r0, r0, &(0x7f0000000180)=0x74000000, 0x0) [ 2813.786255] binder: 8388:8389 unknown command 0 14:36:46 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0e\x00'}}}}, 0x68}}, 0x0) [ 2813.820992] binder: 8388:8389 ioctl c0306201 20000600 returned -22 14:36:46 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) 14:36:46 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000040)='cgroup\x00') sendfile(r0, r0, &(0x7f0000000180)=0x74000000, 0x0) 14:36:46 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0xe630c4000000000, 0x0}) 14:36:46 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)) 14:36:46 executing program 2: clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5460, &(0x7f0000000380)=0x6) 14:36:46 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00'}}}}, 0x68}}, 0x0) [ 2814.030612] binder: 8413:8417 unknown command 0 14:36:47 executing program 3 (fault-call:1 fault-nth:0): r0 = syz_open_procfs(0x0, &(0x7f0000000040)='cgroup\x00') sendfile(r0, r0, &(0x7f0000000180)=0x74000000, 0x5) [ 2814.091111] binder: 8413:8417 ioctl c0306201 20000600 returned -22 14:36:47 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0xc0045878, &(0x7f0000000380)=0x6) 14:36:47 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x6000, 0x0}) 14:36:47 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\n\x00'}}}}, 0x68}}, 0x0) [ 2814.230386] FAULT_INJECTION: forcing a failure. [ 2814.230386] name failslab, interval 1, probability 0, space 0, times 0 [ 2814.252794] binder: 8437:8438 unknown command 0 [ 2814.268030] binder: 8437:8438 ioctl c0306201 20000600 returned -22 [ 2814.290094] CPU: 0 PID: 8431 Comm: syz-executor3 Not tainted 4.20.0+ #5 [ 2814.296903] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2814.306273] Call Trace: [ 2814.308869] dump_stack+0x1db/0x2d0 [ 2814.312515] ? dump_stack_print_info.cold+0x20/0x20 [ 2814.317564] ? aa_file_perm+0x42e/0x1090 [ 2814.321665] should_fail.cold+0xa/0x15 [ 2814.325606] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 2814.330742] ? ___might_sleep+0x1e7/0x310 [ 2814.335011] ? arch_local_save_flags+0x50/0x50 [ 2814.339609] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 2814.345166] __should_failslab+0x121/0x190 [ 2814.349423] should_failslab+0x9/0x14 [ 2814.353255] kmem_cache_alloc_trace+0x2d1/0x760 [ 2814.358082] alloc_pipe_info+0x152/0x580 [ 2814.362156] ? pipe_read+0x940/0x940 [ 2814.365896] ? aa_path_link+0x5d0/0x5d0 [ 2814.370019] ? debug_lockdep_rcu_enabled+0x71/0xa0 [ 2814.374964] ? common_file_perm+0x231/0x800 [ 2814.379314] splice_direct_to_actor+0x795/0x9d0 [ 2814.383991] ? iterate_fd+0x4b0/0x4b0 [ 2814.387813] ? generic_pipe_buf_nosteal+0x10/0x10 [ 2814.392677] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 2814.398399] ? do_splice_to+0x190/0x190 [ 2814.402394] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 2814.408052] ? rw_verify_area+0x118/0x360 [ 2814.412231] do_splice_direct+0x2c7/0x420 [ 2814.416484] ? splice_direct_to_actor+0x9d0/0x9d0 [ 2814.421351] ? rcu_read_lock_sched_held+0x110/0x130 [ 2814.426380] ? rcu_sync_lockdep_assert+0x73/0xb0 [ 2814.431146] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 2814.436781] ? __sb_start_write+0x1ac/0x360 [ 2814.441129] do_sendfile+0x61a/0xe60 [ 2814.444865] ? do_compat_pwritev64+0x1c0/0x1c0 [ 2814.449464] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 2814.455005] ? _copy_from_user+0xdd/0x150 [ 2814.459172] __x64_sys_sendfile64+0x15a/0x240 [ 2814.463700] ? __ia32_sys_sendfile+0x2a0/0x2a0 [ 