000100)='./file1\x00') [ 2428.568417] binder: undelivered TRANSACTION_ERROR: 29201 [ 2428.589206] binder: send failed reply for transaction 3218, target dead [ 2428.650444] binder: 24785:24787 got reply transaction with no transaction stack [ 2428.668988] binder: 24785:24787 transaction failed 29201/-71, size 0-0 line 2801 [ 2428.688045] binder: 24785:24787 ioctl c0306201 20000600 returned -14 13:47:06 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) acct(0x0) [ 2428.710981] binder: release 24785:24787 transaction 3221 out, still active [ 2428.744953] binder: undelivered TRANSACTION_COMPLETE [ 2428.812339] binder: undelivered TRANSACTION_ERROR: 29201 [ 2428.818507] binder: send failed reply for transaction 3221, target dead 13:47:07 executing program 4: signalfd4(0xffffffffffffffff, &(0x7f0000000ff8), 0x8, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000340), 0x10000014c) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x5000000}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 13:47:07 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x24, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad77"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:47:07 executing program 3: syz_read_part_table(0x5ffe, 0x1, &(0x7f00000017c0)=[{&(0x7f00000001c0)='ER%', 0x3}]) [ 2429.136543] binder: 24797:24800 got reply transaction with no transaction stack [ 2429.148328] binder: 24797:24800 transaction failed 29201/-71, size 0-0 line 2801 [ 2429.164298] binder: 24797:24800 ioctl c0306201 20000600 returned -14 [ 2429.175581] binder: release 24797:24800 transaction 3224 out, still active [ 2429.193004] binder: undelivered TRANSACTION_COMPLETE [ 2429.210750] __loop_clr_fd: partition scan of loop3 failed (rc=-22) 13:47:07 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) pread64(r1, 0x0, 0x0, 0x0) gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000001100)={0x0}) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r2}}, 0x0) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) dup2(r3, r1) tkill(0x0, 0x15) 13:47:07 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x24, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad77"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) [ 2429.276665] binder: undelivered TRANSACTION_ERROR: 29201 [ 2429.283023] binder: send failed reply for transaction 3224, target dead 13:47:07 executing program 3: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setownex(0xffffffffffffffff, 0xf, 0x0) r2 = dup3(r0, r1, 0x0) pipe2$9p(0x0, 0x0) rmdir(0x0) ioctl$FS_IOC_GETFSMAP(0xffffffffffffffff, 0xc0c0583b, 0x0) ioctl$void(r2, 0x5450) [ 2429.372141] binder: 24807:24809 got reply transaction with no transaction stack [ 2429.380130] binder: 24807:24809 transaction failed 29201/-71, size 0-0 line 2801 [ 2429.409758] binder: 24807:24809 ioctl c0306201 20000600 returned -14 13:47:07 executing program 2: socket$netlink(0x10, 0x3, 0x0) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='fdinfo/3\x00') exit(0x0) pread64(r0, 0x0, 0x0, 0x3) 13:47:07 executing program 5: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-vsock\x00', 0x2, 0x0) clone(0x100002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) dup2(r2, r0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1e2ba62e) recvfrom(r1, 0x0, 0x0, 0x0, 0x0, 0x0) recvfrom(0xffffffffffffffff, &(0x7f0000000180)=""/184, 0xfffffffffffffd84, 0x10100, 0x0, 0xfffffffffffffd51) [ 2429.419788] __loop_clr_fd: partition scan of loop3 failed (rc=-22) [ 2429.435060] binder: release 24807:24809 transaction 3227 out, still active [ 2429.447438] binder: undelivered TRANSACTION_COMPLETE 13:47:07 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x36, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab767615"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) [ 2429.501025] binder: undelivered TRANSACTION_ERROR: 29201 [ 2429.507341] binder: send failed reply for transaction 3227, target dead 13:47:07 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) exit(0x0) dup2(r0, r1) [ 2429.572792] binder: 24819:24820 got reply transaction with no transaction stack [ 2429.598808] binder: 24819:24820 transaction failed 29201/-71, size 0-0 line 2801 13:47:07 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x36, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab767615"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) [ 2429.623217] binder: 24819:24820 ioctl c0306201 20000600 returned -14 13:47:07 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x36, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab767615"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) [ 2429.722478] binder: 24826:24827 ioctl c0306201 20000600 returned -14 [ 2429.823421] binder: 24828:24829 ioctl c0306201 20000600 returned -14 13:47:08 executing program 4: signalfd4(0xffffffffffffffff, &(0x7f0000000ff8), 0x8, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000340), 0x10000014c) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x6000000}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 13:47:08 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x3f, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:47:08 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) pread64(r1, 0x0, 0x0, 0x0) gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000001100)={0x0}) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r2}}, 0x0) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) dup2(r3, r1) tkill(0x0, 0x15) [ 2430.244261] binder: 24831:24834 ioctl c0306201 20000600 returned -14 13:47:08 executing program 5: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-vsock\x00', 0x2, 0x0) clone(0x100002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) dup2(r2, r0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1e2ba62e) recvfrom(r1, 0x0, 0x0, 0x0, 0x0, 0x0) recvfrom(r2, 0x0, 0x0, 0x10100, 0x0, 0x0) 13:47:08 executing program 2: socket$netlink(0x10, 0x3, 0x0) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='fdinfo/3\x00') exit(0x0) pread64(r0, 0x0, 0x0, 0x3) 13:47:08 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x3f, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) [ 2430.455024] binder: 24846:24847 ioctl c0306201 20000600 returned -14 13:47:08 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x3f, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:47:08 executing program 3: syz_emit_ethernet(0x36, &(0x7f0000000080)={@local, @local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x0, 0x0, @dev, @remote={0xac, 0x14, 0x223}}, @icmp=@timestamp_reply={0xffffff83, 0xa}}}}}, 0x0) 13:47:08 executing program 3: r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000100)='/dev/autofs\x00', 0x0, 0x0) syz_execute_func(&(0x7f00000004c0)="3666440f50f564ff09c3e2c9975842f0815d7d0000000056b80f4c938a00fd00420fe2e3e2e31110c442019dccd3196f") clone(0x3102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket$inet6(0xa, 0x0, 0x0) clone(0x3102001ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f0000000280)=0x100000001, 0x4) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x3f, 0x0, 0x0) clone(0x1fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) connect$inet6(r1, &(0x7f00000000c0), 0x1c) r2 = dup2(r1, r0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000180), 0xfe0c) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, 0x0, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r1, 0x29, 0x2a, 0x0, 0x0) [ 2430.592857] binder: 24852:24853 ioctl c0306201 20000600 returned -14 13:47:08 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x44, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:47:08 executing program 3: r0 = gettid() r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup\x00', 0x200002, 0x0) fchdir(r1) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r2, 0x4, 0x6100) r3 = creat(&(0x7f0000000600)='./bus\x00', 0x0) ftruncate(r3, 0x8200) r4 = open(&(0x7f00000000c0)='./bus\x00', 0x101002, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r4, 0x0) r5 = open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) sendfile(r2, r5, 0x0, 0x8000fffffffe) process_vm_writev(r0, &(0x7f0000000580)=[{&(0x7f0000000500)=""/127, 0x7f}], 0x1, &(0x7f0000000d40)=[{&(0x7f0000001880)=""/4096, 0x1000}], 0x1, 0x0) [ 2430.734249] binder: 24867:24868 ioctl c0306201 20000600 returned -14 13:47:08 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x44, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) [ 2430.820989] binder: 24873:24874 ioctl c0306201 20000600 returned -14 13:47:09 executing program 4: signalfd4(0xffffffffffffffff, &(0x7f0000000ff8), 0x8, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000340), 0x10000014c) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x7000000}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 13:47:09 executing program 3: r0 = gettid() r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup\x00', 0x200002, 0x0) fchdir(r1) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r2, 0x4, 0x6100) r3 = creat(&(0x7f0000000600)='./bus\x00', 0x0) ftruncate(r3, 0x8200) r4 = open(&(0x7f00000000c0)='./bus\x00', 0x101002, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r4, 0x0) r5 = open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) sendfile(r2, r5, 0x0, 0x8000fffffffe) process_vm_writev(r0, &(0x7f0000000580)=[{&(0x7f0000000500)=""/127, 0x7f}], 0x1, &(0x7f0000000d40)=[{&(0x7f0000001880)=""/4096, 0x1000}], 0x1, 0x0) 13:47:09 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x44, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:47:09 executing program 5: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-vsock\x00', 0x2, 0x0) clone(0x100002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) dup2(r2, r0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1e2ba62e) recvfrom(r1, 0x0, 0x0, 0x0, 0x0, 0x0) recvfrom(r2, 0x0, 0x0, 0x10100, 0x0, 0x0) 13:47:09 executing program 2: socket$netlink(0x10, 0x3, 0x0) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='fdinfo/3\x00') pread64(r0, 0x0, 0x0, 0x3) 13:47:09 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) pread64(r1, 0x0, 0x0, 0x0) gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000001100)={0x0}) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r2}}, 0x0) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) dup2(r3, r1) tkill(0x0, 0x15) [ 2431.201482] binder: 24878:24879 ioctl c0306201 20000600 returned -14 13:47:09 executing program 3: syz_emit_ethernet(0x140, &(0x7f0000000080)={@local, @empty=[0x7, 0x4], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x21, 0x0, @remote, @local}, @dccp={{0x0, 0x0, 0x4, 0x60, 0x0, 0x0, 0x3, 0x2, 0x0, "e57044", 0x0, "cd98e8"}}}}}}, 0x0) 13:47:09 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x46, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b26"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:47:09 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$KDGKBTYPE(0xffffffffffffffff, 0x4b33, 0x0) ioctl$TIOCGSOFTCAR(0xffffffffffffffff, 0x5419, 0x0) ioctl$TIOCGPTPEER(0xffffffffffffffff, 0x5441, 0x0) r1 = syz_open_pts(r0, 0x24042) ioctl$TCGETS(0xffffffffffffffff, 0x5401, 0x0) write$P9_RLOCK(r1, &(0x7f0000000040)={0x8}, 0x8) 13:47:09 executing program 2: socket$netlink(0x10, 0x3, 0x0) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='fdinfo/3\x00') pread64(r0, 0x0, 0x0, 0x3) [ 2431.349469] binder: 24890:24892 ioctl c0306201 20000600 returned -14 13:47:09 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x46, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b26"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:47:09 executing program 3: [ 2431.499251] binder: 24901:24904 ioctl c0306201 20000600 returned -14 13:47:10 executing program 4: signalfd4(0xffffffffffffffff, &(0x7f0000000ff8), 0x8, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000340), 0x10000014c) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x8000000}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 13:47:10 executing program 2: socket$netlink(0x10, 0x3, 0x0) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='fdinfo/3\x00') pread64(r0, 0x0, 0x0, 0x3) 13:47:10 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x46, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b26"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:47:10 executing program 5: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-vsock\x00', 0x2, 0x0) clone(0x100002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) dup2(r2, r0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1e2ba62e) recvfrom(r1, 0x0, 0x0, 0x0, 0x0, 0x0) recvfrom(r2, 0x0, 0x0, 0x10100, 0x0, 0x0) 13:47:10 executing program 3: 13:47:10 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) pread64(r1, 0x0, 0x0, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000001100)={0x0}) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r3}}, 0x0) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) dup2(r4, r1) tkill(r2, 0x0) 13:47:10 executing program 3: 13:47:10 executing program 2: socket$netlink(0x10, 0x3, 0x0) exit(0x0) pread64(0xffffffffffffffff, 0x0, 0x0, 0x3) [ 2432.208722] binder_transaction: 10 callbacks suppressed [ 2432.208732] binder: 24907:24909 got reply transaction with no transaction stack [ 2432.228132] binder_transaction: 10 callbacks suppressed [ 2432.228153] binder: 24907:24909 transaction failed 29201/-71, size 0-0 line 2801 [ 2432.283226] binder: 24907:24909 ioctl c0306201 20000600 returned -14 [ 2432.306372] binder_thread_release: 11 callbacks suppressed [ 2432.306385] binder: release 24907:24909 transaction 3263 out, still active 13:47:10 executing program 3: [ 2432.354041] binder_release_work: 11 callbacks suppressed [ 2432.354049] binder: undelivered TRANSACTION_COMPLETE 13:47:10 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x47, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:47:10 executing program 3: [ 2432.411885] binder_release_work: 11 callbacks suppressed [ 2432.411894] binder: undelivered TRANSACTION_ERROR: 29201 [ 2432.436630] binder_send_failed_reply: 11 callbacks suppressed [ 2432.436638] binder: send failed reply for transaction 3263, target dead [ 2432.495920] binder: 24928:24929 got reply transaction with no transaction stack [ 2432.534440] binder: 24928:24929 transaction failed 29201/-71, size 0-0 line 2801 13:47:10 executing program 3: [ 2432.545949] binder: 24928:24929 ioctl c0306201 20000600 returned -14 [ 2432.571979] binder: release 24928:24929 transaction 3266 out, still active [ 2432.586538] binder: undelivered TRANSACTION_COMPLETE [ 2432.638386] binder: undelivered TRANSACTION_ERROR: 29201 [ 2432.644634] binder: send failed reply for transaction 3266, target dead 13:47:11 executing program 3: 13:47:11 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x47, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:47:11 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) pread64(r1, 0x0, 0x0, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000001100)={0x0}) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r3}}, 0x0) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) dup2(r4, r1) tkill(r2, 0x0) 13:47:11 executing program 5: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-vsock\x00', 0x2, 0x0) clone(0x100002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) dup2(r2, r0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1e2ba62e) recvfrom(r1, 0x0, 0x0, 0x0, 0x0, 0x0) recvfrom(r2, &(0x7f0000000180)=""/184, 0xfffffffffffffd84, 0x0, 0x0, 0xfffffffffffffd51) 13:47:11 executing program 4: signalfd4(0xffffffffffffffff, &(0x7f0000000ff8), 0x8, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000340), 0x10000014c) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x9000000}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 13:47:11 executing program 2: socket$netlink(0x10, 0x3, 0x0) exit(0x0) pread64(0xffffffffffffffff, 0x0, 0x0, 0x3) 13:47:11 executing program 3: [ 2433.229915] binder: 24933:24938 got reply transaction with no transaction stack [ 2433.258041] binder: 24933:24938 transaction failed 29201/-71, size 0-0 line 2801 [ 2433.266432] binder: 24933:24938 ioctl c0306201 20000600 returned -14 [ 2433.283754] binder: release 24933:24938 transaction 3269 out, still active [ 2433.301746] binder: undelivered TRANSACTION_COMPLETE 13:47:11 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x47, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:47:11 executing program 3: [ 2433.324438] binder: undelivered TRANSACTION_ERROR: 29201 [ 2433.332182] binder: send failed reply for transaction 3269, target dead [ 2433.363643] binder: 24950:24951 got reply transaction with no transaction stack [ 2433.414480] binder: 24950:24951 transaction failed 29201/-71, size 0-0 line 2801 [ 2433.428150] binder: 24950:24951 ioctl c0306201 20000600 returned -14 13:47:11 executing program 3: [ 2433.455857] binder: release 24950:24951 transaction 3272 out, still active [ 2433.469548] binder: undelivered TRANSACTION_COMPLETE 13:47:11 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:47:11 executing program 3: [ 2433.526232] binder: undelivered TRANSACTION_ERROR: 29201 [ 2433.532092] binder: send failed reply for transaction 3272, target dead 13:47:11 executing program 3: [ 2433.614943] binder_alloc: 24957: binder_alloc_buf, no vma [ 2433.630945] binder: 24957:24958 transaction failed 29189/-3, size 0-0 line 3035 [ 2433.654902] binder: send failed reply for transaction 3275 to 24957:24958 13:47:11 executing program 3: [ 2433.676340] binder: 24957:24958 ioctl c0306201 20000600 returned -14 [ 2433.698096] binder: undelivered TRANSACTION_COMPLETE [ 2433.704708] binder: undelivered TRANSACTION_ERROR: 29189 [ 2433.746444] binder: undelivered TRANSACTION_ERROR: 29190 13:47:12 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) pread64(r1, 0x0, 0x0, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000001100)={0x0}) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r3}}, 0x0) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) dup2(r4, r1) tkill(r2, 0x0) 13:47:12 executing program 5: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-vsock\x00', 0x2, 0x0) clone(0x100002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) dup2(r2, r0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1e2ba62e) recvfrom(r1, 0x0, 0x0, 0x0, 0x0, 0x0) recvfrom(r2, &(0x7f0000000180)=""/184, 0xfffffffffffffd84, 0x0, 0x0, 0xfffffffffffffd51) 13:47:12 executing program 4: signalfd4(0xffffffffffffffff, &(0x7f0000000ff8), 0x8, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000340), 0x10000014c) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0xa000000}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 13:47:12 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:47:12 executing program 3: 13:47:12 executing program 2: socket$netlink(0x10, 0x3, 0x0) exit(0x0) pread64(0xffffffffffffffff, 0x0, 0x0, 0x3) 13:47:12 executing program 3: [ 2434.246420] binder_alloc: 24969: binder_alloc_buf, no vma [ 2434.258474] binder: 24969:24973 transaction failed 29189/-3, size 0-0 line 3035 [ 2434.275162] binder: send failed reply for transaction 3278 to 24969:24973 13:47:12 executing program 3: [ 2434.296429] binder: 24969:24973 ioctl c0306201 20000600 returned -14 [ 2434.311555] binder: undelivered TRANSACTION_COMPLETE [ 2434.316957] binder: undelivered TRANSACTION_ERROR: 29189 13:47:12 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) [ 2434.362963] binder: undelivered TRANSACTION_ERROR: 29190 13:47:12 executing program 3: [ 2434.430493] binder_alloc: 24982: binder_alloc_buf, no vma [ 2434.437486] binder: 24982:24983 transaction failed 29189/-3, size 0-0 line 3035 [ 2434.451890] binder: send failed reply for transaction 3281 to 24982:24983 [ 2434.461517] binder: 24982:24983 ioctl c0306201 20000600 returned -14 13:47:12 executing program 3: [ 2434.490606] binder: undelivered TRANSACTION_COMPLETE [ 2434.506669] binder: undelivered TRANSACTION_ERROR: 29189 13:47:12 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) [ 2434.560139] binder: undelivered TRANSACTION_ERROR: 29190 [ 2434.619703] binder_alloc: 24986: binder_alloc_buf, no vma [ 2434.648350] binder: 24986:24987 transaction failed 29189/-3, size 0-0 line 3035 [ 2434.663953] binder: send failed reply for transaction 3284 to 24986:24987 [ 2434.672756] binder: 24986:24987 ioctl c0306201 20000600 returned -14 [ 2434.687518] binder: undelivered TRANSACTION_COMPLETE 13:47:12 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:47:12 executing program 5: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-vsock\x00', 0x2, 0x0) clone(0x100002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) dup2(r2, r0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1e2ba62e) recvfrom(r1, 0x0, 0x0, 0x0, 0x0, 0x0) recvfrom(r2, &(0x7f0000000180)=""/184, 0xfffffffffffffd84, 0x0, 0x0, 0xfffffffffffffd51) [ 2434.991159] binder_alloc: 24988: binder_alloc_buf, no vma [ 2435.002760] binder: 24988:24989 transaction failed 29189/-3, size 0-0 line 3035 [ 2435.011111] binder: send failed reply for transaction 3287 to 24988:24989 [ 2435.019086] binder: 24988:24989 ioctl c0306201 20000600 returned -14 [ 2435.027358] binder: undelivered TRANSACTION_COMPLETE 13:47:13 executing program 4: signalfd4(0xffffffffffffffff, &(0x7f0000000ff8), 0x8, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000340), 0x10000014c) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0xb000000}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 13:47:13 executing program 1: 13:47:13 executing program 3: 13:47:13 executing program 2: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='fdinfo/3\x00') exit(0x0) pread64(r0, 0x0, 0x0, 0x3) 13:47:13 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:47:13 executing program 3: 13:47:13 executing program 1: [ 2435.265322] binder_alloc: 25000: binder_alloc_buf, no vma [ 2435.272985] binder: 25000:25001 transaction failed 29189/-3, size 0-0 line 3035 [ 2435.297988] binder: send failed reply for transaction 3290 to 25000:25001 13:47:13 executing program 3: [ 2435.317530] binder: 25000:25001 ioctl c0306201 20000600 returned -14 [ 2435.345745] binder: undelivered TRANSACTION_COMPLETE 13:47:13 executing program 1: 13:47:13 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:47:13 executing program 3: getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000080)={{{@in6, @in6=@mcast2}}, {{@in6=@remote}, 0x0, @in6}}, &(0x7f0000000180)=0xe8) setuid(0x0) socketpair(0x0, 0x5, 0x200, 0x0) r0 = fcntl$dupfd(0xffffffffffffff9c, 0x0, 0xffffffffffffff9c) sendfile(r0, 0xffffffffffffffff, &(0x7f00000000c0), 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r1) sendmsg$TIPC_NL_NODE_GET(0xffffffffffffffff, 0x0, 0x0) r2 = open(&(0x7f0000000040)='./bus\x00', 0x1fe, 0x0) write$binfmt_aout(r2, &(0x7f00000001c0)=ANY=[@ANYBLOB="158add"], 0x3) ioctl$KVM_ARM_SET_DEVICE_ADDR(0xffffffffffffffff, 0x4010aeab, 0x0) perf_event_open(&(0x7f0000000800)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) unlink(&(0x7f0000001e00)='./bus\x00') sendfile(r2, r2, &(0x7f0000000000), 0x8080fffffffe) execveat(r2, 0x0, 0x0, &(0x7f0000000a00)=[0x0, &(0x7f00000008c0)='vfat\x00', &(0x7f0000000900)='user\x8e)\x00', 0x0, &(0x7f0000000980)='/dev/ppp\x00'], 0x1500) r3 = getpid() sched_setattr(r3, &(0x7f00000002c0)={0x0, 0x2, 0x0, 0x0, 0x3}, 0x0) socket$inet6(0xa, 0x1000000000002, 0x0) ioctl$FS_IOC_FSSETXATTR(0xffffffffffffffff, 0x401c5820, 0x0) clock_getres(0x4, 0x0) creat(&(0x7f0000000100)='./file1\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) msgsnd(0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="020000008e070100b589bdee5b7f82e9e279"], 0x1, 0x0) [ 2435.476895] binder_alloc: 25011: binder_alloc_buf, no vma [ 2435.508030] binder: send failed reply for transaction 3293 to 25011:25012 [ 2435.532196] binder: 25011:25012 ioctl c0306201 20000600 returned -14 13:47:13 executing program 1: r0 = open(&(0x7f0000000000)='.