2814.468290] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 2814.473066] do_syscall_64+0x1a3/0x800 [ 2814.476974] ? syscall_return_slowpath+0x5f0/0x5f0 [ 2814.481917] ? prepare_exit_to_usermode+0x232/0x3b0 14:36:47 executing program 2: clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5437, &(0x7f0000000380)=0x6) 14:36:47 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x500000000000000, 0x0}) [ 2814.486951] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 2814.491811] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 2814.497013] RIP: 0033:0x457ec9 [ 2814.500232] Code: 6d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 3b b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 2814.519139] RSP: 002b:00007efcba70ec78 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 2814.527040] RAX: ffffffffffffffda RBX: 00007efcba70ec90 RCX: 0000000000457ec9 [ 2814.534319] RDX: 0000000020000180 RSI: 0000000000000003 RDI: 0000000000000003 14:36:47 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x540c, &(0x7f0000000380)=0x6) [ 2814.541617] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 2814.548899] R10: 0000000000000005 R11: 0000000000000246 R12: 00007efcba70f6d4 [ 2814.556190] R13: 00000000004c4b6b R14: 00000000004d8278 R15: 0000000000000004 [ 2814.565781] binder: 8446:8448 unknown command 0 14:36:47 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xff\xff\xff\xf0\x00'}}}}, 0x68}}, 0x0) [ 2814.599603] binder: 8446:8448 ioctl c0306201 20000600 returned -22 14:36:47 executing program 4 (fault-call:4 fault-nth:0): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) 14:36:47 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x300000000000000, 0x0}) 14:36:47 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xf0\x00'}}}}, 0x68}}, 0x0) 14:36:47 executing program 2: clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x541e, &(0x7f0000000380)=0x6) [ 2814.784947] binder: 8468:8470 unknown command 0 [ 2814.789710] binder: 8468:8470 ioctl c0306201 20000600 returned -22 [ 2814.852032] binder: 8468:8470 unknown command 0 [ 2814.868409] binder: 8468:8470 ioctl c0306201 20000600 returned -22 [ 2814.956231] FAULT_INJECTION: forcing a failure. [ 2814.956231] name failslab, interval 1, probability 0, space 0, times 0 [ 2814.968183] CPU: 0 PID: 8478 Comm: syz-executor4 Not tainted 4.20.0+ #5 [ 2814.974977] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2814.984340] Call Trace: [ 2814.987297] dump_stack+0x1db/0x2d0 [ 2814.990949] ? dump_stack_print_info.cold+0x20/0x20 [ 2814.995997] should_fail.cold+0xa/0x15 [ 2814.999905] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 2815.005031] ? ___might_sleep+0x1e7/0x310 [ 2815.009215] ? arch_local_save_flags+0x50/0x50 [ 2815.013828] __should_failslab+0x121/0x190 [ 2815.018081] should_failslab+0x9/0x14 [ 2815.021888] __kmalloc+0x2dc/0x740 [ 2815.025470] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 2815.031020] ? x25_asy_open_tty+0x470/0x80b [ 2815.035367] x25_asy_open_tty+0x470/0x80b [ 2815.039526] ? x25_asy_close_tty+0x220/0x220 [ 2815.044381] ? up_write+0x7b/0x230 [ 2815.047933] ? down_write_nested+0x130/0x130 [ 2815.052347] ? down_read+0x120/0x120 [ 2815.056088] ? x25_asy_close_tty+0x220/0x220 [ 2815.060508] tty_ldisc_open.isra.0+0x8b/0xe0 [ 2815.064933] tty_set_ldisc+0x2d7/0x690 [ 2815.068838] tty_ioctl+0xffa/0x16c0 [ 2815.072483] ? tty_vhangup+0x30/0x30 [ 2815.076213] ? find_held_lock+0x35/0x120 [ 2815.080289] ? __fget+0x472/0x710 [ 2815.083760] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 2815.089337] ? lock_downgrade+0x910/0x910 [ 2815.093496] ? kasan_check_read+0x11/0x20 [ 2815.097659] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 14:36:48 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000040)='cgroup\x00') sendfile(r0, r0, &(0x7f0000000180)=0x74000000, 0x5) 14:36:48 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5416, &(0x7f0000000380)=0x6) 14:36:48 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xea\x00'}}}}, 0x68}}, 0x0) 14:36:48 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x48000000, 0x0}) [ 2815.102972] ? rcu_read_unlock_special+0x380/0x380 [ 2815.107927] ? __fget+0x499/0x710 [ 2815.111403] ? iterate_fd+0x4b0/0x4b0 [ 2815.115221] ? tty_vhangup+0x30/0x30 [ 2815.118939] do_vfs_ioctl+0x107b/0x17d0 [ 2815.122926] ? wait_for_completion+0x810/0x810 [ 2815.127522] ? ioctl_preallocate+0x2f0/0x2f0 [ 2815.131953] ? __fget_light+0x2db/0x420 [ 2815.135939] ? fget_raw+0x20/0x20 [ 2815.139401] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 2815.144964] ? fput+0x128/0x1a0 [ 2815.148260] ? do_syscall_64+0x8c/0x800 [ 2815.152249] ? do_syscall_64+0x8c/0x800 14:36:48 executing program 2: clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x80045440, &(0x7f0000000380)=0x6) [ 2815.156235] ? lockdep_hardirqs_on+0x415/0x5d0 [ 2815.160833] ? security_file_ioctl+0x93/0xc0 [ 2815.165249] ksys_ioctl+0xab/0xd0 [ 2815.165269] __x64_sys_ioctl+0x73/0xb0 [ 2815.165290] do_syscall_64+0x1a3/0x800 [ 2815.165308] ? syscall_return_slowpath+0x5f0/0x5f0 [ 2815.165324] ? prepare_exit_to_usermode+0x232/0x3b0 [ 2815.165347] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 2815.165370] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 2815.165382] RIP: 0033:0x457ec9 [ 2815.165397] Code: 6d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 3b b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 2815.165405] RSP: 002b:00007f24a561fc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2815.165420] RAX: ffffffffffffffda RBX: 00007f24a561fc90 RCX: 0000000000457ec9 [ 2815.165428] RDX: 0000000020000380 RSI: 0000000000005423 RDI: 0000000000000004 [ 2815.165437] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 2815.165446] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f24a56206d4 14:36:48 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0f\x00'}}}}, 0x68}}, 0x0) [ 2815.165456] R13: 00000000004c207b R14: 00000000004d4450 R15: 0000000000000005 [ 2815.187529] binder: 8487:8489 unknown command 0 [ 2815.246617] binder: 8487:8489 ioctl c0306201 20000600 returned -22 14:36:48 executing program 3: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/lblcr_expiration\x00', 0x2, 0x0) ioctl$BLKIOMIN(r0, 0x1278, &(0x7f0000000100)) setsockopt$inet6_tcp_int(r0, 0x6, 0x1b, &(0x7f00000000c0)=0x5, 0x4) r1 = syz_open_procfs(0x0, &(0x7f0000000040)='cgroup\x00') sendfile(r1, r1, &(0x7f0000000180)=0x74000000, 0x5) 14:36:48 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0xc630000, 0x0}) 14:36:48 executing program 4 (fault-call:4 fault-nth:1): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000380)=0x6) 14:36:48 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5428, &(0x7f0000000380)=0x6) 14:36:48 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\n\x00'}}}}, 0x68}}, 0x0) [ 2815.436912] binder: 8507:8508 unknown command 0 [ 2815.441808] binder: 8507:8508 ioctl c0306201 20000600 returned -22 14:36:48 executing program 2: clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5450, &(0x7f0000000380)=0x6) 14:36:48 