\x00', 0x0, 0x0) r1 = openat(r0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r1, &(0x7f0000000080)={0x2000}) preadv(r0, 0x0, 0x0, 0x0) [ 2436.103483] FAT-fs (loop3): error, invalid access to FAT (entry 0x00006500) [ 2436.111088] FAT-fs (loop3): Filesystem has been set read-only [ 2436.119318] FAT-fs (loop3): error, invalid access to FAT (entry 0x00006500) 13:47:14 executing program 4: signalfd4(0xffffffffffffffff, &(0x7f0000000ff8), 0x8, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000340), 0x10000014c) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0xb000200}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 13:47:14 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:47:14 executing program 5: syz_open_procfs(0x0, &(0x7f0000000100)='cmdline\x00') pread64(0xffffffffffffffff, 0x0, 0x2b6041cb, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000240)={0x9}, 0x0, 0x0) 13:47:14 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000b40)={0x26, 'aead\x00', 0x0, 0x0, 'morus1280-generic\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10) r1 = accept$alg(r0, 0x0, 0x0) write$binfmt_script(r1, &(0x7f0000000600)=ANY=[], 0xfec8) recvmmsg(r1, &(0x7f0000007e00)=[{{0x0, 0x0, &(0x7f0000004700)=[{&(0x7f0000003580)=""/4096, 0xfed8}], 0x1, 0x0, 0x0, 0x10000000}}], 0x1, 0x0, 0x0) 13:47:14 executing program 2: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='fdinfo/3\x00') exit(0x0) pread64(r0, 0x0, 0x0, 0x3) 13:47:14 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$IP_VS_SO_GET_VERSION(0xffffffffffffffff, 0x0, 0x480, 0x0, 0x0) r2 = fcntl$dupfd(r0, 0x0, r1) getsockopt$IPT_SO_GET_INFO(0xffffffffffffffff, 0x0, 0x40, 0x0, 0x0) setsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, 0x0, 0x0) setsockopt$inet6_MCAST_LEAVE_GROUP(0xffffffffffffffff, 0x29, 0x2d, 0x0, 0x0) setsockopt$inet_tcp_buf(r2, 0x6, 0x21, &(0x7f00000002c0)='9', 0x1) 13:47:14 executing program 1: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-vsock\x00', 0x2, 0x0) clone(0x100002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) dup2(r2, r0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1e2ba62e) recvfrom(r1, 0x0, 0x0, 0x0, 0x0, 0x0) recvfrom(r2, &(0x7f0000000180)=""/184, 0xfffffffffffffd84, 0x0, 0x0, 0xfffffffffffffd51) [ 2436.455386] binder_alloc: 25030: binder_alloc_buf, no vma [ 2436.490051] binder: send failed reply for transaction 3296 to 25030:25036 13:47:14 executing program 3: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-vsock\x00', 0x2, 0x0) clone(0x100002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) dup2(r2, r0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1e2ba62e) recvfrom(r1, 0x0, 0x0, 0x0, 0x0, 0x0) recvfrom(r2, 0x0, 0x0, 0x10100, 0x0, 0x0) [ 2436.516515] binder: 25030:25036 ioctl c0306201 20000600 returned -14 13:47:14 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:47:14 executing program 3: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-vsock\x00', 0x2, 0x0) clone(0x100002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) dup2(r2, r0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1e2ba62e) recvfrom(r1, 0x0, 0x0, 0x0, 0x0, 0x0) recvfrom(r2, 0x0, 0x0, 0x10100, 0x0, 0x0) [ 2436.676492] binder_alloc: 25048: binder_alloc_buf, no vma [ 2436.701342] binder: send failed reply for transaction 3299 to 25048:25050 [ 2436.734380] binder: 25048:25050 ioctl c0306201 20000600 returned -14 13:47:14 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:47:14 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) [ 2436.853107] binder_alloc: 25056: binder_alloc_buf, no vma [ 2436.859547] binder: send failed reply for transaction 3302 to 25056:25057 [ 2436.866923] binder: 25056:25057 ioctl c0306201 20000600 returned -14 [ 2436.928907] binder: 25058:25059 ioctl c0306201 20000600 returned -14 13:47:15 executing program 4: signalfd4(0xffffffffffffffff, &(0x7f0000000ff8), 0x8, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000340), 0x10000014c) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0xd000000}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 13:47:15 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:47:15 executing program 5: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c12") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)) 13:47:15 executing program 2: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='fdinfo/3\x00') exit(0x0) pread64(r0, 0x0, 0x0, 0x3) [ 2437.320057] binder_transaction: 5 callbacks suppressed [ 2437.320073] binder: 25063:25064 transaction failed 29189/-3, size 0-0 line 3035 [ 2437.341784] binder: 25063:25064 ioctl c0306201 20000600 returned -14 13:47:15 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:47:15 executing program 1: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-vsock\x00', 0x2, 0x0) clone(0x100002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) dup2(r2, r0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1e2ba62e) recvfrom(r1, 0x0, 0x0, 0x0, 0x0, 0x0) recvfrom(r2, &(0x7f0000000180)=""/184, 0xfffffffffffffd84, 0x0, 0x0, 0xfffffffffffffd51) [ 2437.369257] usb usb9: usbfs: process 25070 (syz-executor.5) did not claim interface 0 before use [ 2437.404572] vhci_hcd: default hub control req: 010b v0000 i0000 l0 [ 2437.435218] binder: release 25072:25073 transaction 3311 out, still active [ 2437.452020] binder_release_work: 6 callbacks suppressed [ 2437.452027] binder: undelivered TRANSACTION_COMPLETE 13:47:15 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:47:15 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:47:15 executing program 3: openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-vsock\x00', 0x2, 0x0) clone(0x100002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) dup2(r1, 0xffffffffffffffff) write$binfmt_misc(r0, &(0x7f0000000140)=ANY=[], 0x1e2ba62e) recvfrom(r0, 0x0, 0x0, 0x0, 0x0, 0x0) recvfrom(r1, &(0x7f0000000180)=""/184, 0xfffffffffffffd84, 0x10100, 0x0, 0xfffffffffffffd51) [ 2437.508527] binder: release 25072:25073 transaction 3311 in, still active [ 2437.528778] binder: send failed reply for transaction 3311, target dead [ 2437.591582] binder: BINDER_SET_CONTEXT_MGR already set [ 2437.593218] binder: 25080:25081 transaction failed 29189/-3, size 0-0 line 3035 [ 2437.609563] binder: 25079:25082 ioctl 40046207 0 returned -16 [ 2437.636142] binder: 25080:25081 ioctl c0306201 20000600 returned -14 [ 2437.685528] binder: undelivered TRANSACTION_COMPLETE [ 2437.695449] binder_release_work: 18 callbacks suppressed [ 2437.695456] binder: undelivered TRANSACTION_ERROR: 29189 13:47:15 executing program 5: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-vsock\x00', 0x2, 0x0) clone(0x100002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) dup2(r2, r0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1e2ba62e) recvfrom(r1, 0x0, 0x0, 0x0, 0x0, 0x0) recvfrom(r2, &(0x7f0000000180)=""/184, 0xfffffffffffffd84, 0x10100, 0x0, 0xfffffffffffffd51) [ 2437.766840] binder: undelivered TRANSACTION_ERROR: 29190 13:47:16 executing program 2: socket$netlink(0x10, 0x3, 0x0) r0 = syz_open_procfs(0xffffffffffffffff, 0x0) exit(0x0) pread64(r0, 0x0, 0x0, 0x3) 13:47:16 executing program 1: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-vsock\x00', 0x2, 0x0) clone(0x100002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) dup2(r2, r0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1e2ba62e) recvfrom(r1, 0x0, 0x0, 0x0, 0x0, 0x0) recvfrom(r2, &(0x7f0000000180)=""/184, 0xfffffffffffffd84, 0x10100, 0x0, 0xfffffffffffffd51) 13:47:16 executing program 4: signalfd4(0xffffffffffffffff, &(0x7f0000000ff8), 0x8, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000340), 0x10000014c) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0xe000000}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 13:47:16 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) [ 2438.379764] binder: undelivered TRANSACTION_COMPLETE [ 2438.385263] binder: undelivered TRANSACTION_ERROR: 29189 [ 2438.486190] binder: release 25106:25107 transaction 3317 out, still active [ 2438.504454] binder: undelivered TRANSACTION_COMPLETE 13:47:16 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) [ 2438.575308] binder: release 25106:25107 transaction 3317 in, still active [ 2438.586984] binder: send failed reply for transaction 3317, target dead 13:47:16 executing program 3: openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-vsock\x00', 0x2, 0x0) clone(0x100002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) dup2(r1, 0xffffffffffffffff) write$binfmt_misc(r0, &(0x7f0000000140)=ANY=[], 0x1e2ba62e) recvfrom(r0, 0x0, 0x0, 0x0, 0x0, 0x0) recvfrom(r1, &(0x7f0000000180)=""/184, 0xfffffffffffffd84, 0x10100, 0x0, 0xfffffffffffffd51) 13:47:16 executing program 5: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-vsock\x00', 0x2, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) dup2(r2, r0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1e2ba62e) recvfrom(r1, 0x0, 0x0, 0x0, 0x0, 0x0) recvfrom(r2, &(0x7f0000000180)=""/184, 0xfffffffffffffd84, 0x10100, 0x0, 0xfffffffffffffd51) [ 2438.678602] binder: 25108:25109 ioctl c0306201 0 returned -14 [ 2438.713351] binder: release 25108:25109 transaction 3319 out, still active [ 2438.728087] binder: undelivered TRANSACTION_COMPLETE 13:47:16 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) [ 2438.773484] binder: release 25108:25109 transaction 3319 in, still active [ 2438.787337] binder: send failed reply for transaction 3319, target dead [ 2438.836335] binder: 25117:25118 ioctl c0306201 0 returned -14 [ 2438.864688] binder: release 25117:25118 transaction 3321 out, still active 13:47:16 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) [ 2438.893280] binder: undelivered TRANSACTION_COMPLETE [ 2438.932147] binder: release 25117:25118 transaction 3321 in, still active [ 2438.977192] binder: send failed reply for transaction 3321, target dead [ 2439.000605] binder: 25121:25122 ioctl c0306201 0 returned -14 13:47:17 executing program 2: socket$netlink(0x10, 0x3, 0x0) r0 = syz_open_procfs(0xffffffffffffffff, 0x0) exit(0x0) pread64(r0, 0x0, 0x0, 0x3) [ 2439.030402] binder: release 25121:25122 transaction 3323 out, still active [ 2439.046160] binder: undelivered TRANSACTION_COMPLETE 13:47:17 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) [ 2439.098340] binder: release 25121:25122 transaction 3323 in, still active [ 2439.118176] binder: send failed reply for transaction 3323, target dead [ 2439.198284] binder: undelivered TRANSACTION_COMPLETE 13:47:17 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 13:47:17 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)) r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) pread64(r1, 0x0, 0x0, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000001100)={0x0}) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r3}}, 0x0) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) dup2(r4, r1) tkill(r2, 0x15) [ 2439.258034] binder: send failed reply for transaction 3325, target dead [ 2439.354989] binder: undelivered TRANSACTION_COMPLETE 13:47:17 executing program 4: signalfd4(0xffffffffffffffff, &(0x7f0000000ff8), 0x8, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000340), 0x10000014c) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0xf000000}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 13:47:17 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) [ 2439.414709] binder: send failed reply for transaction 3327, target dead 13:47:17 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x0, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) pread64(r1, 0x0, 0x0, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000001100)={0x0}) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r3}}, 0x0) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) dup2(r4, r1) tkill(r2, 0x15) [ 2439.496903] binder: undelivered TRANSACTION_COMPLETE 13:47:17 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000380), 0x0, 0x0, 0x0}) [ 2439.563252] binder: send failed reply for transaction 3329, target dead [ 2439.729340] binder: send failed reply for transaction 3331, target dead 13:47:17 executing program 3: openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-vsock\x00', 0x2, 0x0) clone(0x100002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) dup2(r1, 0xffffffffffffffff) write$binfmt_misc(r0, &(0x7f0000000140)=ANY=[], 0x1e2ba62e) recvfrom(r0, 0x0, 0x0, 0x0, 0x0, 0x0) recvfrom(r1, &(0x7f0000000180)=""/184, 0xfffffffffffffd84, 0x10100, 0x0, 0xfffffffffffffd51) 13:47:17 executing program 1 (fault-call:5 fault-nth:0): r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-vsock\x00', 0x2, 0x0) clone(0x100002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) dup2(r2, r0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1e2ba62e) recvfrom(r1, 0x0, 0x0, 0x0, 0x0, 0x0) recvfrom(r2, &(0x7f0000000180)=""/184, 0xfffffffffffffd84, 0x10100, 0x0, 0xfffffffffffffd51) 13:47:17 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000380), 0x0, 0x0, 0x0}) 13:47:17 executing program 5 (fault-call:3 fault-nth:0): r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) pread64(r1, 0x0, 0x0, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000001100)={0x0}) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r3}}, 0x0) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) dup2(r4, r1) tkill(r2, 0x15) 13:47:17 executing program 2: socket$netlink(0x10, 0x3, 0x0) r0 = syz_open_procfs(0xffffffffffffffff, 0x0) exit(0x0) pread64(r0, 0x0, 0x0, 0x3) [ 2439.962567] FAULT_INJECTION: forcing a failure. [ 2439.962567] name failslab, interval 1, probability 0, space 0, times 0 [ 2440.001556] CPU: 1 PID: 25153 Comm: syz-executor.1 Not tainted 5.0.0+ #6 [ 2440.008459] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2440.017870] Call Trace: [ 2440.020497] dump_stack+0x172/0x1f0 [ 2440.024180] should_fail.cold+0xa/0x1b [ 2440.028140] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 2440.033294] ? lock_downgrade+0x810/0x810 [ 2440.037484] ? ___might_sleep+0x163/0x280 [ 2440.041691] __should_failslab+0x121/0x190 [ 2440.044551] binder: send failed reply for transaction 3333, target dead [ 2440.045960] should_failslab+0x9/0x14 [ 2440.045980] kmem_cache_alloc_node+0x264/0x710 [ 2440.046003] __alloc_skb+0xd5/0x5e0 [ 2440.064798] ? skb_scrub_packet+0x440/0x440 [ 2440.069142] ? __lock_acquire+0x53b/0x4700 [ 2440.073400] ? __lock_acquire+0x53b/0x4700 [ 2440.077665] alloc_skb_with_frags+0x93/0x580 [ 2440.082099] ? __lock_acquire+0x53b/0x4700 [ 2440.086376] sock_alloc_send_pskb+0x72d/0x8a0 [ 2440.090903] ? smack_inet_conn_request+0xa70/0xa70 [ 2440.095863] ? sock_wmalloc+0x120/0x120 [ 2440.099856] ? unix_gc+0xdb0/0xdb0 [ 2440.103414] ? __lock_acquire+0x53b/0x4700 [ 2440.107674] ? unix_stream_sendpage+0xb10/0xb10 [ 2440.112364] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 2440.117922] ? security_socket_getpeersec_dgram+0x93/0xc0 [ 2440.123491] unix_stream_sendmsg+0x5f7/0x990 [ 2440.127928] ? unix_stream_sendpage+0xb10/0xb10 [ 2440.132633] ? __lock_acquire+0x53b/0x4700 [ 2440.136901] ? smack_socket_sendmsg+0xb1/0x1a0 [ 2440.141510] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 2440.147086] ? security_socket_sendmsg+0x93/0xc0 [ 2440.151879] ? unix_stream_sendpage+0xb10/0xb10 [ 2440.156567] sock_sendmsg+0xdd/0x130 [ 2440.160299] sock_write_iter+0x27c/0x3e0 [ 2440.164377] ? sock_sendmsg+0x130/0x130 [ 2440.168379] ? __fget+0x340/0x540 [ 2440.171845] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 2440.177399] ? iov_iter_init+0xea/0x220 [ 2440.181395] __vfs_write+0x613/0x8e0 [ 2440.185139] ? kernel_read+0x120/0x120 [ 2440.189064] ? rw_verify_area+0x118/0x360 [ 2440.193235] vfs_write+0x20c/0x580 [ 2440.196789] ksys_write+0xea/0x1f0 [ 2440.200344] ? __ia32_sys_read+0xb0/0xb0 [ 2440.204422] ? do_syscall_64+0x26/0x610 [ 2440.208420] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 2440.213810] ? do_syscall_64+0x26/0x610 [ 2440.217819] __x64_sys_write+0x73/0xb0 [ 2440.221731] do_syscall_64+0x103/0x610 [ 2440.225644] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 2440.230848] RIP: 0033:0x457e29 [ 2440.234056] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 2440.252975] RSP: 002b:00007fc7dfc0fc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 13:47:18 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000380), 0x0, 0x0, 0x0}) [ 2440.260701] RAX: ffffffffffffffda RBX: 00007fc7dfc0fc90 RCX: 0000000000457e29 [ 2440.267983] RDX: 000000001e2ba62e RSI: 0000000020000140 RDI: 0000000000000004 [ 2440.275273] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 2440.282743] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fc7dfc106d4 [ 2440.290047] R13: 00000000004c7260 R14: 00000000004dcde8 R15: 0000000000000007 13:47:18 executing program 1: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-vsock\x00', 0x2, 0x0) clone(0x100002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) dup2(r2, r0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1e2ba62e) recvfrom(r1, 0x0, 0x0, 0x0, 0x0, 0x0) recvfrom(r2, &(0x7f0000000180)=""/184, 0xfffffffffffffd84, 0x10100, 0x0, 0xfffffffffffffd51) 13:47:18 executing program 0 (fault-call:8 fault-nth:0): r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) [ 2440.465675] binder: BINDER_SET_CONTEXT_MGR already set [ 2440.485640] binder: 25171:25172 ioctl 40046207 0 returned -16 [ 2440.505361] binder_alloc_new_buf_locked: 3 callbacks suppressed 13:47:18 executing program 4: signalfd4(0xffffffffffffffff, &(0x7f0000000ff8), 0x8, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000340), 0x10000014c) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x10000000}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) [ 2440.505369] binder_alloc: 25167: binder_alloc_buf, no vma [ 2440.531446] binder: 25171:25172 transaction failed 29189/-3, size 0-0 line 3035 13:47:18 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) [ 2440.778772] FAULT_INJECTION: forcing a failure. [ 2440.778772] name failslab, interval 1, probability 0, space 0, times 0 [ 2440.825178] binder: undelivered TRANSACTION_ERROR: 29189 [ 2440.827064] CPU: 1 PID: 25156 Comm: syz-executor.5 Not tainted 5.0.0+ #6 [ 2440.837569] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2440.846955] Call Trace: [ 2440.848059] binder_send_failed_reply: 4 callbacks suppressed [ 2440.848069] binder: send failed reply for transaction 3335 to 25167:25168 [ 2440.849592] dump_stack+0x172/0x1f0 [ 2440.849615] should_fail.cold+0xa/0x1b [ 2440.849638] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 2440.875029] ? lock_downgrade+0x810/0x810 [ 2440.879211] ? ___might_sleep+0x163/0x280 [ 2440.883388] __should_failslab+0x121/0x190 [ 2440.887661] should_failslab+0x9/0x14 [ 2440.891486] kmem_cache_alloc+0x2b2/0x6f0 [ 2440.895669] ? kasan_check_read+0x11/0x20 [ 2440.899852] taskstats_exit+0x6c8/0xcf0 [ 2440.903862] ? taskstats_user_cmd+0xcf0/0xcf0 [ 2440.908388] ? _raw_spin_unlock_irq+0x5e/0x90 [ 2440.912919] ? acct_collect+0x699/0x860 [ 2440.916927] do_exit+0x3ec/0x2fd0 [ 2440.920404] ? find_held_lock+0x35/0x130 [ 2440.924493] ? get_signal+0x331/0x1d50 [ 2440.928407] ? find_held_lock+0x35/0x130 [ 2440.932504] ? mm_update_next_owner+0x660/0x660 [ 2440.937220] ? kasan_check_read+0x11/0x20 [ 2440.941400] ? _raw_spin_unlock_irq+0x28/0x90 [ 2440.945922] ? get_signal+0x331/0x1d50 [ 2440.949835] ? _raw_spin_unlock_irq+0x28/0x90 [ 2440.954373] do_group_exit+0x135/0x370 [ 2440.958299] get_signal+0x399/0x1d50 [ 2440.962047] ? vfs_copy_file_range+0xbb0/0xbb0 [ 2440.966668] ? __fget+0x367/0x540 [ 2440.970160] do_signal+0x87/0x1940 [ 2440.973725] ? kick_process+0xef/0x180 [ 2440.977643] ? setup_sigcontext+0x7d0/0x7d0 [ 2440.981999] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 2440.987576] ? fput+0x128/0x1a0 [ 2440.990892] ? ksys_pread64+0x121/0x1c0 [ 2440.994908] ? exit_to_usermode_loop+0x43/0x2c0 [ 2440.999615] ? do_syscall_64+0x52d/0x610 [ 2441.003727] ? exit_to_usermode_loop+0x43/0x2c0 [ 2441.008430] ? lockdep_hardirqs_on+0x415/0x5d0 [ 2441.013058] ? trace_hardirqs_on+0x67/0x230 [ 2441.017435] exit_to_usermode_loop+0x244/0x2c0 [ 2441.022069] do_syscall_64+0x52d/0x610 [ 2441.026008] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 2441.031240] RIP: 0033:0x457e29 [ 2441.034474] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 2441.053408] RSP: 002b:00007f9ef72b6c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000011 [ 2441.061156] RAX: fffffffffffffe00 RBX: 00007f9ef72b6c90 RCX: 0000000000457e29 [ 2441.068452] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000004 13:47:19 executing program 2: socket$netlink(0x10, 0x3, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='fdinfo/3\x00') exit(0x0) pread64(0xffffffffffffffff, 0x0, 0x0, 0x3) [ 2441.075748] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 2441.083043] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f9ef72b76d4 [ 2441.090340] R13: 00000000004c492b R14: 00000000004d81f8 R15: 0000000000000005 [ 2441.114222] binder_alloc: 25276: binder_alloc_buf, no vma [ 2441.133079] binder: 25276:25347 transaction failed 29189/-3, size 0-0 line 3035 [ 2441.156350] binder: send failed reply for transaction 3338 to 25276:25347 [ 2441.180775] binder: 25276:25347 ioctl c0306201 20000600 returned -14 13:47:19 executing program 3 (fault-call:3 fault-nth:0): r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)) 13:47:19 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0x2, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) [ 2441.282250] binder: undelivered TRANSACTION_ERROR: 29189 13:47:19 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) pread64(r1, 0x0, 0x0, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000001100)={0x0}) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r3}}, 0x0) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) dup2(r4, r1) tkill(r2, 0x15) [ 2441.337535] binder: undelivered TRANSACTION_ERROR: 29190 [ 2441.342624] usb usb9: usbfs: process 25355 (syz-executor.3) did not claim interface 0 before use [ 2441.366185] binder: undelivered TRANSACTION_ERROR: 29189 13:47:19 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0x10, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) [ 2441.429618] FAULT_INJECTION: forcing a failure. [ 2441.429618] name failslab, interval 1, probability 0, space 0, times 0 [ 2441.457431] binder: send failed reply for transaction 3341 to 25356:25357 [ 2441.478102] binder: undelivered TRANSACTION_ERROR: 29189 [ 2441.499184] CPU: 1 PID: 25355 Comm: syz-executor.3 Not tainted 5.0.0+ #6 [ 2441.503997] binder: 25364:25365 ioctl 10 20000600 returned -22 [ 2441.506088] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2441.506096] Call Trace: [ 2441.506142] dump_stack+0x172/0x1f0 13:47:19 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) pread64(r1, 0x0, 0x2, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000001100)={0x0}) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r3}}, 0x0) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) dup2(r4, r1) tkill(r2, 0x15) [ 2441.506168] should_fail.cold+0xa/0x1b [ 2441.531697] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 2441.536840] ? lock_downgrade+0x810/0x810 [ 2441.541027] ? ___might_sleep+0x163/0x280 [ 2441.545220] __should_failslab+0x121/0x190 [ 2441.549501] should_failslab+0x9/0x14 [ 2441.553340] __kmalloc_track_caller+0x2d8/0x740 [ 2441.558057] ? __lock_acquire+0x53b/0x4700 [ 2441.562335] ? __lock_acquire+0x53b/0x4700 [ 2441.566608] ? kstrdup_const+0x66/0x80 [ 2441.570546] kstrdup+0x3a/0x70 [ 2441.573775] kstrdup_const+0x66/0x80 [ 2441.577584] __kernfs_new_node+0xb0/0x690 [ 2441.581773] ? mark_held_locks+0x100/0x100 [ 2441.586048] ? kernfs_dop_revalidate+0x3c0/0x3c0 [ 2441.590839] ? __lock_acquire+0x53b/0x4700 [ 2441.595113] ? sysfs_do_create_link_sd.isra.0+0x82/0x140 [ 2441.600605] ? find_held_lock+0x35/0x130 [ 2441.604709] ? sysfs_do_create_link_sd.isra.0+0x82/0x140 [ 2441.610196] ? kasan_check_read+0x11/0x20 [ 2441.614368] kernfs_new_node+0x99/0x130 [ 2441.618367] kernfs_create_link+0xdd/0x250 [ 2441.622643] sysfs_do_create_link_sd.isra.0+0x90/0x140 [ 2441.627953] sysfs_create_link+0x65/0xc0 [ 2441.632128] driver_sysfs_add+0x107/0x2a0 [ 2441.636325] device_bind_driver+0x19/0xe0 [ 2441.640560] usb_driver_claim_interface+0x249/0x430 [ 2441.645625] claimintf+0x10e/0x170 [ 2441.647683] binder: send failed reply for transaction 3343 to 25364:25365 [ 2441.649203] checkintf+0x139/0x180 [ 2441.649223] usbdev_do_ioctl+0x2543/0x2f10 [ 2441.649245] ? processcompl_compat+0x680/0x680 [ 2441.649272] ? proc_fail_nth_write+0x9d/0x1e0 [ 2441.649287] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 13:47:19 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0x5421, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) [ 2441.649301] ? smack_log+0x415/0x540 [ 2441.649321] ? smk_access_entry+0x1c0/0x1c0 [ 2441.687747] ? __fget+0x340/0x540 [ 2441.687764] ? smk_access+0x40d/0x570 [ 2441.687779] ? find_held_lock+0x35/0x130 [ 2441.687803] ? usbdev_compat_ioctl+0x30/0x30 13:47:19 executing program 4: signalfd4(0xffffffffffffffff, &(0x7f0000000ff8), 0x8, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000340), 0x10000014c) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x11000000}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) [ 2441.687821] usbdev_ioctl+0x26/0x30 [ 2441.687839] do_vfs_ioctl+0xd6e/0x1390 [ 2441.687853] ? smk_curacc+0x7f/0xa0 [ 2441.687867] ? ioctl_preallocate+0x210/0x210 [ 2441.687881] ? smack_file_ioctl+0x196/0x300 [ 2441.687895] ? smack_file_lock+0x240/0x240 [ 2441.687906] ? __fget+0x367/0x540 [ 2441.687927] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 2441.687941] ? fput+0x128/0x1a0 [ 2441.687960] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 2441.687978] ? security_file_ioctl+0x93/0xc0 [ 2441.687995] ksys_ioctl+0xab/0xd0 [ 2441.688013] __x64_sys_ioctl+0x73/0xb0 [ 2441.688032] do_syscall_64+0x103/0x610 [ 2441.688053] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 2441.688065] RIP: 0033:0x457e29 [ 2441.688082] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 2441.688090] RSP: 002b:00007f0fe2154c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2441.688105] RAX: ffffffffffffffda RBX: 00007f0fe2154c90 RCX: 0000000000457e29 [ 2441.688114] RDX: 0000000020000000 RSI: 0000000080085504 RDI: 0000000000000003 [ 2441.688134] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 2441.688143] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f0fe21556d4 [ 2441.688153] R13: 00000000004c0313 R14: 00000000004d1f40 R15: 0000000000000005 [ 2441.776288] binder: undelivered TRANSACTION_ERROR: 29189 [ 2441.807594] binder: send failed reply for transaction 3345 to 25370:25371 13:47:19 executing program 1: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-vsock\x00', 0x2, 0x0) clone(0x100002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) dup2(r2, r0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1e2ba6fb) recvfrom(r1, 0x0, 0x0, 0x0, 0x0, 0x0) recvfrom(r2, &(0x7f0000000180)=""/184, 0xfffffffffffffd84, 0x10100, 0x0, 0xfffffffffffffd51) 13:47:19 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0x5450, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) [ 2441.808450] binder: undelivered TRANSACTION_ERROR: 29189 13:47:20 executing program 3 (fault-call:3 fault-nth:1): r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)) 13:47:20 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0x5451, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:47:20 executing program 2: socket$netlink(0x10, 0x3, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='fdinfo/3\x00') exit(0x0) pread64(0xffffffffffffffff, 0x0, 0x0, 0x3) [ 2442.014286] binder: send failed reply for transaction 3347 to 25375:25376 [ 2442.061751] usb usb9: usbfs: process 25385 (syz-executor.3) did not claim interface 0 before use [ 2442.080866] FAULT_INJECTION: forcing a failure. [ 2442.080866] name failslab, interval 1, probability 0, space 0, times 0 [ 2442.136175] CPU: 0 PID: 25385 Comm: syz-executor.3 Not tainted 5.0.0+ #6 [ 2442.143063] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2442.149221] binder: send failed reply for transaction 3349 to 25386:25387 [ 2442.152434] Call Trace: [ 2442.152465] dump_stack+0x172/0x1f0 [ 2442.152489] should_fail.cold+0xa/0x1b [ 2442.152508] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 2442.174623] ? lock_downgrade+0x810/0x810 [ 2442.178782] ? ___might_sleep+0x163/0x280 [ 2442.182948] __should_failslab+0x121/0x190 [ 2442.187203] should_failslab+0x9/0x14 [ 2442.191015] kmem_cache_alloc+0x2b2/0x6f0 [ 2442.195167] ? memcpy+0x46/0x50 [ 2442.198454] ? kstrdup+0x5a/0x70 [ 2442.201828] __kernfs_new_node+0xef/0x690 [ 2442.205986] ? kernfs_dop_revalidate+0x3c0/0x3c0 [ 2442.210749] ? __lock_acquire+0x53b/0x4700 [ 2442.214993] ? sysfs_do_create_link_sd.isra.0+0x82/0x140 [ 2442.220447] ? find_held_lock+0x35/0x130 [ 2442.224516] ? sysfs_do_create_link_sd.isra.0+0x82/0x140 [ 2442.229978] ? kasan_check_read+0x11/0x20 [ 2442.234148] kernfs_new_node+0x99/0x130 [ 2442.238146] kernfs_create_link+0xdd/0x250 [ 2442.242391] sysfs_do_create_link_sd.isra.0+0x90/0x140 [ 2442.247678] sysfs_create_link+0x65/0xc0 [ 2442.251747] driver_sysfs_add+0x107/0x2a0 [ 2442.255903] device_bind_driver+0x19/0xe0 [ 2442.260057] usb_driver_claim_interface+0x249/0x430 [ 2442.265112] claimintf+0x10e/0x170 [ 2442.268693] checkintf+0x139/0x180 [ 2442.272248] usbdev_do_ioctl+0x2543/0x2f10 [ 2442.276502] ? processcompl_compat+0x680/0x680 [ 2442.281102] ? proc_fail_nth_write+0x9d/0x1e0 [ 2442.285615] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 2442.291171] ? smack_log+0x415/0x540 [ 2442.294897] ? smk_access_entry+0x1c0/0x1c0 [ 2442.299226] ? __fget+0x340/0x540 [ 2442.302685] ? smk_access+0x40d/0x570 [ 2442.306492] ? find_held_lock+0x35/0x130 [ 2442.310563] ? usbdev_compat_ioctl+0x30/0x30 [ 2442.314980] usbdev_ioctl+0x26/0x30 [ 2442.318616] do_vfs_ioctl+0xd6e/0x1390 [ 2442.322508] ? smk_curacc+0x7f/0xa0 [ 2442.326149] ? ioctl_preallocate+0x210/0x210 [ 2442.330568] ? smack_file_ioctl+0x196/0x300 [ 2442.334895] ? smack_file_lock+0x240/0x240 [ 2442.339145] ? __fget+0x367/0x540 [ 2442.342611] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 2442.348165] ? fput+0x128/0x1a0 [ 2442.351451] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 2442.356992] ? security_file_ioctl+0x93/0xc0 [ 2442.361410] ksys_ioctl+0xab/0xd0 [ 2442.364872] __x64_sys_ioctl+0x73/0xb0 [ 2442.368766] do_syscall_64+0x103/0x610 [ 2442.372665] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 2442.377855] RIP: 0033:0x457e29 [ 2442.381052] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 2442.399967] RSP: 002b:00007f0fe2154c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2442.407687] RAX: ffffffffffffffda RBX: 00007f0fe2154c90 RCX: 0000000000457e29 [ 2442.414956] RDX: 0000000020000000 RSI: 0000000080085504 RDI: 0000000000000003 [ 2442.422228] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 2442.429500] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f0fe21556d4 13:47:20 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0x5452, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) [ 2442.436775] R13: 00000000004c0313 R14: 00000000004d1f40 R15: 0000000000000005 13:47:20 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) pread64(r1, 0x0, 0xe, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000001100)={0x0}) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r3}}, 0x0) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) dup2(r4, r1) tkill(r2, 0x15) 13:47:20 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0x5460, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:47:20 executing program 3 (fault-call:3 fault-nth:2): r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)) 13:47:20 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) pread64(r1, 0x0, 0xe00, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000001100)={0x0}) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r3}}, 0x0) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) dup2(r4, r1) tkill(r2, 0x15) [ 2442.663308] binder: BINDER_SET_CONTEXT_MGR already set [ 2442.709046] binder: 25397:25398 ioctl 40046207 0 returned -16 13:47:20 executing program 4: signalfd4(0xffffffffffffffff, &(0x7f0000000ff8), 0x8, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000340), 0x10000014c) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x20000000}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 13:47:20 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0x40046205, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:47:21 executing program 1: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vhost-vsock\x00', 0x2, 0x0) clone(0x100002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) dup2(r2, r0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1e2ba62e) recvfrom(r1, 0x0, 0x0, 0x0, 0x0, 0x0) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/attr/current\x00', 0x2, 0x0) recvfrom(r2, &(0x7f0000000180)=""/184, 0xfffffffffffffd84, 0x10100, 0x0, 0xfffffffffffffd51) 13:47:21 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) pread64(r1, 0x0, 0x3f00, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000001100)={0x0}) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r3}}, 0x0) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) dup2(r4, r1) tkill(r2, 0x15) 13:47:21 executing program 2: socket$netlink(0x10, 0x3, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='fdinfo/3\x00') exit(0x0) pread64(0xffffffffffffffff, 0x0, 0x0, 0x3) 13:47:21 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0x40046207, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) [ 2442.976977] binder_thread_release: 16 callbacks suppressed [ 2442.976989] binder: release 25389:25390 transaction 3351 in, still active [ 2443.042091] binder: BINDER_SET_CONTEXT_MGR already set [ 2443.045438] binder: send failed reply for transaction 3351 to 25389:25390 [ 2443.056965] binder: 25625:25626 ioctl 40046207 20000600 returned -16 [ 2443.076226] binder_release_work: 8 callbacks suppressed [ 2443.076233] binder: undelivered TRANSACTION_COMPLETE 13:47:21 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0x40046208, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) [ 2443.101958] binder_release_work: 1 callbacks suppressed [ 2443.101967] binder: undelivered TRANSACTION_ERROR: 29189 13:47:21 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) pread64(r1, 0x0, 0x1000000, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000001100)={0x0}) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r3}}, 0x0) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) dup2(r4, r1) tkill(r2, 0x15) [ 2443.149135] binder: release 25625:25626 transaction 3353 in, still active [ 2443.181215] binder: send failed reply for transaction 3353 to 25625:25626 [ 2443.202097] binder: release 25632:25633 transaction 3355 in, still active [ 2443.215113] binder: undelivered TRANSACTION_COMPLETE [ 2443.232528] binder: undelivered TRANSACTION_ERROR: 29189 [ 2443.253500] binder: send failed reply for transaction 3355 to 25632:25633 [ 2443.266729] binder: undelivered TRANSACTION_COMPLETE 13:47:21 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)) [ 2443.295832] binder: undelivered TRANSACTION_ERROR: 29189 13:47:21 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) pread64(r1, 0x0, 0x2000000, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000001100)={0x0}) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r3}}, 0x0) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) dup2(r4, r1) tkill(r2, 0x15) [ 2443.370827] usb usb9: usbfs: process 25639 (syz-executor.3) did not claim interface 0 before use [ 2443.395259] vhci_hcd: default hub control req: 010b v0000 i0000 l0 13:47:21 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0x40049409, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:47:21 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x2, &(0x7f0000000000)) [ 2443.419272] binder: undelivered TRANSACTION_COMPLETE [ 2443.424508] binder: undelivered TRANSACTION_ERROR: 29189 [ 2443.599618] binder: release 25642:25644 transaction 3357 in, still active [ 2443.613445] binder: undelivered TRANSACTION_COMPLETE [ 2443.644729] binder: undelivered TRANSACTION_ERROR: 29189 13:47:21 executing program 4: signalfd4(0xffffffffffffffff, &(0x7f0000000ff8), 0x8, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000340), 0x10000014c) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x40000000}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 13:47:21 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x5421, &(0x7f0000000000)) 13:47:22 executing program 1: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-vsock\x00', 0x2, 0x0) clone(0x100002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$FICLONERANGE(r0, 0x4020940d, &(0x7f00000000c0)={r0, 0x0, 0x7, 0x0, 0x1}) ioctl$TIOCLINUX3(r0, 0x541c, &(0x7f00000003c0)) r3 = dup2(r2, r0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1e2ba62e) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000540)={r3, &(0x7f0000000400)="9811c1cb01640ebfbab7741fb62ef2ccde7e82ef0dfa605e39a84e0eff814da55944d28f942c8f17c30fd92804491474b88c07597eacce1d299b5cd5d6c31e68817dd88262db8a019de540c89001a32f1b76437bab043765b5f06cdfd62afb24e703d4d624e0eab399efa2423f27884425cf952e0d212e79515d0e748917d2ea97db06eeb766799e36a96ecac25550bf3488bdc2a6f6e36b90f1960fa828b77058bbd889e0b8bf7bc6fdc90ab6268f560e53d75c1e45175050d4bdce1959727424a12121b6e81f50aec31a97a1c9f62dabe168e8fa4925", &(0x7f0000000500)=""/39}, 0x18) recvfrom(r1, 0x0, 0x0, 0x0, 0x0, 0x0) recvfrom(r2, &(0x7f0000000180)=""/184, 0xfffffffffffffd84, 0x10100, 0x0, 0xfffffffffffffd51) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000140)='IPVS\x00') sendmsg$IPVS_CMD_GET_CONFIG(r3, &(0x7f0000000340)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x90000}, 0xc, &(0x7f0000000300)={&(0x7f0000000240)=ANY=[@ANYBLOB="b0000000", @ANYRES16=r4, @ANYBLOB="08042cbd7000fedbdf250d000000080004000400000034000200080008000500000078a92f2c24422407a731f19b0901fb0800090005000000080002e94e2300000800050008000000080003000300000008000b000200000008002300ff7f00002000010008000b00736970000c000700010000000400000008000100ef3e20003800020014000100ff020000000000000000000000000001080003000200000008000900360b000008"], 0xb0}}, 0x810) 13:47:22 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) pread64(r1, 0x0, 0xe000000, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000001100)={0x0}) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r3}}, 0x0) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) dup2(r4, r1) tkill(r2, 0x15) 13:47:22 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0x4020940d, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:47:22 executing program 2: socket$netlink(0x10, 0x3, 0x0) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='fdinfo/3\x00') exit(0x0) pread64(r0, 0x0, 0x0, 0x0) 13:47:22 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x5450, &(0x7f0000000000)) 13:47:22 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x5451, &(0x7f0000000000)) 13:47:22 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0045878, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) [ 2444.164518] binder: release 25668:25670 transaction 3359 in, still active [ 2444.184579] binder: undelivered TRANSACTION_COMPLETE [ 2444.203309] binder: undelivered TRANSACTION_ERROR: 29189 13:47:22 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) pread64(r1, 0x0, 0x3f000000, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000001100)={0x0}) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r3}}, 0x0) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) dup2(r4, r1) tkill(r2, 0x15) 13:47:22 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0045878, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:47:22 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x5452, &(0x7f0000000000)) [ 2444.295704] binder: release 25680:25681 transaction 3361 in, still active [ 2444.311346] binder: undelivered TRANSACTION_COMPLETE [ 2444.329494] binder: undelivered TRANSACTION_ERROR: 29189 [ 2444.424439] binder: release 25690:25692 transaction 3363 in, still active [ 2444.438015] binder: undelivered TRANSACTION_COMPLETE [ 2444.459790] binder: undelivered TRANSACTION_ERROR: 29189 13:47:22 executing program 4: signalfd4(0xffffffffffffffff, &(0x7f0000000ff8), 0x8, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000340), 0x10000014c) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x401f0000}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 13:47:22 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0046209, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) [ 2444.922912] binder: release 25697:25699 transaction 3365 in, still active [ 2444.930313] binder: undelivered TRANSACTION_COMPLETE [ 2444.943889] binder: undelivered TRANSACTION_ERROR: 29189 13:47:23 executing program 1: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-vsock\x00', 0x2, 0x0) clone(0x100002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) dup2(r2, r0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1e2ba62e) recvfrom(r1, 0x0, 0x0, 0x0, 0x0, 0x0) recvfrom(r2, &(0x7f00000000c0)=""/184, 0xb8, 0x10100, 0x0, 0xfffffffffffffef3) 13:47:23 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) pread64(r1, 0x0, 0xfeffffff, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000001100)={0x0}) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r3}}, 0x0) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) dup2(r4, r1) tkill(r2, 0x15) 13:47:23 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x5460, &(0x7f0000000000)) 13:47:23 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc018620b, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:47:23 executing program 2: socket$netlink(0x10, 0x3, 0x0) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='fdinfo/3\x00') exit(0x0) pread64(r0, 0x0, 0x0, 0x0) 13:47:23 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x550b, &(0x7f0000000000)) 13:47:23 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc018620c, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) [ 2445.135939] binder: release 25707:25708 transaction 3367 in, still active [ 2445.166257] binder: undelivered TRANSACTION_COMPLETE 13:47:23 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) pread64(r1, 0x0, 0xfffffffe, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000001100)={0x0}) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r3}}, 0x0) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) dup2(r4, r1) tkill(r2, 0x15) [ 2445.183755] binder: undelivered TRANSACTION_ERROR: 29189 [ 2445.236207] binder: 25723 BINDER_GET_NODE_INFO_FOR_REF: only handle may be non-zero. [ 2445.236223] binder: 25723:25724 ioctl c018620c 20000600 returned -22 13:47:23 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x5514, &(0x7f0000000000)) 13:47:23 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) pread64(r1, 0x0, 0x7ffffffff000, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000001100)={0x0}) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r3}}, 0x0) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) dup2(r4, r1) tkill(r2, 0x15) [ 2445.390155] binder: release 25723:25724 transaction 3369 in, still active 13:47:23 executing program 4: signalfd4(0xffffffffffffffff, &(0x7f0000000ff8), 0x8, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000340), 0x10000014c) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x4d010000}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 13:47:23 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0189436, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) [ 2445.933865] binder_send_failed_reply: 7 callbacks suppressed [ 2445.933877] binder: send failed reply for transaction 3371 to 25740:25741 13:47:24 executing program 1: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-vsock\x00', 0x2, 0x0) clone(0x100002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = dup2(r2, r0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1e2ba62e) recvfrom(r1, 0x0, 0x0, 0x0, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r1, 0x84, 0x1f, &(0x7f00000000c0)={0x0, @in={{0x2, 0x4e23, @multicast2}}, 0x2, 0x80}, &(0x7f0000000240)=0x90) setsockopt$inet_sctp6_SCTP_MAXSEG(r3, 0x84, 0xd, &(0x7f0000000280)=@assoc_id=r4, 0x4) recvfrom(r2, &(0x7f0000000180)=""/184, 0xfffffffffffffd84, 0x10100, 0x0, 0xfffffffffffffd51) 13:47:24 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x551f, &(0x7f0000000000)) 13:47:24 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) pread64(r1, 0x0, 0xf0ffffff7f0000, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000001100)={0x0}) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r3}}, 0x0) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) dup2(r4, r1) tkill(r2, 0x15) 13:47:24 executing program 2: socket$netlink(0x10, 0x3, 0x0) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='fdinfo/3\x00') exit(0x0) pread64(r0, 0x0, 0x0, 0x0) 13:47:24 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc020660b, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:47:24 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x4004550c, &(0x7f0000000000)) 13:47:24 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306202, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:47:24 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) pread64(r1, 0x0, 0x100000000000000, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000001100)={0x0}) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r3}}, 0x0) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) dup2(r4, r1) tkill(r2, 0x15) [ 2446.160073] binder: send failed reply for transaction 3373 to 25756:25757 [ 2446.221722] binder: 25763:25766 ioctl c0306202 20000600 returned -22 13:47:24 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306204, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:47:24 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) pread64(r1, 0x0, 0x200000000000000, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000001100)={0x0}) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r3}}, 0x0) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) dup2(r4, r1) tkill(r2, 0x15) [ 2446.294316] binder: send failed reply for transaction 3375 to 25763:25766 [ 2446.382360] binder: 25771:25772 ioctl c0306204 20000600 returned -22 [ 2446.453707] binder: send failed reply for transaction 3377 to 25771:25772 13:47:24 executing program 4: signalfd4(0xffffffffffffffff, &(0x7f0000000ff8), 0x8, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000340), 0x10000014c) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x7c150000}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 13:47:24 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc030620a, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:47:25 executing program 1: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-vsock\x00', 0x2, 0x0) clone(0x100002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x9, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x195440, 0x0) r3 = dup2(r2, r0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1e2ba62e) recvfrom(r1, 0x0, 0x0, 0x0, 0x0, 0x0) accept4$vsock_stream(r3, &(0x7f0000000100)={0x28, 0x0, 0xffffffff, @my=0x0}, 0x10, 0x80000) recvfrom(r2, &(0x7f0000000180)=""/184, 0xb8, 0x12040, 0x0, 0x0) 13:47:25 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) pread64(r1, 0x0, 0xe00000000000000, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000001100)={0x0}) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r3}}, 0x0) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) dup2(r4, r1) tkill(r2, 0x15) 13:47:25 executing program 2: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) pread64(r1, 0x0, 0x2, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000001100)={0x0}) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r3}}, 0x0) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) dup2(r4, r1) tkill(r2, 0x15) 13:47:25 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306212, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) [ 2446.939551] binder: 25777:25780 ioctl c030620a 20000600 returned -22 [ 2446.964350] binder: send failed reply for transaction 3379 to 25777:25780 13:47:25 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x4004550d, &(0x7f0000000000)) [ 2447.074487] binder: 25788:25792 ioctl c0306212 20000600 returned -22 13:47:25 executing program 2 (fault-call:3 fault-nth:0): socket$netlink(0x10, 0x3, 0x0) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='fdinfo/3\x00') exit(0x0) pread64(r0, 0x0, 0x0, 0x3) 13:47:25 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) pread64(r1, 0x0, 0x3f00000000000000, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000001100)={0x0}) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r3}}, 0x0) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) dup2(r4, r1) tkill(r2, 0x15) 13:47:25 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306225, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) [ 2447.165299] binder: send failed reply for transaction 3381 to 25788:25792 13:47:25 executing program 1: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000280)='/dev/ubi_ctrl\x00', 0x200040, 0x0) ioctl$NBD_CLEAR_QUE(r0, 0xab05) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-vsock\x00', 0x2, 0x0) getsockopt$netrom_NETROM_T4(r0, 0x103, 0x6, &(0x7f00000002c0)=0x8, &(0x7f0000000300)=0x4) clone(0x100002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x4001, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup2(r3, r2) getsockname$tipc(r4, &(0x7f0000000140), &(0x7f0000000240)=0x10) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r5 = dup2(r3, r1) write$binfmt_misc(r2, &(0x7f0000000140)=ANY=[], 0x1e2ba62e) connect$pptp(r5, &(0x7f00000000c0)={0x18, 0x2, {0x0, @remote}}, 0x1e) set_thread_area(&(0x7f0000000100)={0x6, 0xffffffffffffffff, 0x0, 0x3f, 0xa3, 0x8, 0x9, 0x4, 0x3, 0x1200000}) recvfrom(r0, &(0x7f0000000180)=""/184, 0xb8, 0x10100, 0x0, 0x0) [ 2447.269175] binder: 25805:25806 ioctl c0306225 20000600 returned -22 13:47:25 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x4004551e, &(0x7f0000000000)) [ 2447.310466] FAULT_INJECTION: forcing a failure. [ 2447.310466] name failslab, interval 1, probability 0, space 0, times 0 [ 2447.370549] binder: send failed reply for transaction 3383 to 25805:25806 [ 2447.380347] CPU: 0 PID: 25813 Comm: syz-executor.2 Not tainted 5.0.0+ #6 [ 