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x2000000, 0x0}) 14:36:48 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xf0\x00'}}}}, 0x68}}, 0x0) 14:36:48 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000040)='cgroup\x00') sendfile(r0, r0, &(0x7f0000000180)=0x74000000, 0x5) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f00000000c0)={0x0, @remote, @multicast2}, &(0x7f0000000100)=0xc) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000140)={@loopback, r1}, 0x14) sendfile(r0, r0, &(0x7f0000000000), 0x319d) 14:36:48 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5425, &(0x7f0000000380)=0x6) [ 2815.645594] binder: 8524:8532 unknown command 0 [ 2815.650342] binder: 8524:8532 ioctl c0306201 20000600 returned -22 14:36:48 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001480)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000014c0)={0x68, r2, 0x5, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00`\x00'}}}}, 0x68}}, 0x0) 14:36:48 executing program 2: clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5409, &(0x7f0000000380)=0x6) 14:36:48 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x3000000, 0x0}) 14:36:48 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001140)=0xd) ioctl$TIOCSETD(r1, 0x5424, &(0x7f0000000380)=0x6) [ 2815.839243] binder: 8550:8551 unknown command 0 [ 2815.858339] binder: 8550:8551 ioctl c0306201 20000600 returned -22 [ 2815.876607] binder: 8550:8551 unknown command 0 [ 2815.893056] binder: 8550:8551 ioctl c0306201 20000600 returned -22 [ 2815.928503] FAULT_INJECTION: forcing a failure. [ 2815.928503] name failslab, interval 1, probability 0, space 0, times 0 [ 2815.950615] CPU: 0 PID: 8553 Comm: syz-executor4 Not tainted 4.20.0+ #5 [ 2815.957518] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2815.966882] Call Trace: [ 2815.969485] dump_stack+0x1db/0x2d0 [ 2815.973137] ? dump_stack_print_info.cold+0x20/0x20 [ 2815.978172] ? print_usage_bug+0xd0/0xd0 [ 2815.982255] should_fail.cold+0xa/0x15 [ 2815.986170] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 2815.991313] ? ___might_sleep+0x1e7/0x310 [ 2815.995475] ? arch_local_save_flags+0x50/0x50 [ 2816.000103] __should_failslab+0x121/0x190 [ 2816.004353] should_failslab+0x9/0x14 [ 2816.008160] __kmalloc+0x2dc/0x740 [ 2816.011710] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 2816.017262] ? x25_asy_open_tty+0x4b8/0x80b [ 2816.021595] x25_asy_open_tty+0x4b8/0x80b [ 2816.025758] ? x25_asy_close_tty+0x220/0x220 [ 2816.030187] ? up_write+0x7b/0x230 [ 2816.033746] ? down_write_nested+0x130/0x130 [ 2816.038182] ? down_read+0x120/0x120 [ 2816.041909] ? x25_asy_close_tty+0x220/0x220 [ 2816.046329] tty_ldisc_open.isra.0+0x8b/0xe0 [ 2816.050746] tty_set_ldisc+0x2d7/0x690 [ 2816.054652] tty_ioctl+0xffa/0x16c0 [ 2816.058290] ? tty_vhangup+0x30/0x30 [ 2816.062010] ? find_held_lock+0x35/0x120 [ 2816.066087] ? __fget+0x472/0x710 [ 2816.069670] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 2816.075224] ? lock_downgrade+0x910/0x910 [ 2816.079376] ? kasan_check_read+0x11/0x20 [ 2816.083546] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 2816.088832] ? rcu_read_unlock_special+0x380/0x380 [ 2816.093777] ? __fget+0x499/0x710 [ 2816.097350] ? iterate_fd+0x4b0/0x4b0 [ 2816.101164] ? tty_vhangup+0x30/0x30 [ 2816.104888] do_vfs_ioctl+0x107b/0x17d0 [ 2816.108868] ? wait_for_completion+0x810/0x810 [ 2816.113461] ? ioctl_preallocate+0x2f0/0x2f0 [ 2816.117881] ? __fget_light+0x2db/0x420 [ 2816.121867] ? fget_raw+0x20/0x20 [ 