2447.387243] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2447.396625] Call Trace: [ 2447.399256] dump_stack+0x172/0x1f0 [ 2447.402944] should_fail.cold+0xa/0x1b [ 2447.406874] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 2447.412019] ? lock_downgrade+0x810/0x810 [ 2447.416216] ? ___might_sleep+0x163/0x280 [ 2447.420407] __should_failslab+0x121/0x190 [ 2447.424663] should_failslab+0x9/0x14 [ 2447.428476] kmem_cache_alloc_node_trace+0x270/0x720 [ 2447.433616] ? _kstrtoul+0x170/0x170 [ 2447.433667] __kmalloc_node+0x3d/0x70 [ 2447.433686] kvmalloc_node+0x68/0x100 [ 2447.433708] traverse+0x401/0x760 [ 2447.441249] seq_read+0x8f8/0x1130 [ 2447.441267] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 2447.441283] ? find_held_lock+0x35/0x130 [ 2447.441299] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 2447.441313] ? fsnotify+0x395/0xbd0 [ 2447.441333] __vfs_read+0x116/0x8c0 [ 2447.441350] ? seq_dentry+0x2d0/0x2d0 [ 2447.441364] ? vfs_copy_file_range+0xbb0/0xbb0 [ 2447.441381] ? __fget+0x367/0x540 [ 2447.452219] ? security_file_permission+0x94/0x320 [ 2447.452242] ? rw_verify_area+0x118/0x360 [ 2447.452261] vfs_read+0x194/0x3e0 [ 2447.452284] ksys_pread64+0x183/0x1c0 [ 2447.461913] ? __ia32_sys_write+0xb0/0xb0 [ 2447.461931] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 2447.461948] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 2447.461964] ? do_syscall_64+0x26/0x610 [ 2447.461981] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 2447.461998] ? do_syscall_64+0x26/0x610 [ 2447.529893] __x64_sys_pread64+0x97/0xf0 [ 2447.533992] do_syscall_64+0x103/0x610 [ 2447.537923] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 2447.543142] RIP: 0033:0x457e29 [ 2447.546344] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 2447.565267] RSP: 002b:00007fa092f96c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000011 [ 2447.573001] RAX: ffffffffffffffda RBX: 00007fa092f96c90 RCX: 0000000000457e29 [ 2447.580286] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000004 [ 2447.587574] RBP: 000000000073bfa0 R08: 0000000000000000 R09: 0000000000000000 [ 2447.594868] R10: 0000000000000003 R11: 0000000000000246 R12: 00007fa092f976d4 [ 2447.602166] R13: 00000000004c492b R14: 00000000004d81f8 R15: 0000000000000005 13:47:25 executing program 4: signalfd4(0xffffffffffffffff, &(0x7f0000000ff8), 0x8, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000340), 0x10000014c) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x9a020000}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 13:47:25 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) pread64(r1, 0x0, 0xfeffffff00000000, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000001100)={0x0}) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r3}}, 0x0) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) dup2(r4, r1) tkill(r2, 0x15) 13:47:25 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc030623d, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:47:25 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x40049409, &(0x7f0000000000)) 13:47:25 executing program 1: r0 = accept4(0xffffffffffffff9c, &(0x7f00000000c0)=@sco, &(0x7f0000000140)=0x80, 0x80800) setsockopt$bt_BT_SNDMTU(r0, 0x112, 0xc, &(0x7f0000000240), 0x2) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-vsock\x00', 0x2, 0x0) clone(0x100002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) rt_sigprocmask(0x0, &(0x7f0000000280)={0x100000001}, &(0x7f00000002c0), 0x8) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r4 = dup2(r3, r1) write$binfmt_misc(r2, &(0x7f0000000140)=ANY=[], 0x1e2ba62e) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r4, 0x6, 0x23, &(0x7f0000000300)={&(0x7f0000ffc000/0x2000)=nil, 0x2000}, &(0x7f0000000340)=0x10) recvfrom(r2, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$VIDIOC_SUBDEV_G_DV_TIMINGS(r3, 0xc0845658, &(0x7f00000003c0)={0x0, @bt={0x3, 0x6ae8, 0x0, 0x1, 0xcc4, 0xffffffffffffffbf, 0x20, 0xfffffffffffffffc, 0x6, 0x7f, 0x8, 0x1, 0x6, 0x4, 0x8, 0x12}}) recvfrom(r3, &(0x7f0000000180)=""/184, 0xfffffffffffffd84, 0x10100, 0x0, 0xfffffffffffffd51) [ 2447.960532] binder: 25824:25827 ioctl c030623d 20000600 returned -22 13:47:26 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x4008550c, &(0x7f0000000000)) 13:47:26 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306248, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) [ 2448.006309] binder_thread_release: 7 callbacks suppressed [ 2448.006322] binder: release 25824:25827 transaction 3385 in, still active [ 2448.032083] binder: send failed reply for transaction 3385 to 25824:25827 13:47:26 executing program 2 (fault-call:3 fault-nth:1): socket$netlink(0x10, 0x3, 0x0) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='fdinfo/3\x00') exit(0x0) pread64(r0, 0x0, 0x0, 0x3) 13:47:26 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) pread64(r1, 0x0, 0xffffffff00000000, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000001100)={0x0}) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r3}}, 0x0) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) dup2(r4, r1) tkill(r2, 0x15) [ 2448.150561] binder: 25838:25844 ioctl c0306248 20000600 returned -22 13:47:26 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) pread64(r1, 0x0, 0x0, 0x2) r2 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000001100)={0x0}) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r3}}, 0x0) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) dup2(r4, r1) tkill(r2, 0x15) [ 2448.222582] FAULT_INJECTION: forcing a failure. [ 2448.222582] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 2448.234459] CPU: 1 PID: 25848 Comm: syz-executor.2 Not tainted 5.0.0+ #6 [ 2448.241331] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2448.250715] Call Trace: [ 2448.250751] dump_stack+0x172/0x1f0 [ 2448.250793] should_fail.cold+0xa/0x1b [ 2448.250812] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 2448.250829] ? mark_held_locks+0x100/0x100 [ 2448.250858] should_fail_alloc_page+0x50/0x60 [ 2448.250880] __alloc_pages_nodemask+0x1a1/0x710 [ 2448.270368] ? find_held_lock+0x35/0x130 [ 2448.270390] ? __alloc_pages_slowpath+0x2900/0x2900 [ 2448.270426] cache_grow_begin+0x9c/0x8c0 [ 2448.292793] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 2448.298372] ? check_preemption_disabled+0x48/0x290 [ 2448.303430] kmem_cache_alloc_node_trace+0x658/0x720 [ 2448.308576] ? _kstrtoul+0x170/0x170 [ 2448.312341] __kmalloc_node+0x3d/0x70 [ 2448.316192] kvmalloc_node+0x68/0x100 [ 2448.320045] traverse+0x401/0x760 [ 2448.323547] seq_read+0x8f8/0x1130 [ 2448.327143] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 2448.332729] ? find_held_lock+0x35/0x130 [ 2448.336833] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 2448.342410] ? fsnotify+0x395/0xbd0 [ 2448.346077] __vfs_read+0x116/0x8c0 [ 2448.349758] ? seq_dentry+0x2d0/0x2d0 [ 2448.353596] ? vfs_copy_file_range+0xbb0/0xbb0 [ 2448.358231] ? __fget+0x367/0x540 [ 2448.361732] ? security_file_permission+0x94/0x320 [ 2448.366707] ? rw_verify_area+0x118/0x360 13:47:26 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc030624d, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) [ 2448.370897] vfs_read+0x194/0x3e0 [ 2448.374395] ksys_pread64+0x183/0x1c0 [ 2448.379300] ? __ia32_sys_write+0xb0/0xb0 [ 2448.379322] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 2448.388279] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 2448.393076] ? do_syscall_64+0x26/0x610 [ 2448.397083] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 2448.401942] binder: release 25838:25844 transaction 3387 in, still active [ 2448.402504] ? do_syscall_64+0x26/0x610 [ 2448.402528] __x64_sys_pread64+0x97/0xf0 [ 2448.402546] do_syscall_64+0x103/0x610 [ 2448.419765] binder: send failed reply for transaction 3387 to 25838:25844 [ 2448.421436] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 2448.421450] RIP: 0033:0x457e29 [ 2448.421467] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 2448.421476] RSP: 002b:00007fa092f96c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000011 [ 2448.421491] RAX: ffffffffffffffda RBX: 00007fa092f96c90 RCX: 0000000000457e29 [ 2448.421500] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000004 [ 2448.421512] RBP: 000000000073bfa0 R08: 0000000000000000 R09: 0000000000000000 [ 2448.436859] R10: 0000000000000003 R11: 0000000000000246 R12: 00007fa092f976d4 [ 2448.436869] R13: 00000000004c492b R14: 00000000004d81f8 R15: 0000000000000005 [ 2448.513517] binder_release_work: 9 callbacks suppressed 13:47:26 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) pread64(r1, 0x0, 0x0, 0xe) r2 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000001100)={0x0}) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r3}}, 0x0) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) dup2(r4, r1) tkill(r2, 0x15) [ 2448.513524] binder: undelivered TRANSACTION_COMPLETE [ 2448.532965] binder_release_work: 9 callbacks suppressed [ 2448.532999] binder: undelivered TRANSACTION_ERROR: 29189 [ 2448.564883] binder: 25854:25855 ioctl c030624d 20000600 returned -22 [ 2448.618866] binder: release 25854:25855 transaction 3389 in, still active [ 2448.627680] binder: send failed reply for transaction 3389 to 25854:25855 [ 2448.646685] binder: undelivered TRANSACTION_COMPLETE [ 2448.652549] binder: undelivered TRANSACTION_ERROR: 29189 13:47:27 executing program 4: signalfd4(0xffffffffffffffff, &(0x7f0000000ff8), 0x8, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000340), 0x10000014c) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0xfeffffff}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 13:47:27 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306253, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:47:27 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) pread64(r1, 0x0, 0x0, 0xe00) r2 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000001100)={0x0}) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r3}}, 0x0) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) dup2(r4, r1) tkill(r2, 0x15) 13:47:27 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x4008550d, &(0x7f0000000000)) 13:47:27 executing program 2 (fault-call:3 fault-nth:2): socket$netlink(0x10, 0x3, 0x0) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='fdinfo/3\x00') exit(0x0) pread64(r0, 0x0, 0x0, 0x3) 13:47:27 executing program 1: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-vsock\x00', 0x2, 0x0) clone(0x100002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = dup2(r2, r0) fadvise64(r3, 0x0, 0x100000001, 0x2) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1e2ba62e) recvfrom(r1, 0x0, 0x0, 0x0, 0x0, 0x0) recvfrom(r2, &(0x7f0000000180)=""/184, 0xfffffffffffffd84, 0x10100, 0x0, 0xfffffffffffffd51) 13:47:27 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x40085511, &(0x7f0000000000)) [ 2449.117620] binder: 25869:25877 ioctl c0306253 20000600 returned -22 13:47:27 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x48, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:47:27 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) pread64(r1, 0x0, 0x0, 0x3f00) r2 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000001100)={0x0}) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r3}}, 0x0) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) dup2(r4, r1) tkill(r2, 0x15) [ 2449.209881] binder: release 25869:25877 transaction 3391 in, still active [ 2449.221826] binder: undelivered TRANSACTION_COMPLETE [ 2449.241918] binder: undelivered TRANSACTION_ERROR: 29189 [ 2449.317468] binder_alloc: 25890: binder_alloc_buf, no vma [ 2449.340158] binder: 25890:25893 transaction failed 29189/-3, size 0-0 line 3035 13:47:27 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x4020940d, &(0x7f0000000000)) [ 2449.364758] binder: 25890:25893 ioctl c0306201 20000600 returned -14 13:47:27 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x4d, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:47:27 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) pread64(r1, 0x0, 0x0, 0x1000000) r2 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000001100)={0x0}) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r3}}, 0x0) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) dup2(r4, r1) tkill(r2, 0x15) [ 2449.453754] binder: undelivered TRANSACTION_ERROR: 29190 [ 2449.459808] binder: undelivered TRANSACTION_COMPLETE [ 2449.482490] binder: undelivered TRANSACTION_ERROR: 29189 [ 2449.563235] binder_alloc: 25901: binder_alloc_buf, no vma [ 2449.579300] binder: 25901:25902 transaction failed 29189/-3, size 0-0 line 3035 [ 2449.619258] binder: 25901:25902 ioctl c0306201 20000600 returned -14 [ 2449.728321] binder: undelivered TRANSACTION_ERROR: 29190 [ 2449.734375] binder: undelivered TRANSACTION_COMPLETE [ 2449.756574] binder: undelivered TRANSACTION_ERROR: 29189 13:47:28 executing program 4: signalfd4(0xffffffffffffffff, &(0x7f0000000ff8), 0x8, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000340), 0x10000014c) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0xffffff7f}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 13:47:28 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x41045508, &(0x7f0000000000)) 13:47:28 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x53, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:47:28 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) pread64(r1, 0x0, 0x0, 0x2000000) r2 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000001100)={0x0}) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r3}}, 0x0) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) dup2(r4, r1) tkill(r2, 0x15) 13:47:28 executing program 2: socket$netlink(0x10, 0x3, 0x0) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='fdinfo/3\x00') exit(0x0) pread64(r0, 0x0, 0x0, 0x3) 13:47:28 executing program 1: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-vsock\x00', 0x2, 0x0) clone(0x100002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) dup2(r1, r0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1e2ba62e) recvfrom(r1, 0x0, 0x0, 0x0, 0x0, 0x0) recvfrom(r2, &(0x7f0000000180)=""/184, 0xfffffffffffffd84, 0x10100, 0x0, 0xfffffffffffffd51) 13:47:28 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80045503, &(0x7f0000000000)) [ 2450.178008] binder_alloc: 25912: binder_alloc_buf, no vma [ 2450.183658] binder: 25912:25913 transaction failed 29189/-3, size 0-0 line 3035 [ 2450.208070] binder: 25912:25913 ioctl c0306201 20000600 returned -14 13:47:28 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x2, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:47:28 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) pread64(r1, 0x0, 0x0, 0xe000000) r2 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000001100)={0x0}) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r3}}, 0x0) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) dup2(r4, r1) tkill(r2, 0x15) [ 2450.264472] binder: undelivered TRANSACTION_ERROR: 29190 [ 2450.270752] binder: undelivered TRANSACTION_COMPLETE [ 2450.294575] binder: undelivered TRANSACTION_ERROR: 29189 13:47:28 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80045505, &(0x7f0000000000)) [ 2450.370446] binder: 25934:25935 unknown command 16448 [ 2450.397104] binder: 25934:25935 ioctl c0306201 20000600 returned -22 13:47:28 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x3, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:47:28 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x8004550f, &(0x7f0000000000)) [ 2450.472659] binder: release 25934:25935 transaction 3402 in, still active [ 2450.482001] binder: undelivered TRANSACTION_COMPLETE [ 2450.498811] binder: undelivered TRANSACTION_ERROR: 29189 [ 2450.598619] binder: 25945:25947 unknown command 64 [ 2450.618565] binder: 25945:25947 ioctl c0306201 20000600 returned -22 [ 2450.693688] binder: release 25945:25947 transaction 3404 in, still active [ 2450.702449] binder: undelivered TRANSACTION_COMPLETE 13:47:29 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80045510, &(0x7f0000000000)) 13:47:29 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) pread64(r1, 0x0, 0x0, 0x3f000000) r2 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000001100)={0x0}) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r3}}, 0x0) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) dup2(r4, r1) tkill(r2, 0x15) 13:47:29 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x4, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:47:29 executing program 2: socket$netlink(0x10, 0x3, 0x0) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='fdinfo/3\x00') exit(0x0) pread64(r0, 0x0, 0x3, 0x3) 13:47:29 executing program 4: signalfd4(0xffffffffffffffff, &(0x7f0000000ff8), 0x8, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000340), 0x10000014c) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0xfffffffe}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 13:47:29 executing program 1: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000280)='/dev/vhost-vsock\x00', 0x2, 0x0) clone(0x100002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) dup2(r2, r0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1e2ba62e) recvfrom(r1, 0x0, 0x0, 0x0, 0x0, 0x0) recvfrom(r2, &(0x7f0000000180)=""/184, 0xfffffffffffffd84, 0x10100, 0x0, 0xfffffffffffffd51) [ 2451.263010] binder: 25960:25966 unknown command 0 [ 2451.268258] binder: 25960:25966 ioctl c0306201 20000600 returned -22 13:47:29 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x5, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:47:29 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80045515, &(0x7f0000000000)) [ 2451.312005] binder: release 25960:25966 transaction 3406 in, still active [ 2451.324901] binder_send_failed_reply: 6 callbacks suppressed [ 2451.324911] binder: send failed reply for transaction 3406 to 25960:25966 13:47:29 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) pread64(r1, 0x0, 0x0, 0xfeffffff) r2 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000001100)={0x0}) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r3}}, 0x0) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) dup2(r4, r1) tkill(r2, 0x15) [ 2451.383070] binder: undelivered TRANSACTION_COMPLETE [ 2451.394000] binder: 25977:25978 unknown command 0 [ 2451.415980] binder: 25977:25978 ioctl c0306201 20000600 returned -22 13:47:29 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80045518, &(0x7f0000000000)) 13:47:29 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x6, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) [ 2451.476528] binder: release 25977:25978 transaction 3408 in, still active [ 2451.491536] binder: send failed reply for transaction 3408 to 25977:25978 [ 2451.531980] binder: undelivered TRANSACTION_COMPLETE [ 2451.563839] binder: 25985:25987 unknown command 0 [ 2451.584510] binder: 25985:25987 ioctl c0306201 20000600 returned -22 13:47:29 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80045519, &(0x7f0000000000)) 13:47:29 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) pread64(r1, 0x0, 0x0, 0xfffffffe) r2 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000001100)={0x0}) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r3}}, 0x0) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) dup2(r4, r1) tkill(r2, 0x15) 13:47:29 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x7, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) [ 2451.724180] binder: release 25985:25987 transaction 3410 in, still active [ 2451.740133] binder: send failed reply for transaction 3410 to 25985:25987 13:47:29 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x8004551a, &(0x7f0000000000)) [ 2451.846549] binder: 25995:25996 unknown command 0 [ 2451.875610] binder: 25995:25996 ioctl c0306201 20000600 returned -22 [ 2452.051997] binder: release 25995:25996 transaction 3412 in, still active [ 2452.061149] binder: send failed reply for transaction 3412 to 25995:25996 13:47:30 executing program 2: socket$netlink(0x10, 0x3, 0x0) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='fdinfo/3\x00') exit(0x0) pread64(r0, 0x0, 0x300, 0x3) 13:47:30 executing program 4: signalfd4(0xffffffffffffffff, &(0x7f0000000ff8), 0x8, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000340), 0x10000014c) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x10000000000}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 13:47:30 executing program 1: r0 = openat$autofs(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/autofs\x00', 0x0, 0x0) r1 = syz_genetlink_get_family_id$net_dm(&(0x7f0000000140)='NET_DM\x00') sendmsg$NET_DM_CMD_STOP(r0, &(0x7f00000002c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x14, r1, 0x0, 0x70bd2c, 0x25dfdbfd, {}, ["", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x40801}, 0x20000010) r2 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000400)='/dev/vhost-vsock\x00', 0x2, 0x0) clone(0x100002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) dup2(r4, r2) write$binfmt_misc(r3, &(0x7f0000000140)=ANY=[], 0x1e2ba62e) recvfrom(r3, 0x0, 0x0, 0x0, 0x0, 0x0) recvfrom(r4, &(0x7f0000000180)=""/184, 0xfffffffffffffd84, 0x10100, 0x0, 0xfffffffffffffd51) 13:47:30 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) pread64(r1, 0x0, 0x0, 0x7ffffffff000) r2 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000001100)={0x0}) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r3}}, 0x0) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) dup2(r4, r1) tkill(r2, 0x15) 13:47:30 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085502, &(0x7f0000000000)) 13:47:30 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0xa, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) [ 2452.404105] binder: 26018:26020 unknown command 0 [ 2452.418409] binder: 26018:26020 ioctl c0306201 20000600 returned -22 13:47:30 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085503, &(0x7f0000000000)) 13:47:30 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x48, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) [ 2452.481979] binder: send failed reply for transaction 3414 to 26018:26020 13:47:30 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) pread64(r1, 0x0, 0x0, 0xf0ffffff7f0000) r2 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000001100)={0x0}) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r3}}, 0x0) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) dup2(r4, r1) tkill(r2, 0x15) 13:47:30 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085505, &(0x7f0000000000)) [ 2452.608399] binder: 26034:26037 ioctl c0306201 20000600 returned -14 13:47:30 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x4c, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) [ 2452.715861] binder: send failed reply for transaction 3416 to 26034:26037 13:47:30 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085506, &(0x7f0000000000)) [ 2452.824313] binder: 26045:26046 ioctl c0306201 20000600 returned -14 [ 2452.912304] binder: send failed reply for transaction 3418 to 26045:26046 13:47:31 executing program 2: socket$netlink(0x10, 0x3, 0x0) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='fdinfo/3\x00') exit(0x0) pread64(r0, 0x0, 0x3000000, 0x3) 13:47:31 executing program 4: signalfd4(0xffffffffffffffff, &(0x7f0000000ff8), 0x8, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000340), 0x10000014c) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1bc1e337233}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 13:47:31 executing program 1: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-vsock\x00', 0x2, 0x0) clone(0x100002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = syz_open_dev$usbmon(&(0x7f00000000c0)='/dev/usbmon#\x00', 0x10000, 0x204880) write$UHID_INPUT(r3, &(0x7f00000003c0)={0x8, "9752d059fff871e1cc4a503c1adfbac9563a59fc9246c43a1665b5c67948b9d027a0dcd0d6104f14c4a5461d738f38a69f466622dd117ef8e711a3bc988e1090be19470a0c3b075865b6d902f459781124ca0ce5439e311cd2a15f76110d4f422468be26fa74fcdb8011d7e42be28fee43ac8de97c91184e7da05baf0b16091f9b9d5320233af545c9b14a07083d9720d16d7fa9e5913e0fd7d48b916c386a24bd002b6162a82af9024eb36eb1c242698c5952e398fe85b73c65b76dd97975834eea7a10094bba7673130e77d3e86a852c24ca827cdca24786751996cc81884291fda15dbe09812d9c5be164e696a6331cca363c465abff040c32f2b6bd2c2c337c44a2cc616ccc5f6147c3a0e93a95edf878ca19407c79242b89b64e44e9592ae5f092edc225681078d413a6cf905cd48d264e9874c6a79873acbfebc176fbed18ed3338e6c79212458857e7a9062b8a79f2049849265160ab1290a3e5851b3b269689fc18702d8b57417c39fcd65b614dcafb5132cc421991a58ca11529880edaeeaa2a41e32b03b6345eaeda9d30618c514065c0a7bc132b5124073853ef1132dc9c8a7f2da3cf6bc064767940c058a2d72bf0342e4469cefdb9ecf468f944e4a25d872a3bf38f5068ee803e0a35b9ffa243d44184f9b211cf223101fa3930c28d0d191bf27b68c675c9f8742b8372a00422804b6e93a2354583f3e66ae5abb267f3309a5dc32ab2db05c173e09559be3ab3e4fdcdd0802936b20253cf0466676cac56089495f27e4f8e4dcf374e884e3197754c1d7a8b5b4f0716f72c717ea426d17144b4b622df0bb877976fe43f74d4cd0d81faff70a05eb67d7c1b1fa0b77f81f41f67432615aed44eaf922a8ee0c65fae685c2193e6a3a910b589e8c56f1ac86c6634188c7e038cc5a49f938c654d0c7b323161ac1de1fde78fd39911f60d021426463e1780cb80799ec9662bb1f120c67d90eadde56331755b6d7316e48546c33001d655774d406805f35d240dc33a1698af23cd951b599ff0d003ef9f31b48783a5e184d6c24fa61a74075008bd1b563d0cefe8b17f9c8d7f16776385661a4d12fafeb89d7c20a0281d03bb40d0917318e5d1897629b8ad68dc2583f15f3b5890a52511b110a3e088fc21d6b30f847a202d1cfd5417bc465653506e62640d781d5ee73039718d70816a6e4e2207fb471d43b8b265c1b26593b3a3608427a12e6a4e4a60c863ff9fa8120908198198c270888b7eafcbed193808cd007f73a421d3d07caa77fa5a68a1125e65ebbda34d231dcc8c392def5e3c908cac69a875f342d443b73465d9a6edab6e1303fa954b3a77a6d92a216f760eb9f49cb23bfd4946ab2c321f519d2e5ba6dec0d1efe6899f821b780b03fe55919df22812a7ed8bf9b3a2da01f3ba342d21318040dfa7752f3fc91cd60ac977f9f9954a3ca5479a83d0cc4bb915f605de4f6f1a4aa1565e7b5754cdb6475925191151e86d9e57cbaf0c7531e254b9f6b79e96253645338ced8a5736e0e351b5eac22ce453b028a06c9b95d3731e102071e9c6007284f458d6a1012c85cd6573db670610a615388594d06e6b9d7b933656390d619b480c9efc4ace73977a76435ebc786074c5e79167068b09be3e19bc4086911b4216f8f04f4e5bc7e98f1151952291029ccd2ef7f1e930ab87f19576ce20dff17136a5f7ee3254f415ead345b1fd4c259295fea4a27d9dbc880e600f083938e55301ea5595784f02e5c86252b8346c4debaa4c5cbda80e897b87d992f5351a67752f231fcd6b6fb0cc0fdb4a17c633279d52e3cdcb5d5749e8567468316015474b5d7bc52b6eaea1aeea9b51735156539f8164966041bcdc0b06bf6f1866455fab97a4e06ac2da1a4d4bf4aac6bb8e2556faccb722df0f2e0920997c39f22225a16f1655ad4c8447530f9b9f46e95d4b668cd20753d5699e98b67d8d80df1256f14788517b7669d4854618fc028bccfeb0c6a0ad34115c8f943b5b0f4f80833b7ff93007ce8403df217a84700fa0e4f37f5f8f164f268e953976ff92bc0360b31a88143c3bbaaba66d4a67393a618154192265104638931d68158a7b57bb0565a72b687f3d3dec4d8875179807c539b8690733be260212c6fd4031137506aa57fb9ee77f6a8a3447a75ad6162371d1840ffb1265f41122a42695a6b8f585e9372222ae1e356236816b47cc831235fcd78338a6c27047a0ce033c18e6f842222833860b04187bc9b7e0096c50fd0a9e68078923aea41dacec0e078021cbf84bdef4fe6ffbf6ebfbe538c2988365cf3c5edaf909aa2679983d5d591579deb5f397fccceb4d6eb8a32fe5f1db86aed2c77ff55913376df0a85c393f3cc08aa8a0f343f4438e279b584d62f5e145c16c74d6eb9899aca3545776ed31aaf659c5b1578863a865c740530462aeeadb09c22416d8531da91caa163911f070bd6247c32cac25b1515b04ac3a87de68e937d02b7a3b8ecccf75c847aa7b9221681e98d07bcf51f7730c81da0c461e91d646061937151a96e968ab25bc393cd19436f36352caa5f300a84905389f09eb58b631ab7bdd20d7409bd31ebe8fdb56d4bc5b1b4fe97d9e3c3acf5a9696759ec12b64800dc27fd2c8ac26f5453fc99c5186176213872aa8e11a13de78ebe94197e7ff2fd921e8bc2b594e35d44bbd2ad9f38b1677bc46ce2518d52b3727f8aa88db2509932961534b9f1b84be269550e3fcf4226317aa397e0a380ae5a82de9f38c18cdf7ee00ab766d36c9516dfc621b37f382164601ee46f937abba8688c0e1dfb71127e45a7b0c4b20eefbbad03c6baa2c29156e50a4891f867eab8f2afc83392f4683f34cc2f562b7944065e2dda869bb0b9b636b868b4389976924f0022119039c5fcb5e6836a98b27137345b15dd9a6c923bf2946c2940441930690660c05c8578c752fb639394b566d4e19853313bba742a73590148e88109723a7636ea9f60374471d2bc44e5d8657d6c79903c7c5bc7b9cb9ff4d42d06eaca015dfbfc357ab620ea9909cf23cb8051e8292371dd136420bc006f19d8fcf912c18304d0fe05299b053093e7cb9a33e7330df92dafd4d3d1934656bc768c374b792e64dee8b5c29fc4b48ed9bb72418fd284fa5fbc7e7c2f65e0ca252692bf224068fc7ea74425d1f4fac14b081650903ac029fa7c35f0de4dfa7d9b4ee50c4ed8666eb4e61ac1e6e71980289c7d2a7eacbfb772bea128a7846daea80caf4f7365738af04de91f7240d1839efab00849acfe66bf6da6b14c373c43f870c9f99b26e10cb200dcd9176ccd2536cba4d6383775dd843d8e4f3a23671114de575ee3ba6f2bd033f35d2d1640505dcc6329c39551f82078a71c2d63e9028461859dc6678addf09e0fcd18623a357e8689c97d971aa16b336ba661801aa38e60775470ef9eb5878c94d0362d31092c4ac4e4f7c82ecfc982b303c074e9f340dc75039a401f20b075afb1fbcfbfd1192bcae033e43e46c65509ee354a53c52f17a200ff24ec037951b9119aba28955e0983d67af5ee07342f0fc0ea3ed74c4f9dbc89cf1be34ddb4a166787f482b46e5499c876a4e7a53df60d4c3b8a7ff924a94ad8ad5c4bf879ff9d2009b23bd38214a2c62f39872609296f4d7f9124401618b65871d6bb1c61317f25f7f3e800f6075f84a69fec9cae759232bf22b55f1e9eb55cc8e800a86f79a5cd840652be3c8d225dbc1195f6c681ecaa94e67ef489f742f578c3b76288593da4d214e7539b37d3bcd2217c68785d304bc0adcf6475c39fb93384f8dafdf1ab33f95de4ae3743c64c360842cff14200be44902f7af2ad54371f6dff186f29baf87493302dd91942f26f14d05c9c0b3d697d9ac393fe1f1594e291e03b7c400c2ad8ce5423e9fb97f4e829485ee08db6d9cd9a29416e5b039698fef9bf063a59aac61ad2bf17e9d0a3bddd1510fcb01ee7facd4b3e2afb8ce541a409c58ef2b9ac11f01859b496eadaaa3156abb4f77ccd86e97c61f915d4c507983505ce4e4f41427a536f482d69469231ffb59996225e73f270844fdb13ae5d0d0da083c936781ad8a2ddfb9bc93408889f736711a14d51f1b5facbecdd95c32f9b8543afa05fea65691def39008ca1772977d02f0b89dc0e57e0c364306fe3b42e2f68543648b78dd3062f1999d8f1a8627d188c41e656606ff88d8ea1aa07a5331303e49f2ed584e18d4656d618cc70651f911646e75c5d96b58f5eb70859f9f1c1faabd956ccb8cf421a88e9932cfc324c6ee8e76eabf371e283604f07e386decfea755ded07ffa4558c3340fa5ec6cdc341ba3d1a1faf0e129c8cec6be4dcfdc586ac6219b6ba9e646af5dcbfc980ebcf1b98e0eef664b648705797eafe9735d0fd6d081787ae7fdb6a7dec4ebaf5a06a34dd0e397f1ac7a20d05b63862767fdb00affda952f5a6ded8e8a38a5244b34b979016720399d1c78646747790548019720532aa008dc5380f6db30dcf4a56a5aeb3fd20f10fa57f35a59171625d948ba84f54027cc40f4de823e9d70ecf50dda4fa87f56a6cedf1a5e57662c0f151d1f6be5ac5eda91fac86afec5ebc9c9bfa94ef8e331454786a84894b4fdb84d3ee79cebb19fb44b131ed631b892ad661691e2bf699039c1c4505ba421c1824d7303d1a1be0cc8fa1a8264aad85102656cf11eb34a17d36799703e16a5f675ddf3cedfbb2b2ad4fdde72bde7f5b7fb53999d1c316e0b47a4e9d848089be50aabb681027c3b9bd4a889f43074b801346f5155db347d6b1b1f0ed366d13844cb4b4a6a58e87d45451d9de8bdea8731577867c8c1e97f8769e34d1da65cee52f5b0a413d513d28631cf2865e70201fa8e7003510efd2b8937deebf4de332baa5054f25f3fdf4409b447feead9fec24a262122d21caaec8f4ed485e29fbd147e41c70d4a6db73a1ce0d4ae98d6f197feb6064b8e3970cacb7a2a3ea986345af8e5721dfaa344f79997d7168a38416edc705fca31e84589727532575961dd2fe3d5805cabe5573ae27d7a24c5f9f9334c57ba2efbc7f0172413b882e37c7f5b42b443a59b4b11909265ec4bfedd9fa37cfcd7d705333e30e1044056d46e3e7d85571773445aa19e29883bc69266e14b6bb83f62a50f8966eac2e2d0b00930f2f07f216e08abba14ed556077d207767724b1a77f661e2a8a6846364766b774a8d50123c0c29ef384db314039fc6b62497651a2a25d91e40348c196463def55b1eb6ddb7fda219065a661258583c3931edb0457084020236735b62e68cf364d74e9a223e12dc1f7401be9acc2147cc86238b97670865bd4d763ba0d4d02f01e6aad36c79d7bd15410c397cdbb3584c7015fae5fdcf92a85540883ffda70d34f6784a5b91a4f37386d55c37a00d987ff4e0ce8e35aac4454ade1b14c94831d5015325164d98ae1745ee1b60e70ede2326b150c73ece4942e52d5d9fc848493829d6bca3bcf63f0e4dde53c276f2d0616c12afb7da955f3c431d7fb4c9c123688b2dda92b334456cd862fe4dd75356ae191f565dc228cbbf5d1f854eed0a5e8bd6cfd02b5764f2139556f6614b8f54ebd3ca4389ac0ed03fcfecc701b2871f5074754120833b4d9cd7fd7f14b9a86a29756e65acf315b1eaefb80b57008fc650be7ea165ec15128ad78bc53541716b9cd8edc6219eca317318ea9ff26ca68715b2b57f96d9a559a3e5b1922e26334150208f91d3a18ac790ced589273c28968b06161a490af1cd86e8f084082eab46f95999db5d88b26fa13b7bc2a595c9096ac6d9fd3f63dc8538e719", 0x1000}, 0x1006) dup2(r2, r0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1e2ba62e) recvfrom(r1, 0x0, 0x0, 0x0, 0x0, 0x0) recvfrom(r2, &(0x7f0000000180)=""/184, 0xfffffffffffffd84, 0x10100, 0x0, 0xfffffffffffffd51) 13:47:31 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) pread64(r1, 0x0, 0x0, 0x100000000000000) r2 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000001100)={0x0}) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r3}}, 0x0) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) dup2(r4, r1) tkill(r2, 0x15) 13:47:31 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x60, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:47:31 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085507, &(0x7f0000000000)) 13:47:31 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085509, &(0x7f0000000000)) [ 2453.439411] binder: 26062:26066 ioctl c0306201 20000600 returned -14 13:47:31 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x68, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) [ 2453.516397] binder_thread_release: 3 callbacks suppressed [ 2453.516411] binder: release 26062:26066 transaction 3420 in, still active [ 2453.554532] binder: send failed reply for transaction 3420 to 26062:26066 13:47:31 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) pread64(r1, 0x0, 0x0, 0x200000000000000) r2 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000001100)={0x0}) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r3}}, 0x0) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) dup2(r4, r1) tkill(r2, 0x15) [ 2453.574744] binder_release_work: 5 callbacks suppressed [ 2453.574779] binder: undelivered TRANSACTION_COMPLETE [ 2453.606151] binder_release_work: 8 callbacks suppressed [ 2453.606159] binder: undelivered TRANSACTION_ERROR: 29189 [ 2453.621208] binder: 26075:26077 ioctl c0306201 20000600 returned -14 13:47:31 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x8008550e, &(0x7f0000000000)) 13:47:31 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x6c, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) [ 2453.694589] binder: release 26075:26077 transaction 3422 in, still active [ 2453.704375] binder: send failed reply for transaction 3422 to 26075:26077 [ 2453.718796] binder: undelivered TRANSACTION_COMPLETE [ 2453.731237] binder: undelivered TRANSACTION_ERROR: 29189 13:47:31 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) pread64(r1, 0x0, 0x0, 0xe00000000000000) r2 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000001100)={0x0}) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r3}}, 0x0) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) dup2(r4, r1) tkill(r2, 0x15) [ 2453.795470] binder: 26086:26087 ioctl c0306201 20000600 returned -14 [ 2453.888288] binder: release 26086:26087 transaction 3424 in, still active [ 2453.900497] binder: send failed reply for transaction 3424 to 26086:26087 [ 2453.922356] binder: undelivered TRANSACTION_COMPLETE [ 2453.935446] binder: undelivered TRANSACTION_ERROR: 29189 13:47:32 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085512, &(0x7f0000000000)) 13:47:32 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) pread64(r1, 0x0, 0x0, 0x3f00000000000000) r2 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000001100)={0x0}) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r3}}, 0x0) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) dup2(r4, r1) tkill(r2, 0x15) 13:47:32 executing program 1: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-vsock\x00', 0x2, 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x2000, 0x0) write$P9_RVERSION(r1, &(0x7f0000000100)={0x13, 0x65, 0xffff, 0xfffffffeffffffff, 0x6, '9P2000'}, 0x13) clone(0x100002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r0) write$binfmt_misc(r2, &(0x7f0000000140)=ANY=[], 0x1e2ba62e) recvfrom(r2, 0x0, 0x0, 0x0, 0x0, 0x0) recvfrom(r3, &(0x7f0000000180)=""/184, 0xfffffffffffffd84, 0x10100, 0x0, 0xfffffffffffffd51) 13:47:32 executing program 2: socket$netlink(0x10, 0x3, 0x0) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='fdinfo/3\x00') exit(0x0) pread64(r0, 0x0, 0x7ffffffff000, 0x3) 13:47:32 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x74, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:47:32 executing program 4: signalfd4(0xffffffffffffffff, &(0x7f0000000ff8), 0x8, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000340), 0x10000014c) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x7d0000000000}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 13:47:32 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x8008551c, &(0x7f0000000000)) 13:47:32 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) pread64(r1, 0x0, 0x0, 0xfeffffff00000000) r2 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000001100)={0x0}) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r3}}, 0x0) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) dup2(r4, r1) tkill(r2, 0x15) [ 2454.518705] binder: 26106:26112 ioctl c0306201 20000600 returned -14 13:47:32 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x7a, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:47:32 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x8008551d, &(0x7f0000000000)) [ 2454.561893] binder: release 26106:26112 transaction 3426 in, still active [ 2454.573531] binder: undelivered TRANSACTION_COMPLETE [ 2454.582670] binder: undelivered TRANSACTION_ERROR: 29189 13:47:32 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) pread64(r1, 0x0, 0x0, 0xffffffff00000000) r2 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000001100)={0x0}) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r3}}, 0x0) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) dup2(r4, r1) tkill(r2, 0x15) [ 2454.642752] binder: 26125:26126 ioctl c0306201 20000600 returned -14 13:47:32 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085546, &(0x7f0000000000)) 13:47:32 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x300, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:47:32 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) pread64(r1, 0x0, 0x0, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000001100)={0x0}) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r3}}, 0x0) munlock(&(0x7f0000ffe000/0x2000)=nil, 0x2000) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) dup2(r4, r1) tkill(r2, 0x15) [ 2454.765214] binder: release 26125:26126 transaction 3428 in, still active [ 2454.778677] binder: undelivered TRANSACTION_COMPLETE [ 2454.802035] binder: undelivered TRANSACTION_ERROR: 29189 [ 2454.859000] binder: 26136:26138 ioctl c0306201 20000600 returned -14 [ 2454.924605] binder: release 26136:26138 transaction 3430 in, still active [ 2454.942549] binder: undelivered TRANSACTION_COMPLETE [ 2454.965839] binder: undelivered TRANSACTION_ERROR: 29189 13:47:33 executing program 1: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-vsock\x00', 0x2, 0x0) clone(0x100002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = dup2(r2, r0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1e2ba62e) ioctl$BLKRRPART(r3, 0x125f, 0x0) write$FUSE_INTERRUPT(r3, &(0x7f00000000c0)={0x10, 0xfffffffffffffffe, 0x1}, 0x10) recvfrom(r1, 0x0, 0x0, 0x0, 0x0, 0x0) recvfrom(r2, &(0x7f0000000180)=""/184, 0xfffffffffffffd84, 0x40000000, 0x0, 0xfffffffffffffcc0) 13:47:33 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085564, &(0x7f0000000000)) 13:47:33 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x500, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) [ 2455.410534] binder: 26148:26150 ioctl c0306201 20000600 returned -14 13:47:33 executing program 4: signalfd4(0xffffffffffffffff, &(0x7f0000000ff8), 0x8, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000340), 0x10000014c) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1000000000000}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 13:47:33 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) pread64(r1, 0x0, 0x0, 0x0) r2 = gettid() r3 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000080)='/dev/snapshot\x00', 0x20000, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(r3, 0x40405515, &(0x7f0000000100)={0x7, 0x7, 0x6, 0x2f, '\x00', 0xffffffffffffffbe}) timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000001100)={0x0}) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r4}}, 0x0) r5 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) dup2(r5, r1) tkill(r2, 0x15) 13:47:33 executing program 2: socket$netlink(0x10, 0x3, 0x0) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='fdinfo/3\x00') exit(0x0) pread64(r0, 0x0, 0xf0ffffff7f0000, 0x3) 13:47:33 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x8010550e, &(0x7f0000000000)) 13:47:33 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x600, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) [ 2455.493764] binder: release 26148:26150 transaction 3432 in, still active [ 2455.508089] binder: undelivered TRANSACTION_COMPLETE [ 2455.527475] binder: undelivered TRANSACTION_ERROR: 29189 13:47:33 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x802c550a, &(0x7f0000000000)) [ 2455.581269] binder: 26160:26161 ioctl c0306201 20000600 returned -14 13:47:33 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x8038550a, &(0x7f0000000000)) 13:47:33 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x700, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:47:33 executing program 5: r0 = syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0x3, 0x2) ioctl$VIDIOC_TRY_FMT(r0, 0xc0d05640, &(0x7f0000000100)={0xb, @sdr={0x0, 0x5}}) r1 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r2 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) pread64(r2, 0x0, 0x0, 0x0) r3 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000001100)={0x0}) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r4}}, 0x0) r5 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) dup2(r5, r1) tkill(r3, 0x15) [ 2455.662924] binder: release 26160:26161 transaction 3434 in, still active [ 2455.677663] binder: undelivered TRANSACTION_COMPLETE [ 2455.698456] binder: undelivered TRANSACTION_ERROR: 29189 [ 2455.762836] binder: 26177:26180 ioctl c0306201 20000600 returned -14 [ 2455.810974] binder: release 26177:26180 transaction 3436 in, still active [ 2455.832716] binder: undelivered TRANSACTION_COMPLETE [ 2455.850640] binder: undelivered TRANSACTION_ERROR: 29189 13:47:34 executing program 1: pipe(&(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SNDRV_TIMER_IOCTL_GSTATUS(r1, 0xc0505405, &(0x7f00000002c0)={{0x3, 0x1, 0x9c2, 0x3, 0xc1c}, 0x2, 0x3, 0x4}) r2 = syz_open_dev$swradio(&(0x7f0000000140)='/dev/swradio#\x00', 0x0, 0x2) ioctl$SNDRV_TIMER_IOCTL_PAUSE(r2, 0x54a3) r3 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-vsock\x00', 0x2, 0x0) r4 = syz_open_dev$media(&(0x7f00000000c0)='/dev/media#\x00', 0x100000000, 0x3fffc) ioctl$PIO_CMAP(r4, 0x4b71, &(0x7f0000000100)={0x8, 0x6, 0x9, 0x8, 0x1000, 0x1d}) clone(0x100002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r8 = dup2(r6, r3) r9 = fcntl$getown(r4, 0x9) lstat(&(0x7f0000000640)='./file0\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000700)={0x0, 0x0, 0x0}, &(0x7f0000000740)=0xc) r12 = memfd_create(&(0x7f0000000840)='\x00', 0x4) ioctl$sock_FIOGETOWN(r4, 0x8903, &(0x7f0000000880)=0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f00000008c0)={{{@in=@loopback, @in6=@initdev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@remote}, 0x0, @in=@empty}}, &(0x7f00000009c0)=0xe8) lstat(&(0x7f0000000a00)='./file0\x00', &(0x7f0000000a40)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r16 = gettid() lstat(&(0x7f0000000ac0)='./file0\x00', &(0x7f0000000b00)={0x0, 0x0, 0x0, 0x0, 0x0}) lstat(&(0x7f0000000b80)='./file0\x00', &(0x7f0000000bc0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$sock_SIOCGPGRP(r5, 0x8904, &(0x7f0000001080)=0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(r1, 0x29, 0x22, &(0x7f00000010c0)={{{@in=@multicast1, @in6=@initdev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f00000011c0)=0xe8) getsockopt$sock_cred(r6, 0x1, 0x11, &(0x7f0000001200)={0x0, 0x0, 0x0}, &(0x7f0000001240)=0xc) sendmmsg$unix(r6, &(0x7f0000001440)=[{&(0x7f0000000500)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000600)=[{&(0x7f0000000580)="844151dff2787d792c87fcfbb82a1d14475024b595092fd3f95317a5f70fc07a495d4ded54bc0efa5db4cdd41fccdb8a7c2fa7419c8e3a52dd816d9d7de57fc64e9c6c7d15217e5250be4d372545ea4af5c6bac606077f06f70525b38b6399753ebef429b260b738fe0a379034be735f5ae6ed9f1dff42538ab92963af3af0", 0x7f}], 0x1, &(0x7f0000000c40)=[@cred={0x20, 0x1, 0x2, r9, r10, r11}, @rights={0x20, 0x1, 0x1, [r8, r12, r7, r8]}, @rights={0x18, 0x1, 0x1, [r0]}, @rights={0x30, 0x1, 0x1, [r6, r7, r3, r3, r8, r6, r3, r6]}, @rights={0x20, 0x1, 0x1, [r7, r1, r3, r1]}, @rights={0x38, 0x1, 0x1, [r7, r0, r6, r4, r8, r7, r7, r3, r5]}, @cred={0x20, 0x1, 0x2, r13, r14, r15}, @rights={0x18, 0x1, 0x1, [r5]}, @cred={0x20, 0x1, 0x2, r16, r17, r18}], 0x138, 0x4000080}, {&(0x7f0000000d80)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000001040)=[{&(0x7f0000000e00)="d4920c67ec1dbc72bafd676a3e532490a94a7794ca83c0e06106b8736fa903c681c45989aa8e6fa220e7bb2d505f0a4ea038fe7476a4180c1ba16924a9465dbf7ea69f9f92523d502bd4379c79e80fbbefcef425ab54fad6f99abd142cbf0c8ad0c7d1768ecdc5efca0eff53c5cba0476ac5c7931368253564f1c7041fa6301037f58ff4681c5e47266b8f2593b75672215dd0b0c5f824aef2e3b8a324d9823556c2b7224127286023837f0f3037651b8e98689caf4b69d39a", 0xb9}, {&(0x7f0000000ec0)="df13ba20c1d4fa2f506def7dfdd519a4ebf81818c1a79f7dc74ab5a27b3730a4e2cd4ae5660471b2de12dd7ec07014f4bc117c62d58e97ef56d2973d703ae74f1a28e6ecfa76a5a5dae280ff026b24c9369aa6e40dec370377ac9706d007eabb274d4d8145771e9761a60d3c1009485501aafbe148ef61d76e2a54be3e8c65d04fceb15a0dee6f24ba60ef0ed3d6686f2b294d55c5a3592b022cc77b0e1ffeeafc31210ec5275f28e41eb355bce73ada136f129643f92b80b17ee72dec8e2b61fb09a97151c90ae4b3ea894c19f440db1fe171ca0d788729", 0xd8}, {&(0x7f0000000fc0)}, {&(0x7f0000001000)="8c65272028db0c022e6bc5e77c575b176f83cf603669f07d3356ec2951192731bb092e16c06736b51b8fb59da689979e", 0x30}], 0x4, &(0x7f0000001280)=[@cred={0x20, 0x1, 0x2, r19, r20, r21}, @rights={0x18, 0x1, 0x1, [r5]}], 0x38, 0x4}, {&(0x7f00000012c0)=@abs={0x1, 0x0, 0x4e22}, 0x6e, &(0x7f0000001400)=[{&(0x7f0000001340)="c10742313aebd2eaee8a6756a298e9f91f01a53c9913b55889112491cecf7767891f73a12f2ea4c7ef27583ec69b2f103e0f422b04fa9f34907212367d0703d34216e221e7d10b4548bf9f8279768a3d3d21c2", 0x53}, {&(0x7f00000013c0)="bb2aaca4ff155b755aaa831735945b9d82d60f20210714a8bc7cc005584aa9503d8089ccf7a5ed8318e9217da0ef70ad171a7caff64de56fcc064d37db", 0x3d}], 0x2, 0x0, 0x0, 0x40000}], 0x3, 0x4) write$binfmt_misc(r5, &(0x7f0000000140)=ANY=[], 0x1e2ba62e) setsockopt$inet_opts(r4, 0x0, 0x9, &(0x7f00000003c0)="e339cd9a0642399159d945bea97614a0c3d8704b6c5c394e016d02acd285d08c04832e39a05f47de35b1067fbe6a32fd630ac267f5153087f835fb7b85945b3342fcb30ca25f00b9bf122522469258120d2e7f4a5944dbb9e5b3756710ef9ff3df4e73e1164f1d2efc07a11c39468d418061e1c2ac6c90410c4609d1040077685599afda23a4583d2e72bf13fb1d33adddfd9334f07d4d618d1128bd3ab90098bc7f6db2ac11fe06895689ccb12ab182d221ee3853e50a4f9b975787849ffc2e9e0bd483605f822e9385f58c", 0xcc) recvfrom(r4, 0x0, 0x0, 0x0, 0x0, 0x253) syz_open_dev$cec(&(0x7f0000000240)='/dev/cec#\x00', 0x3, 0x2) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r3, &(0x7f00000004c0)={0x10}) write$FUSE_INTERRUPT(r2, &(0x7f0000000340)={0x10, 0xfffffffffffffffe, 0x4}, 0x10) recvfrom(r6, &(0x7f0000000180)=""/184, 0xfffffffffffffd84, 0x10100, 0x0, 0xfffffffffffffd51) 13:47:34 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x8108551b, &(0x7f0000000000)) 13:47:34 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0xa00, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) [ 2456.318607] binder: 26185:26187 ioctl c0306201 20000600 returned -14 [ 2456.365763] binder: release 26185:26187 transaction 3438 in, still active [ 2456.379447] binder_send_failed_reply: 6 callbacks suppressed [ 2456.379458] binder: send failed reply for transaction 3438 to 26185:26187 [ 2456.415890] binder: undelivered TRANSACTION_COMPLETE [ 2456.430152] binder: undelivered TRANSACTION_ERROR: 29189 13:47:34 executing program 4: signalfd4(0xffffffffffffffff, &(0x7f0000000ff8), 0x8, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000340), 0x10000014c) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x10000000000000}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 13:47:34 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x2000, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:47:34 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0xc0045878, &(0x7f0000000000)) 13:47:34 executing program 2: socket$netlink(0x10, 0x3, 0x0) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='fdinfo/3\x00') exit(0x0) pread64(r0, 0x0, 0x300000000000000, 0x3) 13:47:34 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) pread64(r1, 0x0, 0x0, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)=0x0) clock_gettime(0x0, &(0x7f0000001100)={0x0}) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r4}}, 0x0) setsockopt$inet_tcp_buf(r1, 0x6, 0x1d, &(0x7f0000000100)="ab090b2d750031cbd80911887ac6cb1111491e73f99d89f9d5b19301a41a62d7ff7294bb17f42985dbdd75052b777fba5cdd2c37540c7cf252b17b418582562ad611380a5793277cd07f668eea5405077e0a6e56bdb51c15394e7618923f6f93601f96c89321063848b23b0c3f1ec4e82c69e0d443c0718c2306c90a3d3d13f1ce95338f1dc309429b8a94677f490e89a36fc7a2cda61ba3fecd2328ac05d8f3b6bef5003db0e4879aba332a77a7a98f7168654c15fdf3e528c610557688d3b7", 0xc0) r5 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) dup2(r5, r1) tkill(r2, 