2816.125467] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 2816.131017] ? fput+0x128/0x1a0 [ 2816.134421] ? do_syscall_64+0x8c/0x800 [ 2816.138399] ? do_syscall_64+0x8c/0x800 [ 2816.142387] ? lockdep_hardirqs_on+0x415/0x5d0 [ 2816.146983] ? security_file_ioctl+0x93/0xc0 [ 2816.151400] ksys_ioctl+0xab/0xd0 [ 2816.154866] __x64_sys_ioctl+0x73/0xb0 [ 2816.158763] do_syscall_64+0x1a3/0x800 [ 2816.163093] ? syscall_return_slowpath+0x5f0/0x5f0 [ 2816.168170] ? prepare_exit_to_usermode+0x232/0x3b0 [ 2816.173199] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 2816.178072] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 2816.183288] RIP: 0033:0x457ec9 [ 2816.186487] Code: 6d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 3b b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 2816.205409] RSP: 002b:00007f24a561fc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2816.213137] RAX: ffffffffffffffda RBX: 00007f24a561fc90 RCX: 0000000000457ec9 [ 2816.220417] RDX: 0000000020000380 RSI: 0000000000005423 RDI: 0000000000000004 [ 2816.227719] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 2816.234998] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f24a56206d4 [ 2816.242315] R13: 00000000004c207b R14: 00000000004d4450 R15: 0000000000000005 [ 2816.252318] ================================================================== [ 2816.260138] BUG: KASAN: double-free or invalid-free in x25_asy_free+0x37/0x140 [ 2816.267483] [ 2816.269104] CPU: 1 PID: 8553 Comm: syz-executor4 Not tainted 4.20.0+ #5 [ 2816.275838] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2816.285174] Call Trace: [ 2816.287765] dump_stack+0x1db/0x2d0 [ 2816.291428] ? dump_stack_print_info.cold+0x20/0x20 [ 2816.296438] ? debug_check_no_obj_freed+0x2f8/0x588 [ 2816.301447] print_address_description.cold+0x7c/0x20d [ 2816.306729] ? x25_asy_free+0x37/0x140 [ 2816.310614] kasan_report_invalid_free+0x65/0xa0 [ 2816.315356] ? x25_asy_free+0x37/0x140 [ 2816.319299] __kasan_slab_free+0x13a/0x150 [ 2816.323529] ? x25_asy_free+0x37/0x140 [ 2816.327413] kasan_slab_free+0xe/0x10 [ 2816.331199] kfree+0xcf/0x230 [ 2816.334290] x25_asy_free+0x37/0x140 [ 2816.338009] x25_asy_open_tty+0x67b/0x80b [ 2816.342161] ? x25_asy_close_tty+0x220/0x220 [ 2816.346559] ? up_write+0x7b/0x230 [ 2816.350087] ? down_write_nested+0x130/0x130 [ 2816.354480] ? down_read+0x120/0x120 [ 2816.358196] ? x25_asy_close_tty+0x220/0x220 [ 2816.362591] tty_ldisc_open.isra.0+0x8b/0xe0 [ 2816.366988] tty_set_ldisc+0x2d7/0x690 [ 2816.371047] tty_ioctl+0xffa/0x16c0 [ 2816.374680] ? tty_vhangup+0x30/0x30 [ 2816.378379] ? find_held_lock+0x35/0x120 [ 2816.382428] ? __fget+0x472/0x710 [ 2816.385874] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 2816.391406] ? lock_downgrade+0x910/0x910 [ 2816.395560] ? kasan_check_read+0x11/0x20 [ 2816.399703] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 2816.404968] ? rcu_read_unlock_special+0x380/0x380 [ 2816.409890] ? __fget+0x499/0x710 [ 2816.413331] ? iterate_fd+0x4b0/0x4b0 [ 2816.417120] ? tty_vhangup+0x30/0x30 [ 2816.420819] do_vfs_ioctl+0x107b/0x17d0 [ 2816.424789] ? wait_for_completion+0x810/0x810 [ 2816.429381] ? ioctl_preallocate+0x2f0/0x2f0 [ 2816.433798] ? __fget_light+0x2db/0x420 [ 2816.437759] ? fget_raw+0x20/0x20 [ 2816.441220] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 2816.446743] ? fput+0x128/0x1a0 [ 2816.450022] ? do_syscall_64+0x8c/0x800 [ 2816.453994] ? do_syscall_64+0x8c/0x800 [ 2816.457964] ? lockdep_hardirqs_on+0x415/0x5d0 [ 2816.462549] ? security_file_ioctl+0x93/0xc0 [ 2816.466947] ksys_ioctl+0xab/0xd0 [ 2816.470386] __x64_sys_ioctl+0x73/0xb0 [ 2816.474262] do_syscall_64+0x1a3/0x800 [ 2816.478145] ? syscall_return_slowpath+0x5f0/0x5f0 [ 2816.483058] ? prepare_exit_to_usermode+0x232/0x3b0 [ 2816.488061] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 2816.492895] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 2816.498070] RIP: 0033:0x457ec9 [ 2816.501248] Code: 6d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 3b b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 2816.520131] RSP: 002b:00007f24a561fc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2816.527824] RAX: ffffffffffffffda RBX: 00007f24a561fc90 RCX: 0000000000457ec9 [ 2816.535082] RDX: 0000000020000380 RSI: 0000000000005423 RDI: 0000000000000004 [ 2816.542337] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 2816.549606] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f24a56206d4 [ 2816.556859] R13: 00000000004c207b R14: 00000000004d4450 R15: 0000000000000005 [ 2816.564129] [ 2816.565747] Allocated by task 8553: [ 2816.569371] save_stack+0x45/0xd0 [ 2816.572807] kasan_kmalloc+0xcf/0xe0 [ 2816.576632] __kmalloc+0x15c/0x740 [ 2816.580158] x25_asy_open_tty+0x470/0x80b [ 2816.584289] tty_ldisc_open.isra.0+0x8b/0xe0 [ 2816.588681] tty_set_ldisc+0x2d7/0x690 [ 2816.592552] tty_ioctl+0xffa/0x16c0 [ 2816.596162] do_vfs_ioctl+0x107b/0x17d0 [ 2816.600118] ksys_ioctl+0xab/0xd0 [ 2816.603554] __x64_sys_ioctl+0x73/0xb0 [ 2816.607424] do_syscall_64+0x1a3/0x800 [ 2816.611305] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 2816.616487] [ 2816.618132] Freed by task 8553: [ 2816.621405] save_stack+0x45/0xd0 [ 2816.624848] __kasan_slab_free+0x102/0x150 [ 2816.629085] kasan_slab_free+0xe/0x10 [ 2816.632875] kfree+0xcf/0x230 [ 2816.635971] x25_asy_open_tty+0x66e/0x80b [ 2816.640111] tty_ldisc_open.isra.0+0x8b/0xe0 [ 2816.644506] tty_set_ldisc+0x2d7/0x690 [ 2816.648401] tty_ioctl+0xffa/0x16c0 [ 2816.652021] do_vfs_ioctl+0x107b/0x17d0 [ 2816.655983] ksys_ioctl+0xab/0xd0 [ 2816.659431] __x64_sys_ioctl+0x73/0xb0 [ 2816.663308] do_syscall_64+0x1a3/0x800 [ 2816.667204] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 2816.672392] [ 2816.674017] The buggy address belongs to the object at ffff888094db9680 [ 2816.674017] which belongs to the cache kmalloc-1k of size 1024 [ 2816.686667] The buggy address is located 0 bytes inside of [ 2816.686667] 1024-byte region [ffff888094db9680, ffff888094db9a80) [ 2816.698438] The buggy address belongs to the page: [ 2816.703370] page:ffffea0002536e00 count:1 mapcount:0 mapping:ffff88812c3f0ac0 index:0xffff888094db9200 compound_mapcount: 0 [ 2816.715065] flags: 0x1fffc0000010200(slab|head) [ 2816.719727] raw: 01fffc0000010200 ffffea00016cb588 ffffea0002797408 ffff88812c3f0ac0 [ 2816.727599] raw: ffff888094db9200 ffff888094db8000 0000000100000003 0000000000000000 [ 2816.735463] page dumped because: kasan: bad access detected [ 2816.741265] [ 2816.742877] Memory state around the buggy address: [ 2816.747796] ffff888094db9580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 2816.755144] ffff888094db9600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 2816.762492] >ffff888094db9680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 2816.769839] ^ [ 2816.773192] ffff888094db9700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 2816.780539] ffff888094db9780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 2816.787883] ================================================================== [ 2816.795229] Disabling