0x15) ioctl$sock_SIOCGPGRP(r5, 0x8904, &(0x7f0000000080)) timer_settime(r3, 0x1, &(0x7f00000001c0)={{0x0, 0x1c9c380}}, &(0x7f0000000200)) [ 2456.659970] binder: 26202:26203 ioctl c0306201 20000600 returned -14 13:47:34 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0xc0045878, &(0x7f0000000000)) 13:47:34 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x4000, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:47:34 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) pread64(r1, 0x0, 0x0, 0x0) r2 = syz_open_dev$vbi(&(0x7f0000000100)='/dev/vbi#\x00', 0x0, 0x2) setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, &(0x7f0000000140)={0xba, @broadcast, 0x4e23, 0x4, 'wrr\x00', 0x1, 0xff, 0x33}, 0x2c) r3 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000001100)={0x0}) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r4}}, 0x0) r5 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) dup2(r5, r1) tkill(r3, 0x15) ioctl$EVIOCSKEYCODE(r5, 0x40084504, &(0x7f0000000080)=[0x3ff, 0x6]) [ 2456.770303] binder: send failed reply for transaction 3440 to 26202:26203 [ 2456.858510] binder: 26215:26217 ioctl c0306201 20000600 returned -14 13:47:34 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0xc00c5512, &(0x7f0000000000)) [ 2456.998140] binder: send failed reply for transaction 3442 to 26215:26217 13:47:35 executing program 1: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-vsock\x00', 0x2, 0x0) clone(0xa0008400, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000100)=0x0) r4 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, r3, 0x0, 0xffffffffffffffff, 0x0) dup2(r2, r0) ioctl$CAPI_GET_FLAGS(r4, 0x80044323, &(0x7f00000000c0)) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1e2ba62e) recvfrom(r1, 0x0, 0x0, 0x0, 0x0, 0x0) recvfrom(r2, &(0x7f0000000180)=""/184, 0xfffffffffffffd84, 0x10100, 0x0, 0xfffffffffffffd51) 13:47:35 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) pread64(r1, 0x0, 0x0, 0x0) pipe2(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) getsockopt$inet_sctp6_SCTP_ASSOCINFO(0xffffffffffffff9c, 0x84, 0x1, &(0x7f0000000100)={0x0, 0x10000, 0x100, 0x6b, 0x6, 0x6}, &(0x7f0000000140)=0x14) setsockopt$inet_sctp_SCTP_CONTEXT(r2, 0x84, 0x11, &(0x7f0000000180)={r4, 0xfe00000000000}, 0x8) r5 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000001100)={0x0}) getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(r3, 0x84, 0x70, &(0x7f00000001c0)={r4, @in6={{0xa, 0x4e24, 0x9, @mcast1, 0x2}}, [0x5, 0x5, 0xff, 0x1c, 0x5, 0x8, 0x0, 0x7, 0x5076, 0x9, 0x9, 0x5, 0x800, 0x69, 0x4]}, &(0x7f00000002c0)=0x100) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r6}}, 0x0) r7 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) ioctl$EVIOCSABS0(r7, 0x401845c0, &(0x7f0000000300)={0x7, 0xfffffffffffffff9, 0x7fff, 0xffff, 0xfffffffffffffffe, 0x9}) dup2(r7, r1) tkill(r5, 0x7) 13:47:35 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x4800, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) [ 2457.521863] binder: 26229:26231 ioctl c0306201 20000600 returned -14 [ 2457.580205] binder: send failed reply for transaction 3444 to 26229:26231 13:47:35 executing program 4: signalfd4(0xffffffffffffffff, &(0x7f0000000ff8), 0x8, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000340), 0x10000014c) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x20000000000000}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 13:47:35 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0xc0105500, &(0x7f0000000000)) 13:47:35 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = fcntl$getown(r0, 0x9) ptrace$setsig(0x4203, r1, 0x4, &(0x7f0000000000)={0x36, 0xfffffffffffffffb, 0x1}) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='fdinfo/3\x00') exit(0x0) pread64(r2, 0x0, 0x0, 0x3) 13:47:35 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x4c00, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:47:35 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) pread64(r1, 0x0, 0x0, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000001100)={0x0}) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r3}}, 0x0) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) r5 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r5, &(0x7f0000000000)={0xa, 0x20000004e20}, 0x1c) connect$l2tp(r0, &(0x7f0000000180)=@pppol2tpin6={0x18, 0x1, {0x0, r4, 0x4, 0x0, 0x0, 0x0, {0xa, 0x4e20, 0x81, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}}, 0x32) openat$cgroup_subtree(r4, &(0x7f0000000100)='cgroup.subtree_control\x00', 0x2, 0x0) connect$inet6(r5, &(0x7f0000000080)={0xa, 0x0, 0x0, @dev, 0xb}, 0x1c) syz_emit_ethernet(0x437, &(0x7f0000000200)=ANY=[@ANYBLOB="aaaaaaaaaaaaffffffffffff86dd60c22df704011100fe800000000000000000000000000000fe8000000000000000000000000000aa00004e2004019078000087ae00ca83452b00b32def4f1142b6793bb530f9b20e90aa25d5c2b9431efd840a07c1922833b2c789aefbbaee9f63cbab38a8acfb8dba0595ecb683e74ea2bc44a7aee9c52e18ca01c06a5c354712b8b1ff75f45ba55a3487c83849023d37e037d2d3e3e842e9ba099e9ed8775d1173d8e78335aa65d58f54c1d78d4fce897cfefa24b7f268f90be76c7f4e1bfe4d84a869353e931c3732afea55697618a1318ecb657b34172b93fd59d7988d43630cf81e976a0ea01fd8b2547ab593bc605c985f56664b84ed3c9f90ffb666e030c794e2d2d5070af38d83dc275da88cfe6910b2ded59f6c418af5d247237eceb14857c1d7c3ee32e729d9793040117f0e76643797169fba3dac3f377d145ce97980ba626da7a279e698a9e040a22d63c535f0ee06adb59e9e06ad7295e6601f3a5fe9b581975993c6c775734212bccb26288d42a672c965d40e80d0e1908f04425a60a08241378ec7ff88315de073b64c5f9647e51732be34988e0948f12e6c560bedbecf811bca501d4389dbfe20e4df5160cd7324c0670c7b3e8980b061e31b1c8461d6f7a63f9e9fd24326924c076e01631a0b9703a6106accfaa064075fa1f16e16c5171b6a324e8642b2ab76618b824110c312ab12d9f65d6a980634a6a7cba8bf89e01a91259f446232476a1c490982636b78d1300befab1a2f6e8261e07336c5692db37bb7d3cebf4a942b62f2fa6cceb7e488aa02b2e52c6f82bd3792845fff41cce52e0469d14821ce11491864860c11421a92dae3152eb23106a0c679d2b1f0a9809b56abdcf893f9531508f24e64ec911fd8e8b3c8fd2291f1a7b910222c38533d4caadac9acd194be7e53549c1719bdf668887a0e19db83b5356f8f7d93cbef1ef3505dcc40d0d2a02a2745ab518979b9c3774babfe8e70ead767c7a00289b8cc6e51d1a957548270cb3f5064961a88f61b34f9442d78ae5a8551713f9afb4269d689f9adb6b4a902a637184f7f899efe9fa0ddb45cd1076c4eeeda51ca8dc20dcfc9cc5f56768073b3f4c2c9f543324a4fd0b8bc7b95e232bf222394fa4336ab4007d7ad2dc85afa6eb79ad2624c4be6c674ee98fce9a51786b7cc2b5044de114d36d2690e13bcedf96590c7d5aeb8040b74c4d6a5aa38a7c1f0857522f4f968795056b9a7034dc3444784f9486b575e44dec3216d72845500e63297d7197961e7e593ea3411001d1d47ba42d70e7af8e91246c02d7e37ff0eb60abebc37dd00315b4fbb09e77a6b5f7e8441818ebcfafecf622731f1db8a11fa2de8e30d808bedbfee104b3b1100f5094675521da07dd2a28be7e486b325a0f0e6d75116be1bbc2aa20deb64a6e4e7b824b12d009e6f1802f5a8e31559b125d71d00a5684fbde4668f5af1eb4ca04fa7c4ef4d2a194b0856e0070000000000000000000000000000"], &(0x7f0000001780)) syz_emit_ethernet(0x1, &(0x7f0000001140)=ANY=[@ANYBLOB="aaaaaaaaaaaaffffffffffff86dd60c22df704011100fe800000000000000000000000000000fe8000000000000000000000000000aadd864e2004019078000087ae00ca83452b00b32def4f1142b6793bb530f9b20e90aa25d5c2b9431efd840a07c1922833b2c789aefbbaee9f63cbab38a8acfb8dba0595ecb683e74ea2bc44a7aee9c52e18ca01c06a5c354712b8b1ff75f45ba55a3487c83849023d37e037d2d3e3e842e9ba099e9ed8775d1173d8e78335aa65d58f54c1d78d4fce897cfefa24b7f268f90be76c7f4e1bfe4d84a869353e931c3732afea55697618a1318ecb657b34172b93fd59d7988d43630cf80e976a0ea01fd8b2547ab593bc605c985f56664b84ed3c9f90ffb666e030c794e2d2d5070af38d83dc275da88cfe6910b2ded59f6c418af5d247237eceb14857c1d7c3ee32e729d9793040f8f4e432eb875a89fe9b31cbed117f0e76643797169fba3dac3f377d145ce97980ba626da7a279e698a9e040a22d63c535f0ee06adb59e9e06ad7295e6601f3a5fe9b581975993c6c775734212bd2d7ca5a1fbdd87c965d40e80d0e1908f04425a60a08241378ec7ff88315de073b64c5f9647e51732be34bb8e0948f12e6c560bedbece811bca501d4389dbfe20e4df5160cd7324c0670c7b3e8980b061e31b1c8461d6f7a63f9e9fd24326514c076e01631a0b9703a6106accfaa064075fa1f16e16c5171b6a324e8642b2ab76618b824110c312ab12d9f65d6a980634a6a7cba8bf89e01a91259f446232476a1c490982636b78d1300befab1a2f6e8261e07336c5692db37bb7d3cebf4a942b62f2fa6cceb7e488aa02b2e52c6f82bd3792845fff41cce52e0469d14821ce11491864860c11421a92dae3152eb23106a0c679d2b1f0a9809b56abdcf893f9531508f24e64ec911fd8e8b3c8fd2291f1a7b910222c38533d4caadac9acd194be7e53549c1719bdf668887a0e19db83b5356f8f7d93cbef1ef3505dcc40d0d2a02a2745ab518979b9c3774babfe8e70ead767c7a00289b8cc6e51d1a957548270cb3f5064961a88f61b34f9442d78ae5a8551713f9afb4269d689f9adb6b4a902a637184f7f899efe9fa0ddb45cd1076c4eeeda74ca8dc20dcfc9cc5f56768073b3f4c2c9f543324a4fd0b8bc7b95e232bf85bf222394fa4336ab4007d7ad2dc85afa6eb79ad262f4df15bc454c4be6c674ee98fce9a51786b7cc2b5044de114d36d2690e13bcedf96590c7d5aeb8040b74c4d6a5aa38a7c1f0857522f4f968795056b9a7034dc3444784f9486b575e44dec3216d72845500e63297d7197961e7e593ea3411001d1d47ba42d70e7af8e91246c02d7e37ff0eb60abebc37dd00315b4fbb09e77a6b5f7e8441818ebcfafecf622731f1db8a11fa2de8e30d808bedbfee104b3b1100f5094675521da07dd2a28be7e486b325a20deb64a6e4e7b824b12d009e6f1802f5a8e31559b125d71d00a5684fbde4668f5af1eb4ca04fa7c4ef4d2a194b0856e035982c07e1bb5e3e1f1a0bbb98f10c64d80ddb0757f6debf19444c70654027e76966d5c4e39090d7e019ca0260293eb03de6af51711a258a629934b662edd1c4d43d23182414e8c3296f11239af4758ab4d893e5b33875183b93b1dcd9fe5b70071976fe1d338cc36047d2401c1bbb029cdc404fe641a929aa5a84400d6394813f4075474c7c14923458a46fbda2c7dba44920064dd1bc57195815006182a03944c2900d98f3cdcedb6b66bada41fe14dcfd1573e9f2828e9550cbaac4075f9c16b8bb05e7ceb16347c1be68df943d5d3d82dd1279f88e3ff2c09edf4e7d307bb01eed07bd1654d418df8c898369daef9977a5e00c8457460155037a066c6974cbf185a002d8bf66459a86901c10544e422120e19d921d6aeb9bd40bd5e64d781cc9b5d2ca418d72c9c1bcdedcdc4590ef65c518796d8d9ffe3f892f4a5cfa76643fd95de232d728d158d00fcde4041244b8f4dc3874a3e686ce1610ca8a788439c93d9455585187224b5f63056f692537ef0a00bbf4bd8af96e4b33908823a348d3ee34583342874d4b12b642b04b329ecc4a1958072541a07fefa60d238ca3992bfb67405700d3407c4dab441babb8"], &(0x7f0000000140)={0x0, 0x0, [0xffffffffffffffff, 0x4d6]}) r6 = dup2(r4, r1) ioctl$PERF_EVENT_IOC_REFRESH(r6, 0x2402, 0x5) mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x3000008, 0x12, r6, 0x0) tkill(r2, 0x15) [ 2457.714439] binder: 26240:26241 ioctl c0306201 20000600 returned -14 13:47:35 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0xc0105502, &(0x7f0000000000)) [ 2457.769702] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. 13:47:35 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x6000, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) [ 2457.823821] binder: send failed reply for transaction 3446 to 26240:26241 13:47:35 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) getsockopt$inet_sctp_SCTP_AUTOCLOSE(r1, 0x84, 0x4, &(0x7f0000000080), &(0x7f0000000100)=0x4) r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x7, 0x0) bind$bt_l2cap(r2, &(0x7f0000000280)={0x1f, 0x3c, {0x7, 0x3, 0x3, 0xffff, 0x1, 0xfffffffffffffffe}, 0x401, 0x6}, 0xe) pread64(r1, 0x0, 0x0, 0x0) r3 = gettid() r4 = semget(0x3, 0x2, 0x20) semctl$GETVAL(r4, 0x0, 0xc, &(0x7f0000000180)=""/234) timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000001100)={0x0}) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r5}}, 0x0) r6 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) connect$tipc(r6, &(0x7f0000000140)=@id={0x1e, 0x3, 0x3, {0x4e22, 0x2}}, 0x10) dup2(r6, r1) tkill(r3, 0x21) 13:47:35 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0xc0105512, &(0x7f0000000000)) [ 2457.923965] binder: 26260:26261 ioctl c0306201 20000600 returned -14 [ 2458.056690] binder: send failed reply for transaction 3448 to 26260:26261 13:47:36 executing program 1: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vhost-vsock\x00', 0x2, 0x0) r1 = openat$vsock(0xffffffffffffff9c, &(0x7f0000001880)='/dev/vsock\x00', 0x0, 0x0) sendmsg(r1, &(0x7f00000031c0)={&(0x7f00000018c0)=@nfc_llcp={0x27, 0x0, 0x2, 0x2, 0x3, 0x3, "b18b8ba3074276d41cd0bae10f1ea4ca5b547ff87e83bc74f10063df5f9479790c4b726066381974f7e178daca7c56f344136fd26693cad91a46442b056ce3", 0x11}, 0x80, &(0x7f0000001e40)=[{&(0x7f0000001940)="73157a5c2cf23f0a55722e005c42a53f0cde06aa5488808a7d40aff437e2fc1a8226ecffbb3ac3222aae734c524678f416cfa52c3f0553ea034fdfa9ce346accab916f1d2f5cd8e08056be8a50fe86b20b937002d3d5e335c05409f6906ede8086b0fd4f257236527cfbdde8f0595bba273760ecd76df75dd21b18f9f8107eff49804e47ea43a8647ec5d783879e177d18fcdc8af0ac4aea2ae2f7d5635bdb8daf11f272967a55794f5c8209e78ea14bffdca24ab3f59141b01b34dbe009c40c59376708725d51b330c83c1af8cf5e2ef44bb0de960c547ac82028ac2783641959a1a5fbc38ab71b8e9e6560d74d0569f3af57d2802a365a", 0xf8}, {&(0x7f0000001a40)="379f0f22d9e5c6a57bf72197eafa3a9ddefa33d5b1f88971f0b6d7755640e9cecb833352c66114f3ae67d04986e2c8eaff31b76cc91128147018a55c41c31a1f20636dc228eb63b414f845538ac51bf9dfd2a8f42a8a20848748caa0b4cb8787817f112338cb27bc978754a9b293ec80073fc067b953922c5cf3662b1ab750c6fbee3e4e192724e90017a1486c3079bbe29ddc3fb8135040274f6a8d95328be27f1d105891c7e814a73e0eac37bd6b57d6fe463b03f3601553f4", 0xba}, {&(0x7f0000001b00)="ca256803047be0919be67deb24af416b62b4f40e447a3f683a3bc539463e24bb993b0848e08c3ac6bed94c93a2ca8559fb1150efc9221deb7e211a53e50dc3dd17cb400f00516417db0851f9a2ba971f54e69ed90c2101029f554f08ada9ac228d017d14b317038f9308a816bb122cf54fbe6d8a407533b6a5c1a8", 0x7b}, {&(0x7f0000001b80)="1cbbe7490003742998e4a4dca46b635cb8cb1329aee9f97eb30654f0d0986ec17dc2d0665b0308dfa06840057db17a88d5f527fa87e4c424512f17d2d2102008de27f243e0b7ea3cdae9df4091e796b68955c92a9c1941663265e9cc5029066a8c4cbc0f23891608a8eb49826d6f83274b0eeb", 0x73}, {&(0x7f0000001c00)="7ea4c2642538ebe77c21446d8bc661e745ddc6c2b4f0af3ac52be4d776a70e585c5f3508c9fbd254581c0d13867aadec1fc3", 0x32}, {&(0x7f0000001c40)="8882af7deea2a38071bf90e6f70952c29a633d3fedb5b03bf3e6b34aa5afccfd7194b0cd3b86123999d5289da29d63f47e5204ee34fc483b89c17ee3d02e5b3a065dc265fe5cdceaca1c75e31245f8db43e63e220f8df415776a940ea48e8c584bbc6cf7e08eaa594caad8517a928c93fcae24959ab7ae5cce614df91b5799cdf96cc8b905ac78fc6d455536de9199f1b1f53488efde16dff5c60a1716ebb2430a8139e1698fc1efdc43116f5605eb12f4b0a98cf2f74d6fe84b0086048f1dc99ee1496e59f55268b5eef5310b32330ccd09b63924dc179573729544a1dc8e8ce1d0733b26d3d8590c", 0xe9}, {&(0x7f0000001d40)="ac961a54e04ca2a1f0469c283ca3fc96ab785c2cb3fbeaf5a1883d8c425d4bc85e7b8dd929afd21a0b83d42e62f0dca03f89d13bd642a14bec24721b93cae5f986a8a22c12c4894328b65138a29cd9a37d34384a716977b42f9f5efc2f9706f922396896ff40a3018ab9f618f313fd021dd803d128d68908a8698805666634b62b900dae729ea279babda5769a5baa29b5926e95e4f551de2dba0b94faa76d6ffb1ef6ee1d0119", 0xa7}, {&(0x7f0000001e00)="3a797a82f96d3a6d24a199c8b146b4e42dd44c7f06804bcc9073ec77a9acfd25760af0e0b83b083b", 0x28}], 0x8, &(0x7f0000001ec0)=[{0x1010, 0x84, 0x5, "457e3a0be30e9a364f0bec1bc5b9c3b8f7d4d2737338897e843e0f1903111d5836ba95d1f3605ff1f07b1a4ec61b39c4b8dc8296765ae5c7e3592a460fc7c456e563c91162297cdc025582ee444cafcc7353714ac40f479833fa65196fc545956e8163a4ae0926bebec3905ab0387c7a0fc3c0495d93dc4d8ab428002df946fbf938d985fd331dc5c293c24325d9aa1bb6c973ac23f019afbd92a32d3a67d783f9f50c6f9b9d34651676bd58a47cec19b1da66f78e7e42236cdd00cdf73f4bc2f84cc71986ece8e9e485da75f59556798b3e9d5659fd4cdf6717cd42120496f0650bb233486788d8eac0d3a8faa43fe18eab0ed724db2f586e893ba87fc3b4c83232cd94cea677dbf4aebdf31ad9d86bcb61d6d3d9dc7a63f054b7641833fe19efd5666b65242ebd07731d25f9f8d7286f4ca54815fde198d35a0adb3ea35f4b340fe26ea86a0b8f54d55077b6f812c5dce9f2e6db000bc64b5b4bd457fa3ba5fd7f85a5569219fed257d67caee337dada105df23090d999fae59768b3bd061d22bc59db9e3ddf7fee7afac428699c4391a5b136b1b12f08bb641bffcf6836f5e4154500854c9febc9c915785c9c57b424397eddab72e0d6b0029b2f743846d11338830924a043cb679594510699db25667680ff63f7565f9e14243971242c5d72ad7806ec593ef0e1f1d1c45b051893f283e4b604713d11e092295cad600b7498b93c1b85977ad1d12947e11f191e5ff2e7c43c2ab39bc8ba2268c988148145dac780cdc2f6dd94d4567cf2de93b6f7862a438a0dffede004bb584afa4678dea8ba1835bb01758b45d07f81e62e8317863c4a8c365fca1f9599945beed4ca584316f5d5f476365ad13776118d1bb3327ad0f3f8dedf119d3ce271d98ecc3b6e9470e150538f82c91514335d84ed81bffaa553d0368405c3d818c00a8bedc081a65ab7135f2e8e315d3d52604c7f34a948565f0a0fcde5d3e52fe2843ea132c63588dd2de6d1319f99415c4b68f0b25695d481e09c00edcd808f95c14a4c94d55d3ffb7e3381bc19f260574a121b40e327e55a9bf70608fb82841f0b2b33891288fff37f5439d654879eebced9997abc4efeb1ca9ac8bae6afd1f73e206bdc17acba014b29129d804e95975d5edf8e0c84781dd9ca0ed545aba2998ff774831c03395e8cf195d7d7a1d86453ef3a28068ab6923c11eb5ae3158179fe449af7b54a54d11932ae3abfcd528cae35c63f95b91aeaceb16fd927af899b8f458c34a307e03c581d0c9d18115a086ad266f4abba39b8f64e352855231ff07200e339b5cfdc13fc3b41135998289076029eb29c6a984192136af4d98da911a95a87253229cefbb59c29cbb82abcab9168767b0dd6937b0ebdc06a2b8430a910096f0ed513eeaf201d7c7fdc487a54be2be68f267a0e75ad2f6289787d0e6027b3481124f86ce6dfe897f1d2c597fd7ba883e8ad4b07dc9ef2340f875623ce5f061f6b8ef5d207d66bde94217b4423fdd8fc90438d2cb9654280723b9473ce09818a3c01bafc7f0a3208ffb7377d66f5950f08769fe7ef63fd2fa6b86aca3412b4faaec0c0c6d218d38cbd2b0d5c62981863f9ea9d0f91fbccce77f4e1351b14c2b60c1a5d39e7acc48f03ad7d2c7b7a22fb83bbce4a6a49580beda1d46aa402b14a449c65d26f74f8c4c06d25a3a1d6a084fbc0f21a69495b0561a8f22d847e4bccf7f6b3606e360849c5c61103ba9fc40eba9f021cc7d995aec6089a9b953a5da3e4107db8e4ce9e3f8a7f40b88e2efd8b2f087a66bfe6a4223f58f40984dfabeb6736813121d5dcbe94e7b5d06eaca7e7f2597b5876f5acce6ad701a71c3b1ddb491e362934c37023d3a9c8b36e3650b976006377b2a4d659ac14b111056d4a6cd1ed8289abece6ff99649cecbee025c16e63e6149776103b04813b568892281e2191759367449cd3832e5656990dac2fb7fdbe72916de08e726dfd049a8203f47ba6a49e5abb0e6a4fc589789379f351c390937a13b2bb9ad5af5017bb72eea61787f42cd65cdf2fe38e7938bd943dd951cf52f80f815f52a7d5ee9ea1e571983a4514c3339cf896c42efa7fdbba448b62b0109e2f20a6e171754fad93ff2bf9b1c1803f74e5e632c7d862a30668a0514e9e4935ae3304c694ae9f312a8f113741fee58e62fa27b87cd8818580867e5d88d2cfc3c43540d0972190c779c934cc191b28760d131f78869493ad3985b198e820b1b137f183da4f58da72c378a65e8f89ef1297d0215635f48e05cf3053da934cfcf837db4f6f781773fc13712836e666d0cdf4800d020dc91939d2311511cc6d9852315978ac5ad95224b6a02d17beacd0c649fc4b74b0eeb12002727e933809d25d039d3c80a5e3385782140430527d8d128545bbba510c2cb60c5182f71cb76ee48fd48b86e74e59ae4a728fec9912952510e30d1d7eb5325137b9496b82d754a6be006a6f8aa56416949e7150a6bfeaf84af3b0a98fefa1cb27b6fbafb47f0cea88ccf0d3d49b4207a6b8b2e5eeb471b9aaa7f7c534ba514107cb140cf733194ed7beff89606e050503cb5375543c323df9cd7f0696a9254b673ed7ee6b1c37ef50a2c1e580213029e7962896a865d89680d5310d5a901069a0c103d5670aefaff93cf361ae2afd13e57a1cbb10157d1dce1399e4572de7e1a8bb581b9061be46c2a14e78d90f713674ef0c5f2f0396cc15a17c4c56228dc05b065aa3182124826b1f55f8886100b68e4cdf5081ba927e4aea9cd5e541d0f738a7d67294399225899580bf3c8d63b5483570a388924ad6292ca70eb43ea4f2bbf6a146ea58852692f172808a7cb9ccd33aaec4112676ae62cd6ab934141ef88f87ef34e13939fdaa068e8558df065d3e165c1236a9ace34667fcd3624dd3009be39104b441ac813a09f99f9a2359f22779634e510cf64cebcf54c4b85bede0c04856b52665da615d9faef07be656b94b923889b0eb5bacd537d588bde2c4369188e87735f29b86c9849cc6bbfac13bf8b2f844d44c9852a920f46f392faf7e9a64d8a48ddfd842530fe43106e7f561abdc877236b8d8cc59e119d50c6dbcaabb2688f57fe1b4cebe987ccca4309450390165ea2d0834bb538c768aec1767d0e7e127739c7db3ca599a5915ed583de46861debcd9640686a596978e8955c636e75e463d1020e47c2fa2d901e806635a93e90e60f3ba1ece23de65236f3b9dbb3f52cee6cde4847a4b9e4d109d6d6ca00c94b841b26e4cbf4365c0e092859613afc00d79caa58e3bb7d2ede421bbfc1e722ad02b164a66bd6547277754cc7490ac70e4e526a6b2b54c563ede6a1c71817e3199fc74105d25550e493edf1db17d6f4642ed08bcd6e379c50aa92300e96aee446dd62ba6ab452ec049d0810d3bc9060cbeef77ed9b7010a9a955de3f35b249edda2de0c01dd20fd2157bda2c325da083caf38e6da8286f1bc799f63c97a341e4bd315b577734a4efa6d75cb59a35123cd7ccf41db72df846ed25b4ea2a4c4a049c37881a9b82ddf27fb042d43ae69fc17c6e1e98aac927f30e719dfb8c3b25f3bd7640a7ecf91eacee2f2475c7be61ee8d2781183c8aed78d6ee856ff22b081fa24fa16062cf64e87333526e64a448e3074c7a4493d554c425fd6df53bdf481f63960b147cb8685fe1a223c6aeb8151471ba839b71f9aed7c8b2f30d9948cb5b35f50b9c541482b71073f3881401096e667a36ae0e082be493a21de57aef93cb597997b4a01d4b75996cf7f700854e80492217d828e64f275fe4f3da006242695b10fb6d3a8640646d62b0cb20f6faa0a20092bb227b71bec2906130e57eefd80c7bdee91a7d5f44a3857cbb73292c2a5bf223f6de40b840b662d21df092e70a80ac198d6f614decb527556368c5b023a92a17605cee91c22486983835e5c22633b227f66404ab40c81bdf59a54762aee93c57f475ab929b799360b9c600c0c6d8ba30b5d38f166403c306ec3fda0d2f923ecd552bbb6abdfd618b8f52cd0526a0e0b081cb386cec52af53342b223d8e5c74b6ef90ab5a4160c9a9862041a124746574a26994d814fb37ed90c9d99a9a4102d99016a0b2d0c7aee15f292196c1af18e8826d516eecc42528b3f929afa145231f26f058ef395abb28f31673af1eab5f6c7e958d2e779fb3b1686bacd3264f81b6ae2287dc7f43d77e224d9f27939d1611efe07889bbfca1ae13ad54c432c51537b5cd93436aedc7856526626d99018699cf3c0c010110376f0de6f79fa5faf79ab4fe800af74193678b16b2b28a5089ea35326cc0a63dfeb2cb95d6698d19c220cf1fd31f72dabf5876fde72b1fdf4493ce29199a3872d548faeed83d9793cdd8e8e2cbd60489b7ad31398adeaa671a5968d709aee96e4035c576f28e8294be785a4af22c7b5ef0aadf705116fa049d1ba3e9af584971853f7144822f2e4cf67db12c570dae0280a7e0bcd1f83de9e3633b5f7b892603191c450471059d0e2a5d7c58c21593e9321b63934149133750379bde59b7d0dc7d81d6ab2c8821d82ffbdd774365f62993c14ab03708081b5b1e0bc3a53eedf336609324570d8e0ed3c520f80c5c1d5d1a87280241201dab5dc9d8d21909dcd7e5bf86eb74e2b6bc195ec1b58b3360e6041270702961fbb6f665d43b3ee4785af25f87811153548be2450cb0a42a82379e2e974985ae7508f8ac3a4c7f18c2f8567bcb9f2a128612033a720fe25a519b45f3398dd5e3bd44ac5a474930b88b2cdf1b16f6e9ae87d47e7bb55668cbd26f07796bab3918c234bcb5dd5ef533f5963d4a5026d300ff375c92914e7b4ad1dcd23e0672044907e97cab514143bc1072096ce7bac9008b7cb6388ef7c93886878ea96e130a98a57ebeab28b5c4ae68433c674786d0cfa688ee40c847399a189a8603a2174d50fc864dd264714f57602e17248a244bd1490af5eb35ac7675059bd4968ab5bb19bda6f756327166f9214285ce8052b2e36640ca83ba30c2526397ffd9d5f99a938e162897f44fe303d314976d7e1d434fb07c6da5885b18be274fd815ac26a9a5f06b9dd226843a5f2724e5b1dcec0db8748a40ae7ace8fe905897ebca12d0dc4130dabd2767e10e46b880b53d9302d7bdeb4de6158c75328fa1f936a31c9a874fe11beb4ae21170e08d121d20f4115c73285558bd4b07e680eb5efb3483752f3df43cb2bbbabe9b4bda725cd2cdfaf9cdcd4c1648e1d174846c8203aa572997367a6d51f0f97a6b3a7c7bd541f60a18c2d63f719f51be13f0c58ed1cd8999dcbd443a49129789f820c9ddaf74824477c9cf304feffbc7ffe5ae1d5f7e05c1c89bb2c6e314bb0359c781fb71a9bfbba5827e70473aef487fae2535ee961c19cc61ab678666113e8932fe119d5850181bc6cbe11060f37b5d92c66d5e21eb5254c6b0c9b79682d9a05b15eb06c3a033437b3c430bdcb32e157bd41ac0eb41e0d2b64d154198193d76cc1eb4904a71610c4802c6c6c8702b271ca709b7bc303922832d519b39c97accb82ed7f1aec431cfc00e156cb65524c9a45a700b91c94f08acf2a3190d853c940606430bb537249d905e37e3d3a9e053a50029a5f5b02c36de1882f09adbed5a37425e437308f202047e6218b7677627923ae402800597964c1e918d478eb4fd6d64aa23d43ab999c0330d535dfa5c2715fdedbe06a4c6d4f66189e554043788f71634dbdb2a95da7057265fc2815e9bc2407c8262da5945fd7e6932d2872a3ef3d1fbba56f3191424e08f741ad9aae002eb5e4bbedd2527e43b9907678"}, {0x80, 0x1, 0x2, "876f5760f8d025dea29fa085f53a22f51cf1deaa1a622f312b029a420f2c606702736b2f550f4a43e63b04c1c41efe42aa9edaa9c460bb6b05858561dd1999075243a59f7aa20fb456d41b5b022c4195e80d679eb47c509fb273be2b59dda6294d651410d9ab5f673d"}, {0x70, 0x29, 0x0, "e7b0b5f5bc4b8270c35b557490897ea121c0ea88d101e6d0c307901500d9041f32069bd0ad8d866b4a4581506a1520abe91774ed85f6535d8bc5fdeb75959e79e0ce5b91e0c95a801985ab08bf1ae94a24287d2c73588bbe58919ef32f"}, {0xf8, 0x13b, 0x200, "5ce887cf32c1c3ceff89490ab2b0482a3b933e0cfd6685f29a21b94c1dba9e08ad2ce0354fee7147b89033f75ee9f7dd3a6abc22f2439bc59243805b7b1bbf57a09036dd4e44d9e21ec957b62c0e56f82b70eefc2d1d2ae495b62232d7151c1d9649207ffe165decafd498714432eb5b43fbcfbe53be4f4019e2cfa9b90733cbc83d3075cc9bd1985b7faf31f76fb46a390efbb455b136692a5a3f36d4feba13e3c8e9f924b68a541d3df86ebd4de05ed7197722b2b0763b73861f7ecd69bd42227c581cd6040189d20022f928cb134afe9de55ba0f0d61ba84c404e37b4c2bc80"}, {0xf8, 0x105, 0x101, "03aa83b3e4070b8287cad353322beb49fb00e43cc8ce824f6c64ab6f6608ebf748ec3fc50a5d410033f3aadca2787498e088faeb687f3ed8a900975b277ac67bbe7d997ae818794e84b507109df8d3ac87cf4c459aed1419caf8b500c2ba596918a023887dcd36ca3d252a6c0f473cfaa66a2e119d9ba2803f7b2622254251d13306cb01d9841c72fe41cfee63273327874c7576bb4a65562daa1e47113fc17249598d2806ea334d66ab46ecfa8ab1da3491b2c4979a75fe27c1e08c78749d2572d8bf7e32e10a9398ff5f4fb5d8a8fef443aebd777021c9655750f0de833a7652e9c4bf6e"}], 0x12f0}, 0x20000014) clone(0x100002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r0) setsockopt$EBT_SO_SET_COUNTERS(r1, 0x0, 0x81, &(0x7f0000000240)={'nat\x00', 0x0, 0x0, 0x0, [], 0x2, &(0x7f00000000c0)=[{}, {}, {}, {}, {}, {}], 0x0, [{}, {}]}, 0x98) write$binfmt_misc(r2, &(0x7f0000000140)=ANY=[], 0x1e2ba62e) recvfrom(r2, 0x0, 0x0, 0x0, 0x0, 0x0) recvfrom(r3, &(0x7f0000000180)=""/184, 0xfffffffffffffd84, 0x10100, 0x0, 0xfffffffffffffd51) 13:47:36 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000000)) 13:47:36 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x60ff, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) [ 2458.544647] binder: 26273:26275 ioctl c0306201 20000600 returned -14 [ 2458.554037] vhci_hcd: default hub control req: 0000 v0000 i0000 l0 [ 2458.618272] binder_thread_release: 5 callbacks suppressed [ 2458.618285] binder: release 26273:26275 transaction 3450 in, still active [ 2458.639431] binder: send failed reply for transaction 3450 to 26273:26275 [ 2458.650390] binder_release_work: 5 callbacks suppressed [ 2458.650396] binder: undelivered TRANSACTION_COMPLETE [ 2458.656590] binder_release_work: 5 callbacks suppressed [ 2458.656597] binder: undelivered TRANSACTION_ERROR: 29189 13:47:36 executing program 4: signalfd4(0xffffffffffffffff, &(0x7f0000000ff8), 0x8, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000340), 0x10000014c) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0xd0070000000000}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 13:47:36 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='fdinfo/3\x00') bind$netlink(r0, &(0x7f0000000000)={0x10, 0x0, 0x25dfdbff, 0x20000}, 0xc) exit(0x4) pread64(r1, 0x0, 0x0, 0x3) 13:47:36 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x6800, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:47:36 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185502, &(0x7f0000000000)) [ 2458.776290] binder: 26286:26290 ioctl c0306201 20000600 returned -14 13:47:36 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0xc0189436, &(0x7f0000000000)) 13:47:36 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x6c00, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) [ 2458.856399] binder: release 26286:26290 transaction 3452 in, still active [ 2458.868823] binder: send failed reply for transaction 3452 to 26286:26290 13:47:36 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$null(0xffffffffffffff9c, &(0x7f0000000080)='/dev/null\x00', 0x400000, 0x0) ioctl$UI_DEV_CREATE(r1, 0x5501) r2 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) pread64(r2, 0x0, 0x0, 0x0) r3 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000001100)={0x0}) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r4}}, 0x0) r5 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) dup2(r5, r2) tkill(r3, 0x15) [ 2458.911202] binder: undelivered TRANSACTION_COMPLETE 13:47:37 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0xc020660b, &(0x7f0000000000)) [ 2458.936003] binder: undelivered TRANSACTION_ERROR: 29189 [ 2458.964442] binder: 26302:26303 ioctl c0306201 20000600 returned -14 13:47:37 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x7400, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) [ 2459.074062] binder: release 26302:26303 transaction 3454 in, still active [ 2459.090048] binder: send failed reply for transaction 3454 to 26302:26303 [ 2459.122596] binder: undelivered TRANSACTION_COMPLETE [ 2459.143967] binder: undelivered TRANSACTION_ERROR: 29189 [ 2459.178712] binder: 26311:26312 ioctl c0306201 20000600 returned -14 [ 2459.245118] binder: release 26311:26312 transaction 3456 in, still active [ 2459.255611] binder: send failed reply for transaction 3456 to 26311:26312 [ 2459.282997] binder: undelivered TRANSACTION_COMPLETE [ 2459.297347] binder: undelivered TRANSACTION_ERROR: 29189 13:47:37 executing program 1: clone(0x100002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) lstat(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0}) ioprio_get$uid(0x3, r2) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) dup2(r1, 0xffffffffffffffff) write$binfmt_misc(r0, &(0x7f0000000140)=ANY=[], 0x1e2ba62e) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) recvfrom(r0, 0x0, 0x0, 0x0, 0x0, 0x0) recvfrom(r1, &(0x7f0000000180)=""/184, 0xfffffffffffffd84, 0x10100, 0x0, 0xfffffffffffffd51) 13:47:37 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) pread64(r1, 0x0, 0x0, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000001100)={0x0}) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x300000a, 0x8113, r1, 0x0) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r3}}, 0x0) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) dup2(r4, r1) tkill(r2, 0x15) 13:47:37 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x2}) 13:47:37 executing program 4: signalfd4(0xffffffffffffffff, &(0x7f0000000ff8), 0x8, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000340), 0x10000014c) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x100000000000000}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 13:47:37 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x7a00, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:47:37 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x3}) 13:47:37 executing program 2: socket$netlink(0x10, 0x3, 0x0) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='fdinfo/3\x00') setsockopt$netrom_NETROM_N2(r0, 0x103, 0x3, &(0x7f0000000000)=0x2ae, 0x4) exit(0x0) pread64(r0, 0x0, 0xfffffd4c, 0x4) 13:47:37 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) pread64(r1, 0x0, 0x0, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_gettime(0x100, &(0x7f0000000080)={0x0}) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r3}}, 0x0) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) dup2(r4, r1) tkill(r2, 0x15) 13:47:37 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x4}) [ 2459.846518] binder: 26335:26339 ioctl c0306201 20000600 returned -14 13:47:37 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x9400, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:47:38 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x5}) [ 2459.950356] binder: release 26335:26339 transaction 3458 in, still active [ 2459.963435] binder: undelivered TRANSACTION_COMPLETE [ 2459.989258] binder: undelivered TRANSACTION_ERROR: 29189 [ 2460.035759] binder: 26349:26350 ioctl c0306201 20000600 returned -14 13:47:38 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x307100, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) [ 2460.116197] binder: release 26349:26350 transaction 3460 in, still active [ 2460.131008] binder: undelivered TRANSACTION_COMPLETE [ 2460.161686] binder: undelivered TRANSACTION_ERROR: 29189 [ 2460.190925] binder: 26354:26355 ioctl c0306201 20000600 returned -14 [ 2460.296890] binder: release 26354:26355 transaction 3462 in, still active [ 2460.313255] binder: undelivered TRANSACTION_COMPLETE [ 2460.333233] binder: undelivered TRANSACTION_ERROR: 29189 13:47:38 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x6}) 13:47:38 executing program 1: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-vsock\x00', 0x2, 0x0) clone(0x100002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = dup2(r2, r0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1e2ba62e) recvfrom(r1, 0x0, 0x0, 0x0, 0x0, 0x0) recvfrom(r2, &(0x7f0000000180)=""/184, 0xfffffffffffffd84, 0x10100, 0x0, 0xfffffffffffffd51) ioctl$TIOCGSID(r3, 0x5429, &(0x7f0000000240)=0x0) ptrace$PTRACE_SECCOMP_GET_FILTER(0x420c, r4, 0x9d2d, &(0x7f0000000100)=""/99) 13:47:38 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x400000, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) [ 2460.555939] binder: 26361:26364 ioctl c0306201 20000600 returned -14 [ 2460.606401] binder: release 26361:26364 transaction 3464 in, still active [ 2460.617773] binder: undelivered TRANSACTION_COMPLETE [ 2460.654042] binder: undelivered TRANSACTION_ERROR: 29189 13:47:38 executing program 4: signalfd4(0xffffffffffffffff, &(0x7f0000000ff8), 0x8, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000340), 0x10000014c) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x200000000000000}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 13:47:38 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x7}) 13:47:38 executing program 1: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-vsock\x00', 0x2, 0x0) clone(0x100002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = dup2(r2, r0) write$binfmt_misc(r1, &(0x7f0000000440)=ANY=[], 0x3c1) recvfrom(r3, 0x0, 0xffffffaa, 0x20, 0x0, 0x0) recvfrom(r2, &(0x7f0000000180)=""/184, 0xfffffffffffffd84, 0x10100, 0x0, 0xfffffffffffffd51) 13:47:38 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x50a000, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) [ 2460.879325] binder: 26374:26378 ioctl c0306201 20000600 returned -14 [ 2460.922378] binder: release 26374:26378 transaction 3466 in, still active [ 2460.935091] binder: undelivered TRANSACTION_COMPLETE [ 2460.946740] binder: undelivered TRANSACTION_ERROR: 29189 13:47:40 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) pread64(r1, 0x0, 0x0, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) r3 = syz_open_dev$adsp(&(0x7f0000000080)='/dev/adsp#\x00', 0x3, 0x200000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r4, &(0x7f0000001a40)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000200000000002000900400000000003000600000200000200ee00e0000054d81458186fe8b90002000100000000000000020200043a6efc2105000000000002000000e0003f010000000000fca0d9"], 0x60}}, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) clock_gettime(0x6, &(0x7f0000000140)) write$P9_RGETLOCK(r3, &(0x7f0000000100)={0x2d, 0x37, 0x1, {0x3, 0x1, 0xffffffff, r2, 0xf, '/dev/dri/card#\x00'}}, 0x2d) clock_gettime(0x0, &(0x7f0000001100)={0x0}) write$P9_RREADDIR(r3, &(0x7f00000001c0)={0x2a, 0x29, 0x2, {0x3, [{{0x8, 0x2, 0x2}, 0x4, 0x6, 0x7, './file0'}]}}, 0x2a) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r5}}, 0x0) r6 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) dup2(r6, r1) tkill(r2, 0x15) 13:47:40 executing program 2: socket$netlink(0x10, 0x3, 0x0) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='fdinfo/3\x00') exit(0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x100, 0x0) pread64(r0, 0x0, 0x0, 0x3) 13:47:40 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x8}) 13:47:40 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x70a000, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:47:40 executing program 1: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-vsock\x00', 0x2, 0x0) clone(0x100002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = accept$ax25(0xffffffffffffff9c, &(0x7f00000000c0)={{0x3, @null}, [@rose, @default, @netrom, @rose, @default, @null, @rose]}, &(0x7f0000000140)=0x48) sendto$ax25(r1, &(0x7f0000000240)="fb81fa3bd6012af0aae57e8b70273d47620cbe3d76dd305efad013528338b36c0976a67db929cf49339c8481ade8db891dee47cb7f8be64c8e2aba2d6bfc0fb028594c", 0x43, 0x4008044, &(0x7f00000002c0)={{0x3, @bcast, 0x8}, [@default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}]}, 0x48) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r0) write$binfmt_misc(r2, &(0x7f0000000140)=ANY=[], 0x1e2ba62e) pipe2(&(0x7f0000000440), 0x84800) socket$rxrpc(0x21, 0x2, 0x0) recvfrom(r2, &(0x7f0000000340)=""/32, 0x20, 0x40000000, &(0x7f00000003c0)=@pppol2tp={0x18, 0x1, {0x0, r2, {0x2, 0x4e22, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x3, 0x0, 0x4}}, 0x80) recvfrom(r2, 0x0, 0x0, 0x0, 0x0, 0x0) recvfrom(r3, &(0x7f0000000180)=""/184, 0xfffffffffffffd84, 0x10100, 0x0, 0xfffffffffffffd51) utimes(&(0x7f0000000480)='./file0\x00', &(0x7f00000004c0)={{0x0, 0x2710}, {0x77359400}}) 13:47:40 executing program 4: signalfd4(0xffffffffffffffff, &(0x7f0000000ff8), 0x8, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000340), 0x10000014c) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x300000000000000}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) [ 2462.889944] binder: 26388:26395 ioctl c0306201 20000600 returned -14 13:47:40 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0xa}) [ 2462.941834] binder: release 26388:26395 transaction 3468 in, still active 13:47:41 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x713000, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) [ 2462.982424] binder_send_failed_reply: 5 callbacks suppressed [ 2462.982436] binder: send failed reply for transaction 3468 to 26388:26395 [ 2463.065589] binder: undelivered TRANSACTION_COMPLETE 13:47:41 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x10}) [ 2463.096095] binder: undelivered TRANSACTION_ERROR: 29189 [ 2463.104906] binder: 26411:26412 ioctl c0306201 20000600 returned -14 13:47:41 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) pread64(r1, 0x0, 0x0, 0x0) gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000001100)={0x0}) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r2}}, 0x0) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) dup2(r3, r1) 13:47:41 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x48}) 13:47:41 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x740000, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) [ 2463.223010] binder: send failed reply for transaction 3470 to 26411:26412 13:47:41 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x4c}) [ 2463.311305] binder: 26420:26421 ioctl c0306201 20000600 returned -14 [ 2463.463826] binder: send failed reply for transaction 3472 to 26420:26421 13:47:41 executing program 2: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vcs\x00', 0x80, 0x0) ioctl$VIDIOC_DBG_G_REGISTER(r0, 0xc0385650, &(0x7f0000000100)={{0x0, @addr=0x9}, 0x8, 0x76980cc3, 0xfffffffffffffff9}) ioctl$EVIOCSABS0(r0, 0x401845c0, &(0x7f0000000200)={0xffffffffffffff81, 0x9a, 0x3, 0x4, 0x0, 0x5}) getsockopt$SO_COOKIE(r0, 0x1, 0x39, &(0x7f0000000140), &(0x7f0000000180)=0x8) r1 = socket$netlink(0x10, 0x3, 0x4) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='fdinfo/3\x00') openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x480000, 0x0) bind$bt_sco(r2, &(0x7f00000001c0)={0x1f, {0xfffffffffffffffc, 0x3f, 0x2, 0x4, 0xffffffffffffff4e, 0x9}}, 0x8) exit(0x0) ioctl$EVIOCGEFFECTS(r0, 0x80044584, &(0x7f0000000040)=""/11) pread64(r2, 0x0, 0x0, 0x3) ioctl$RTC_ALM_READ(r2, 0x80247008, &(0x7f0000000280)) syncfs(r1) 13:47:41 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x940000, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:47:41 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x60}) [ 2463.840854] binder: 26448:26452 ioctl c0306201 20000600 returned -14 [ 2463.975425] binder_thread_release: 2 callbacks suppressed [ 2463.975439] binder: release 26448:26452 transaction 3474 in, still active [ 2464.010030] binder: send failed reply for transaction 3474 to 26448:26452 13:47:42 executing program 1: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-vsock\x00', 0x2, 0x0) clone(0x100002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r4 = dup2(r2, r0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1e2ba62e) recvfrom(r1, 0x0, 0x0, 0x0, 0x0, 0x0) open_by_handle_at(r3, &(0x7f00000002c0)={0x1d, 0x40, "b2ed6755a5bd1233e89fc69db0dafec006db6e710e"}, 0x284400) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) write$binfmt_elf32(r4, &(0x7f00000003c0)={{0x7f, 0x45, 0x4c, 0x46, 0x3, 0x7ff, 0x3f, 0x1, 0xfffffffffffffff8, 0x3, 0x3e, 0x3, 0x33b, 0x38, 0x2e9, 0x1, 0x0, 0x20, 0x2, 0x8001, 0x8000, 0x81}, [{0x7, 0x5, 0x8, 0x80, 0x9d4, 0x8c7, 0x7ff}, {0x7, 0x6, 0xfff, 0x3, 0x280000000, 0x1, 0xff, 0x4e80}], "d0105f86470e89db0ad07a33b04a52f21f52e949b76cd495d735490d91b518d7e0cdf86c3f192a59a4102742705a71d1646735261bc2af33b8b1a1c896e6e3768241b4c449fb2b8cc6f7d5b1d6b75eca7d380ce30e9ee5901e0ffea0eb01b6a87cbdfbd85ce6a1d7c71530b0eb10b53867b3c8e230880fe82f589cb0db6a23b974156cbb223cc30395f11ef9810f6592d3709050f982b429fb4ae213"}, 0x114) select(0x40, &(0x7f00000000c0)={0x7, 0x6, 0x3f, 0x1000, 0x3, 0x10001, 0x6, 0x7}, &(0x7f0000000100)={0xfffffffffffffff8, 0x8, 0x7f, 0x5, 0x2, 0x1000, 0x7, 0x6}, &(0x7f0000000140)={0xffffffff, 0x4, 0x5, 0x1, 0x3, 0x8, 0x0, 0x849e}, &(0x7f0000000280)={r5, r6/1000+30000}) recvfrom(r2, &(0x7f0000000180)=""/184, 0xfffffffffffffd84, 0x10100, 0x0, 0xfffffffffffffd51) 13:47:42 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x68}) 13:47:42 executing program 4: signalfd4(0xffffffffffffffff, &(0x7f0000000ff8), 0x8, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000340), 0x10000014c) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x400000000000000}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 13:47:42 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0xa05000, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) [ 2464.041175] binder_release_work: 2 callbacks suppressed [ 2464.041183] binder: undelivered TRANSACTION_COMPLETE [ 2464.098176] binder_release_work: 2 callbacks suppressed [ 2464.098184] binder: undelivered TRANSACTION_ERROR: 29189 [ 2464.099769] binder: 26545:26547 ioctl c0306201 20000600 returned -14 13:47:42 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) pread64(r1, 0x0, 0x0, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000001100)={0x0}) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r3}}, 0x0) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vcs\x00', 0x40000000, 0x0) dup2(r4, r1) tkill(r2, 0x15) 13:47:42 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x6c}) 13:47:42 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0xa07000, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) [ 2464.255638] binder: release 26545:26547 transaction 3476 in, still active [ 2464.270281] binder: send failed reply for transaction 3476 to 26545:26547 [ 2464.306752] binder: undelivered TRANSACTION_COMPLETE 13:47:42 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x74}) 13:47:42 executing program 5: mlockall(0x2) r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) pread64(r1, 0x0, 0x0, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_gettime(0x4, &(0x7f0000000080)={0x0}) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r3}}, 0x0) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) dup2(r4, r1) tkill(r2, 0x15) [ 2464.329427] binder: undelivered TRANSACTION_ERROR: 29189 [ 2464.360087] binder: 26565:26567 ioctl c0306201 20000600 returned -14 [ 2464.477515] binder: release 26565:26567 transaction 3478 in, still active [ 2464.490618] binder: send failed reply for transaction 3478 to 26565:26567 [ 2464.525722] binder: undelivered TRANSACTION_COMPLETE [ 2464.557845] binder: undelivered TRANSACTION_ERROR: 29189 13:47:42 executing program 2: socket$netlink(0x10, 0x3, 0x0) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='fdinfo/3\x00') ioctl$CAPI_GET_FLAGS(r0, 0x80044323, &(0x7f0000000000)) ioctl$PPPIOCSCOMPRESS(r0, 0x4010744d) exit(0x2c26) pread64(r0, 0x0, 0x0, 0x3) 13:47:42 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x1000000, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:47:42 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x7a}) [ 2464.756193] binder: 26579:26580 ioctl c0306201 20000600 returned -14 [ 2464.845540] binder: release 26579:26580 transaction 3480 in, still active [ 2464.855207] binder: send failed reply for transaction 3480 to 26579:26580 [ 2464.871407] binder: undelivered TRANSACTION_COMPLETE [ 2464.887417] binder: undelivered TRANSACTION_ERROR: 29189 13:47:43 executing program 1: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-vsock\x00', 0x2, 0x0) clone(0x100002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = openat$full(0xffffffffffffff9c, &(0x7f0000000100)='/dev/full\x00', 0x400, 0x0) r4 = add_key$user(&(0x7f0000000140)='user\x00', &(0x7f0000000240)={'syz', 0x2}, &(0x7f0000000280)="1e2061dbdeca81daa798afdc9ef59124bffc075405c4fba66aecf262b742733da77581df304e4cb021d50a7e1de531a90c40c105e1ff3998a6b956e79106d407ed7e6dcffe5ebbefb9dd750d3aea466abb36e07d1eb704e79cfc1e9aa00163d349450a4845", 0x65, 0xfffffffffffffffd) getsockopt$packet_int(r2, 0x107, 0xf, &(0x7f0000000400), &(0x7f0000000440)=0x4) r5 = add_key$keyring(&(0x7f0000000340)='keyring\x00', &(0x7f00000003c0)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffff9) keyctl$instantiate(0xc, r4, &(0x7f0000000300)=ANY=[@ANYBLOB='new ecryptfs user: 000*0000000000004078\x00'], 0x28, r5) r6 = dup2(r2, r0) ioctl$TIOCSSOFTCAR(r6, 0x541a, &(0x7f00000000c0)=0x1f80000000) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1e2ba62e) ioctl$KVM_REINJECT_CONTROL(r3, 0xae71, &(0x7f0000000480)={0xca6}) recvfrom(r1, 0x0, 0x0, 0x0, 0x0, 0x0) recvfrom(r2, &(0x7f0000000180)=""/184, 0xfffffffffffffd84, 0x10100, 0x0, 0xfffffffffffffd51) 13:47:43 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) pread64(r1, 0x0, 0x0, 0x0) r2 = openat$btrfs_control(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockopt$ARPT_SO_GET_INFO(r2, 0x0, 0x60, &(0x7f0000000600)={'filter\x00'}, &(0x7f0000000680)=0x44) r3 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000001100)) timer_settime(0x0, 0x1, &(0x7f0000000100)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) dup2(r4, r1) tkill(r3, 0x15) 13:47:43 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x2000000, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:47:43 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x300}) 13:47:43 executing program 4: signalfd4(0xffffffffffffffff, &(0x7f0000000ff8), 0x8, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000340), 0x10000014c) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x500000000000000}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 13:47:43 executing program 1: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-vsock\x00', 0x2, 0x0) clone(0x40020000, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/dsp\x00', 0x80000, 0x0) ioctl$sock_bt_bnep_BNEPGETCONNLIST(r1, 0x800442d2, &(0x7f0000000140)={0x2, &(0x7f0000000100)=[{0x0, 0x0, 0x0, @link_local}, {0x0, 0x0, 0x0, @random}]}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r0) r4 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vsock\x00', 0x800, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r4, 0x84, 0x6b, &(0x7f00000002c0)=[@in={0x2, 0x4e24, @remote}, @in6={0xa, 0x4e24, 0xa, @mcast1, 0x2}, @in6={0xa, 0x4e21, 0xced, @mcast1, 0x6}, @in={0x2, 0x4e22, @multicast2}, @in6={0xa, 0x4e21, 0xfff, @ipv4={[], [], @multicast2}, 0x200}, @in={0x2, 0x4e22, @broadcast}, @in={0x2, 0x4e21, @broadcast}], 0x94) ioctl$PPPIOCGUNIT(r4, 0x80047456, &(0x7f0000000280)) write$binfmt_misc(r2, &(0x7f0000000140)=ANY=[], 0x1e2ba62e) recvfrom(r2, 0x0, 0x0, 0x0, 0x0, 0x0) recvfrom(r3, &(0x7f0000000180)=""/184, 0xfffffffffffffd84, 0x10100, 0x0, 0xfffffffffffffd51) 13:47:43 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x500}) [ 2465.222543] binder: 26690:26691 ioctl c0306201 20000600 returned -14 13:47:43 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x3000000, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:47:43 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = getpgrp(0xffffffffffffffff) r2 = getpgid(0x0) r3 = syz_open_dev$dspn(&(0x7f0000000080)='/dev/dsp#\x00', 0x9, 0x100) kcmp$KCMP_EPOLL_TFD(r1, r2, 0x7, r0, &(0x7f0000000100)={r3, r0, 0x4}) r4 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) pread64(r4, 0x0, 0x0, 0x0) r5 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_nanosleep(0x5, 0x0, &(0x7f0000000140), &(0x7f0000000180)) clock_gettime(0x0, &(0x7f0000001100)={0x0}) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r6}}, 0x0) r7 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) dup2(r7, r4) tkill(r5, 0x15) [ 2465.324750] binder: release 26690:26691 transaction 3482 in, still active [ 2465.337029] binder: send failed reply for transaction 3482 to 26690:26691 [ 2465.374996] binder: undelivered TRANSACTION_COMPLETE [ 2465.394440] IPVS: ftp: loaded support on port[0] = 21 [ 2465.399737] binder: undelivered TRANSACTION_ERROR: 29189 [ 2465.417108] binder: 26710:26713 ioctl c0306201 20000600 returned -14 [ 2465.466538] binder: release 26710:26713 transaction 3484 in, still active [ 2465.477150] Unknown ioctl -2147191722 [ 2465.481050] binder: send failed reply for transaction 3484 to 26710:26713 [ 2465.481212] binder: undelivered TRANSACTION_COMPLETE [ 2465.481229] binder: undelivered TRANSACTION_ERROR: 29189 13:47:43 executing program 2: socket$netlink(0x10, 0x3, 0x0) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='fdinfo/3\x00') exit(0xfffffffffffffffb) pread64(r0, 0x0, 0x0, 0x3) setsockopt$inet_sctp6_SCTP_RECVNXTINFO(r0, 0x84, 0x21, &(0x7f0000000000), 0x4) 13:47:43 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x600}) 13:47:43 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x4000000, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:47:43 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) pread64(r1, 0x0, 0x0, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x13, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) clock_gettime(0x0, &(0x7f0000001100)={0x0}) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r3}}, 0x0) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) dup2(r4, r1) tkill(r2, 0x15) [ 2465.705487] binder: 26780:26801 ioctl c0306201 20000600 returned -14 13:47:43 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x700}) 13:47:43 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x5000000, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) [ 