lock debugging due to kernel taint [ 2816.800665] Kernel panic - not syncing: panic_on_warn set ... [ 2816.806541] CPU: 1 PID: 8553 Comm: syz-executor4 Tainted: G B 4.20.0+ #5 [ 2816.814665] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2816.824010] Call Trace: [ 2816.826590] dump_stack+0x1db/0x2d0 [ 2816.830208] ? dump_stack_print_info.cold+0x20/0x20 [ 2816.835222] panic+0x2cb/0x589 [ 2816.838403] ? add_taint.cold+0x16/0x16 [ 2816.842365] ? kasan_check_read+0x11/0x20 [ 2816.846520] ? trace_hardirqs_on_caller+0x310/0x310 [ 2816.851525] ? do_raw_spin_trylock+0x270/0x270 [ 2816.856098] ? add_taint.cold+0x5/0x16 [ 2816.859973] ? trace_hardirqs_off+0xaf/0x310 [ 2816.864919] ? x25_asy_free+0x37/0x140 [ 2816.868797] end_report+0x47/0x4f [ 2816.872241] kasan_report_invalid_free+0x82/0xa0 [ 2816.876987] ? x25_asy_free+0x37/0x140 [ 2816.880873] __kasan_slab_free+0x13a/0x150 [ 2816.885095] ? x25_asy_free+0x37/0x140 [ 2816.888977] kasan_slab_free+0xe/0x10 [ 2816.892770] kfree+0xcf/0x230 [ 2816.895865] x25_asy_free+0x37/0x140 [ 2816.899571] x25_asy_open_tty+0x67b/0x80b [ 2816.903706] ? x25_asy_close_tty+0x220/0x220 [ 2816.908107] ? up_write+0x7b/0x230 [ 2816.911650] ? down_write_nested+0x130/0x130 [ 2816.916048] ? down_read+0x120/0x120 [ 2816.919750] ? x25_asy_close_tty+0x220/0x220 [ 2816.924150] tty_ldisc_open.isra.0+0x8b/0xe0 [ 2816.928547] tty_set_ldisc+0x2d7/0x690 [ 2816.932428] tty_ioctl+0xffa/0x16c0 [ 2816.936046] ? tty_vhangup+0x30/0x30 [ 2816.939750] ? find_held_lock+0x35/0x120 [ 2816.943812] ? __fget+0x472/0x710 [ 2816.947254] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 2816.952779] ? lock_downgrade+0x910/0x910 [ 2816.956919] ? kasan_check_read+0x11/0x20 [ 2816.961061] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 2816.966330] ? rcu_read_unlock_special+0x380/0x380 [ 2816.971252] ? __fget+0x499/0x710 [ 2816.974711] ? iterate_fd+0x4b0/0x4b0 [ 2816.978514] ? tty_vhangup+0x30/0x30 [ 2816.982216] do_vfs_ioctl+0x107b/0x17d0 [ 2816.986179] ? wait_for_completion+0x810/0x810 [ 2816.990766] ? ioctl_preallocate+0x2f0/0x2f0 [ 2816.995165] ? __fget_light+0x2db/0x420 [ 2816.999127] ? fget_raw+0x20/0x20 [ 2817.002576] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 2817.008101] ? fput+0x128/0x1a0 [ 2817.011370] ? do_syscall_64+0x8c/0x800 [ 2817.015333] ? do_syscall_64+0x8c/0x800 [ 2817.019309] ? lockdep_hardirqs_on+0x415/0x5d0 [ 2817.023884] ? security_file_ioctl+0x93/0xc0 [ 2817.028287] ksys_ioctl+0xab/0xd0 [ 2817.031752] __x64_sys_ioctl+0x73/0xb0 [ 2817.035632] do_syscall_64+0x1a3/0x800 [ 2817.039512] ? syscall_return_slowpath+0x5f0/0x5f0 [ 2817.044431] ? prepare_exit_to_usermode+0x232/0x3b0 [ 2817.049446] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 2817.054382] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 2817.059566] RIP: 0033:0x457ec9 [ 2817.062762] Code: 6d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 3b b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 2817.081649] RSP: 002b:00007f24a561fc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2817.089361] RAX: ffffffffffffffda RBX: 00007f24a561fc90 RCX: 0000000000457ec9 [ 2817.096620] RDX: 0000000020000380 RSI: 0000000000005423 RDI: 0000000000000004 [ 2817.103881] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 2817.111152] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f24a56206d4 [ 2817.118526] R13: 00000000004c207b R14: 00000000004d4450 R15: 0000000000000005 [ 2817.127193] Kernel Offset: disabled [ 2817.130846] Rebooting in 86400 seconds..