2465.775363] binder: release 26780:26801 transaction 3486 in, still active [ 2465.788424] binder: send failed reply for transaction 3486 to 26780:26801 13:47:43 executing program 1: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-vsock\x00', 0x2, 0x0) clone(0x100002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = creat(&(0x7f00000000c0)='./file0\x00', 0xa1) ioctl$VIDIOC_SUBDEV_QUERY_DV_TIMINGS(r3, 0x80845663, &(0x7f0000000240)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000140)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(r3, &(0x7f0000000400)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x208030d0}, 0xc, &(0x7f00000003c0)={&(0x7f0000000440)=ANY=[@ANYBLOB='l\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="00032dbd7000fedbdf250e000000080005003f00000008000500010000002c0001000800060066879c06b78c41e201b6c81b5f6f0000080001000a000000085436a91ff435160500000000000000080009007800000008000b007369700008000900770000001c000300080004000000000008000100"], 0x6c}, 0x1, 0x0, 0x0, 0x48001}, 0x4040) dup2(r2, r0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1e2ba62e) recvfrom(r1, 0x0, 0x0, 0x0, 0x0, 0x0) recvfrom(r2, &(0x7f0000000180)=""/184, 0xfffffffffffffd84, 0x10100, 0x0, 0xfffffffffffffd51) [ 2465.817034] binder: undelivered TRANSACTION_COMPLETE [ 2465.837186] binder: undelivered TRANSACTION_ERROR: 29189 [ 2465.866405] binder: 26836:26837 ioctl c0306201 20000600 returned -14 [ 2465.962087] binder: release 26836:26837 transaction 3488 in, still active [ 2465.974612] binder: undelivered TRANSACTION_COMPLETE [ 2465.984916] binder: undelivered TRANSACTION_ERROR: 29189 13:47:44 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0xa00}) 13:47:44 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x6000000, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:47:44 executing program 4: signalfd4(0xffffffffffffffff, &(0x7f0000000ff8), 0x8, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000340), 0x10000014c) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x600000000000000}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 13:47:44 executing program 1: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-vsock\x00', 0x2, 0x0) clone(0x100002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000140)='/dev/cachefiles\x00', 0x200, 0x0) ioctl$CAPI_GET_FLAGS(r3, 0x80044323, &(0x7f0000000240)) openat$vimc2(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video2\x00', 0x2, 0x0) r4 = dup2(r2, r0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1e2ba62e) mmap(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x6, 0x60010, r4, 0x0) recvfrom(r1, 0x0, 0x0, 0x0, 0x0, 0x0) close(r4) recvfrom(r2, &(0x7f0000000180)=""/184, 0xfffffffffffffd84, 0x10100, 0x0, 0xfffffffffffffd51) 13:47:44 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0xf1a}) [ 2466.236299] binder: 26943:26948 ioctl c0306201 20000600 returned -14 [ 2466.317192] binder: release 26943:26948 transaction 3490 in, still active [ 2466.329390] binder: undelivered TRANSACTION_COMPLETE [ 2466.348567] binder: undelivered TRANSACTION_ERROR: 29189 13:47:44 executing program 2: socket$netlink(0x10, 0x3, 0x0) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='fdinfo/3\x00') syz_open_dev$dmmidi(&(0x7f0000000000)='/dev/dmmidi#\x00', 0x9, 0x40800) exit(0x0) pread64(r0, 0x0, 0x0, 0x3) 13:47:44 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x7000000, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:47:44 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x1a0f}) [ 2466.658547] binder: 26963:26965 ioctl c0306201 20000600 returned -14 [ 2466.740978] binder: release 26963:26965 transaction 3492 in, still active [ 2466.754529] binder: undelivered TRANSACTION_COMPLETE [ 2466.774763] binder: undelivered TRANSACTION_ERROR: 29189 13:47:46 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) pread64(r1, 0x0, 0x0, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000000240)={0x0}) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r3}}, 0x0) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) r5 = dup2(r4, r1) tkill(r2, 0x15) write$evdev(r4, &(0x7f0000000100)=[{{}, 0x14, 0x3, 0x9}, {{}, 0x0, 0xf9d, 0x800}, {{}, 0x1f, 0x1, 0xffff}, {{}, 0x1f, 0x9, 0x100000001}, {{0x77359400}, 0x4, 0x1, 0xfffffffffffff000}], 0x78) ioctl$ION_IOC_ALLOC(r5, 0xc0184900, &(0x7f0000000080)={0x49a, 0x10, 0x1, r4}) 13:47:46 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x1f00}) 13:47:46 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0xa000000, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:47:46 executing program 1: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000480)='/dev/vhost-vsock\x00', 0x2, 0x0) clone(0x100002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$pptp(0x18, 0x1, 0x2) r3 = dup2(r2, r0) socket$inet(0x2, 0x800, 0x7fff) write$binfmt_misc(r1, &(0x7f00000002c0)=ANY=[], 0x0) recvfrom(r1, 0x0, 0x0, 0x0, 0x0, 0x0) recvfrom(r2, &(0x7f0000000180)=""/184, 0xfffffffffffffd84, 0x10100, 0x0, 0xfffffffffffffd51) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r3, 0x6, 0x1d, &(0x7f0000000000)={0x7ff, 0x5, 0x3, 0x40, 0x9}, 0x14) r4 = semget(0x2, 0x4, 0x20) semctl$GETPID(r4, 0x1, 0xb, &(0x7f0000000240)=""/193) 13:47:46 executing program 4: signalfd4(0xffffffffffffffff, &(0x7f0000000ff8), 0x8, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000340), 0x10000014c) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x700000000000000}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 13:47:46 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000000)={0xfffffffffffffff9, 0x4, 0x1, 0xffffffffffffff9c}) dup2(r0, r1) socket$netlink(0x10, 0x3, 0x0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='fdinfo/3\x00') exit(0x0) pread64(r2, 0x0, 0x0, 0x3) 13:47:46 executing program 1: socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_TIOCOUTQ(r0, 0x5411, &(0x7f0000000140)) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-vsock\x00', 0x2, 0x0) clone(0x100002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0xfffffffffffffffe, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r4 = dup2(r3, r1) write$binfmt_misc(r2, &(0x7f0000000140)=ANY=[], 0x1e2ba62e) ioctl$TCXONC(r4, 0x540a, 0x80) recvfrom(r2, 0x0, 0x0, 0x0, 0x0, 0x0) recvfrom(r3, &(0x7f0000000180)=""/184, 0xfffffffffffffff8, 0x10100, 0x0, 0x0) 13:47:46 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x2000}) [ 2468.766237] binder: 27073:27083 ioctl c0306201 20000600 returned -14 13:47:46 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x20000000, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) [ 2468.821836] binder_send_failed_reply: 3 callbacks suppressed [ 2468.821854] binder: send failed reply for transaction 3494 to 27073:27083 13:47:46 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) pread64(r1, 0x0, 0x0, 0x0) r2 = gettid() r3 = openat$null(0xffffffffffffff9c, &(0x7f0000000100)='/dev/null\x00', 0x4080, 0x0) ioctl$KVM_SET_CLOCK(r3, 0x4030ae7b, &(0x7f0000000140)={0x100000000, 0x5}) timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000001100)={0x0}) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r4}}, 0x0) r5 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) dup2(r5, r1) ioctl$SG_SET_DEBUG(r1, 0x227e, &(0x7f0000000080)) tkill(r2, 0x15) [ 2468.906753] binder: 27130:27135 ioctl c0306201 20000600 returned -14 13:47:46 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x3f00}) 13:47:47 executing program 1: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000001480)='/dev/vhost-vsock\x00', 0x2, 0x0) clone(0x100002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) statfs(&(0x7f0000000240)='./file0\x00', &(0x7f00000003c0)=""/4096) ioctl$sock_SIOCGIFCONF(r1, 0x8912, &(0x7f0000000140)=@req={0x28, &(0x7f0000000100)={'erspan0\x00', @ifru_addrs=@tipc=@id={0x1e, 0x3, 0x1, {0x4e23, 0x4}}}}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) setns(r1, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r4 = dup2(r3, r0) ioctl$VIDIOC_G_STD(r4, 0x80085617, &(0x7f0000000340)) write$binfmt_misc(r2, &(0x7f0000000140)=ANY=[], 0x1e2ba62e) recvfrom(r2, 0x0, 0x0, 0x0, 0x0, 0x0) recvfrom(r3, &(0x7f0000000180)=""/184, 0xfffffffffffffd84, 0x10100, 0x0, 0xfffffffffffffd51) ioctl$LOOP_SET_FD(r4, 0x4c00, r0) accept4(r1, &(0x7f0000000280)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @dev}}}, &(0x7f0000000300)=0x80, 0x80000) 13:47:47 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x48000000, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) [ 2469.008643] binder_thread_release: 1 callbacks suppressed [ 2469.008657] binder: release 27130:27135 transaction 3496 in, still active [ 2469.043952] binder: send failed reply for transaction 3496 to 27130:27135 13:47:47 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x4800}) 13:47:47 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$dri(&(0x7f0000000100)='/dev/dri/card#\x00', 0x0, 0xa00) pread64(r1, 0x0, 0x0, 0x0) r2 = gettid() r3 = syz_open_dev$dmmidi(&(0x7f0000000080)='/dev/dmmidi#\x00', 0x8, 0x480) ioctl$SG_GET_SG_TABLESIZE(r3, 0x227f, &(0x7f00000000c0)) timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000001100)={0x0}) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r4}}, 0x0) r5 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) dup2(r5, r1) tkill(r2, 0x15) [ 2469.073462] binder_release_work: 1 callbacks suppressed [ 2469.073469] binder: undelivered TRANSACTION_COMPLETE [ 2469.096499] binder: 27206:27207 ioctl c0306201 20000600 returned -14 13:47:47 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x4c00}) [ 2469.228824] binder: release 27206:27207 transaction 3498 in, still active [ 2469.245833] binder: send failed reply for transaction 3498 to 27206:27207 [ 2469.272864] binder: undelivered TRANSACTION_COMPLETE [ 2469.286493] binder_release_work: 2 callbacks suppressed [ 2469.286502] binder: undelivered TRANSACTION_ERROR: 29189 13:47:47 executing program 4: signalfd4(0xffffffffffffffff, &(0x7f0000000ff8), 0x8, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000340), 0x10000014c) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x800000000000000}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 13:47:47 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x4c000000, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:47:47 executing program 1: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-vsock\x00', 0x2, 0x0) clone(0x100002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = dup2(r2, r0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1e2ba62e) recvfrom(r1, 0x0, 0x0, 0x0, 0x0, 0x0) recvfrom(r2, &(0x7f0000000180)=""/184, 0xfffffffffffffd84, 0x10100, 0x0, 0xfffffffffffffd51) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r3, 0x10e, 0x1, &(0x7f00000000c0)=0xc, 0x4) 13:47:47 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f023c123f3188b070") r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) pread64(r1, 0x0, 0x0, 0x0) timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) r2 = open(&(0x7f0000000080)='./file0\x00', 0x40800, 0x40) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffff9c, 0x29, 0x22, &(0x7f0000000100)={{{@in=@empty, @in=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@dev}, 0x0, @in=@multicast1}}, &(0x7f0000000200)=0xe8) getgroups(0x7, &(0x7f0000000240)=[0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xee01, 0xee01, 0x0, 0xffffffffffffffff]) getresuid(&(0x7f0000000280)=0x0, &(0x7f00000002c0), &(0x7f0000000300)) write$P9_RSTATu(r2, &(0x7f0000000340)=ANY=[@ANYBLOB="970000007d020000006900ff010300000010040000000300000000ff010000000080060000000100000002000000000000000f002f6465762f6472692f6361726423001d006d696d655f7479706573797374656d73797374656d24657468312d272601002a09002f6465762f7663730019005c73797374656d63707573657476626f786e65743070726f63", @ANYRES32=r3, @ANYRES32=r4, @ANYRES32=r5], 0x97) clock_gettime(0x0, &(0x7f0000001100)={0x0}) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r6}}, 0x0) r7 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) dup2(r7, r1) tkill(0x0, 0x15) 13:47:47 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x6000}) 13:47:47 executing program 2: socket$netlink(0x10, 0x3, 0x0) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='fdinfo/3\x00') exit(0x0) pread64(r0, 0x0, 0x0, 0x3) [ 2469.752488] binder: 27328:27330 ioctl c0306201 20000600 returned -14 13:47:47 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x6800}) 13:47:47 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x60000000, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) [ 2469.803039] binder: release 27328:27330 transaction 3500 in, still active [ 2469.810721] binder: send failed reply for transaction 3500 to 27328:27330 [ 2469.819948] binder: undelivered TRANSACTION_COMPLETE [ 2469.825330] binder: undelivered TRANSACTION_ERROR: 29189 [ 2469.853715] binder: 27344:27363 ioctl c0306201 20000600 returned -14 13:47:47 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x68000000, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:47:47 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x6c00}) [ 2469.919472] binder: release 27344:27363 transaction 3502 in, still active [ 2469.933117] binder: send failed reply for transaction 3502 to 27344:27363 [ 2469.959371] binder: undelivered TRANSACTION_COMPLETE 13:47:47 executing program 1: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-vsock\x00', 0x2, 0x0) clone(0x100002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x2080, 0x0) ioctl$TIOCEXCL(r1, 0x540c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8916, &(0x7f0000000100)={'bcsh0\x00', {0x2, 0x4e21, @broadcast}}) dup2(r3, r0) write$binfmt_misc(r2, &(0x7f0000000140)=ANY=[], 0x1e2ba62e) recvfrom(r2, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffed0) recvfrom(r3, &(0x7f0000000180)=""/184, 0xfffffffffffffd84, 0x10100, 0x0, 0xfffffffffffffd51) [ 2469.972301] binder: 27444:27445 ioctl c0306201 20000600 returned -14 [ 2469.980776] binder: undelivered TRANSACTION_ERROR: 29189 13:47:48 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x6c000000, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) [ 2470.059636] binder: release 27444:27445 transaction 3504 in, still active [ 2470.069173] binder: send failed reply for transaction 3504 to 27444:27445 [ 2470.091368] binder: undelivered TRANSACTION_COMPLETE [ 2470.109881] binder: undelivered TRANSACTION_ERROR: 29189 [ 2470.145974] binder: 27474:27506 ioctl c0306201 20000600 returned -14 [ 2470.244101] binder: release 27474:27506 transaction 3506 in, still active [ 2470.258605] binder: send failed reply for transaction 3506 to 27474:27506 [ 2470.284865] binder: undelivered TRANSACTION_COMPLETE [ 2470.303803] binder: undelivered TRANSACTION_ERROR: 29189 13:47:48 executing program 4: signalfd4(0xffffffffffffffff, &(0x7f0000000ff8), 0x8, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000340), 0x10000014c) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x900000000000000}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 13:47:48 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x7400}) 13:47:48 executing program 1: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-vsock\x00', 0x2, 0x0) clone(0x100002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = openat$autofs(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/autofs\x00', 0x200c00, 0x0) ioctl$SIOCGETLINKNAME(r3, 0x89e0, &(0x7f0000000240)={0x0, 0x3}) dup2(r2, r0) fsync(r3) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1e2ba62e) socket$pptp(0x18, 0x1, 0x2) recvfrom(r1, 0x0, 0x0, 0x0, 0x0, 0x0) syz_open_dev$radio(&(0x7f0000000100)='/dev/radio#\x00', 0x1, 0x2) recvfrom(r2, &(0x7f0000000180)=""/184, 0xfffffffffffffd84, 0x10100, 0x0, 0xfffffffffffffd51) ioctl$VIDIOC_ENUM_FRAMESIZES(r3, 0xc02c564a, &(0x7f0000000140)={0x2, 0x34367259, 0x1, @discrete={0x101, 0x9}}) 13:47:48 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x74000000, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:47:48 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$vcsn(&(0x7f0000000100)='/dev/vcs#\x00', 0x80000001, 0x440) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000140)="ea49ed273aafcb8b33f304f9c9a4b36f546faf29383f2f4b2af146ad0d896f6085dd0885fe29280e0b028174d37404da51903922a6c6332d937f9c42ec0f36b568c63b7e3d95403f9c0e3a5d9519d8b21bc7fff6c309755639b74d00527900e4c09d07e329345d18ad4dc2a26d2ffb691c602a60a82ad1fc915d70a55376ec050302f98c2fec7a4d6e03f876fe722f4a56aac6", 0x93) r2 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) pread64(r2, 0x0, 0x0, 0x0) r3 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000001100)={0x0}) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r4}}, 0x0) pipe2(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) ioctl$VIDIOC_LOG_STATUS(r5, 0x5646, 0x0) r6 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) dup2(r6, r2) tkill(r3, 0x15) 13:47:48 executing program 2: socket$netlink(0x10, 0x3, 0x0) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='fdinfo/3\x00') exit(0x1) pread64(r0, 0x0, 0x0, 0x3) 13:47:48 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x7a000000, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) [ 2470.740514] binder: 27561:27563 ioctl c0306201 20000600 returned -14 [ 2470.779706] binder: release 27561:27563 transaction 3508 in, still active 13:47:48 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x7a00}) 13:47:48 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) pread64(r1, 0x0, 0x0, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000001100)={0x0}) r4 = dup3(r1, r0, 0x80000) ioctl$FS_IOC_GETFSMAP(r0, 0xc0c0583b, &(0x7f0000000200)={0x0, 0x0, 0x2, 0x0, [], [{0x0, 0x1d3, 0xffff, 0x200, 0x5, 0x4}, {0x4e93d722, 0x5, 0x3, 0x8, 0x3f, 0x7fff}], [[], []]}) ioctl$SNDRV_TIMER_IOCTL_GINFO(r4, 0xc0f85403, &(0x7f0000000100)={{0x0, 0x2, 0x59586b9a, 0x1, 0x7}, 0x101, 0x80000001, 'id1\x00', 'timer1\x00', 0x0, 0x3, 0x2, 0x1, 0x8}) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r3}}, 0x0) r5 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) dup2(r5, r1) tkill(r2, 0x15) [ 2470.805466] binder: send failed reply for transaction 3508 to 27561:27563 [ 2470.824142] binder: undelivered TRANSACTION_COMPLETE [ 2470.835543] binder: undelivered TRANSACTION_ERROR: 29189 [ 2470.847656] binder: 27578:27580 ioctl c0306201 20000600 returned -14 13:47:48 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0xff600000, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:47:48 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x3aa8a}) 13:47:48 executing program 1: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-vsock\x00', 0x2, 0x0) clone(0x100002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000000000000, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$binfmt_elf32(r2, &(0x7f0000000ac0)=ANY=[@ANYBLOB="7f454c464846ff09080000000000000003003e00000000007f0300003800000006010000000800000000200002000000ff0ffcff000000000600000006000000070000040000000001000100000000000000000000080000107377b09026576dbe0069054961c925030f203b838b56732808a11a811225db3a8d428067c99c489e2cd4ea8cd993ec92e8a11c85ba98777b0f9fb5cd5dd926550e8fff710a848c6dca3a85c25be4c065ddf6a41923f068a7ad830780b0aa245d9a155785ff88bddc00bc1266abe72361a8ddd686104bb0a855a7a48e8153dc311cd6d370667f6dee3601c23ac4c942dcdc4a908ba9d5949c748a9a6bac68628eecca53093ca29696524ddba9e03cea333f58449008460a5a4bd5567ad0f471e91e7f01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000000000000000001d00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f4a1cb011e98f5898ad00000000000000000000000000000000000000000006c206d927b41357d02bc66dc1c00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000761d6414cba1ff9c9d6770fa6ec05619f0729951ecf6e0677dcdc875ea77488404c7b2f3b691c86bcb84faec06e2051c5210333a3323b3970177909137ad1b4629460d3ceca88a50df9933b78be6089cfaa03773e363111f91ec99cd3fb6f7deec65c2a4c65859a25109f1dc431728d2d4d585101e853baa68dec2e4361b176690c4b8efa5644e941f3e020ff6a09065dcadefe7f136f2e0f71a21b771fb454e1d730c6775c937a3024c05c6a1a84adfae94a685d1844fff03fd436a979439e46320fb97eaa81acfd21459eede34c0d29ad47a34ef7249bb23f661639bf9736eb9ebdf9afc6a2a8d9093b16aafb5d4"], 0x21c) r3 = dup2(r2, r0) getsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r3, 0x84, 0x71, &(0x7f00000000c0)={0x0, 0x3}, &(0x7f0000000100)=0x8) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r3, 0x84, 0x7b, &(0x7f0000000140)={0x0, 0x8}, &(0x7f0000000240)=0x8) getsockopt$inet_sctp6_SCTP_STATUS(r3, 0x84, 0xe, &(0x7f0000000280)={r4, 0x7, 0x8, 0x100000001, 0x0, 0x8000, 0x1, 0x3, {r5, @in6={{0xa, 0x4e22, 0x8, @rand_addr="dbebd0c44f0d5fd5fcd84769d37b7a98", 0x7}}, 0x2, 0x5, 0x3ff, 0x2a4cb04e, 0x5}}, &(0x7f0000000340)=0xb0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1e2ba62e) ioctl$sock_bt_hidp_HIDPGETCONNINFO(r3, 0x800448d3, &(0x7f0000000180)={{0x3, 0x8, 0xe3b, 0x6, 0x401, 0x7f}, 0x8000, 0x6, 0x3ff, 0xfffffffffffffc5b, 0x101, "dfad7ee4b579e17372e512cc901313691cc0969ed4252867074276ed621d45155b0ee2d59b3dcc624b1ba3eb5a294916f985540b1f8fc2447d1a066095071ae01c634700d5cd40430de538232f2ae56ebfb9e52ffb2d17b53e456de06f9c7888d797dcda5e8b3b9fbe18fb4e9e0e3c17fe5338f6db6e84d9ca04125204309e58"}) recvfrom(r1, 0x0, 0x0, 0x0, 0x0, 0x0) recvfrom(r3, &(0x7f00000006c0)=""/184, 0xb8, 0x400103, 0x0, 0x0) keyctl$set_reqkey_keyring(0xe, 0x5) ioctl$VIDIOC_G_PRIORITY(r3, 0x80045643, 0x3) ioctl$FS_IOC_FIEMAP(r3, 0xc020660b, &(0x7f00000003c0)=ANY=[@ANYBLOB="8000000000000000000000000000000002000000040000000600000000000000ff070000000000003f00000000000000ffffff7f00000000000000000000000000000000000000000220000000000000000000000000000007000000000000007f00000000000000f0de0000000000000000000000000000000000000000000000030000000000000000000000000000070000000000000007000000000000000001000000000000000000000000000000000000000000000200000000000000000000000000000004000000000000000100000000000000ffffffffffffffff00000000000000000000000000000000001000000000000000000000000000007f00000000000000e30d0000000000000900000000000000000000000000000000000000000000000031000000000000000000000000000001000000000000000180000000000000020000002c990000000000000000000000000000000000000000000000000000000000"]) [ 2470.932200] binder: release 27578:27580 transaction 3510 in, still active [ 2470.947079] binder: send failed reply for transaction 3510 to 27578:27580 [ 2470.971886] binder: undelivered TRANSACTION_COMPLETE [ 2470.984373] binder: undelivered TRANSACTION_ERROR: 29189 [ 2471.017799] binder: 27687:27689 ioctl c0306201 20000600 returned -14 [ 2471.084545] binder: release 27687:27689 transaction 3512 in, still active [ 2471.099816] binder: send failed reply for transaction 3512 to 27687:27689 [ 2471.106952] binder: undelivered TRANSACTION_COMPLETE [ 2471.121002] binder: undelivered TRANSACTION_ERROR: 29189 13:47:49 executing program 4: signalfd4(0xffffffffffffffff, &(0x7f0000000ff8), 0x8, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000340), 0x10000014c) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0xa00000000000000}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 13:47:49 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) pread64(r1, 0x0, 0x0, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000001100)={0x0}) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r3}}, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000000080)) dup2(r0, r1) tkill(r2, 0x15) 13:47:49 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x400000000000, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:47:49 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x3aa8b}) 13:47:49 executing program 1: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-vsock\x00', 0x2, 0x0) clone(0x100002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) personality(0x410000d) fsetxattr$security_smack_transmute(r0, &(0x7f00000000c0)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000100)='TRUE', 0x4, 0x3) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r4 = dup2(r1, r3) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1e2ba62e) recvfrom(r1, 0x0, 0xfffffffffffffd47, 0x8000041000000004, 0x0, 0xa3909a1814c1f06d) ioctl$VIDIOC_SUBDEV_ENUM_FRAME_INTERVAL(r4, 0xc040564b, &(0x7f0000000240)={0xff, 0x0, 0x201f, 0x4f8, 0x3, {0x5, 0x1}, 0x1}) recvfrom(r2, &(0x7f0000000180)=""/184, 0xfffffffffffffd84, 0x10100, 0x0, 0xfffffffffffffd51) 13:47:49 executing program 2: r0 = getpgid(0xffffffffffffffff) r1 = syz_open_procfs(r0, &(0x7f0000000080)='fdinfo/3\x00') ioctl$VIDIOC_S_FMT(r1, 0xc0d05605, &(0x7f00000001c0)={0x5, @sdr={0x35315258}}) ioctl$sock_inet_SIOCSIFDSTADDR(r1, 0x8918, &(0x7f00000002c0)={'hwsim0\x00', {0x2, 0x4e22, @remote}}) exit(0x1) ioctl$SNDRV_RAWMIDI_IOCTL_STATUS(r1, 0xc0385720, &(0x7f00000000c0)={0x1, {}, 0x20, 0x1}) getsockname$packet(r1, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000000040)=0x14) setsockopt$inet6_MCAST_JOIN_GROUP(r1, 0x29, 0x2a, &(0x7f0000000100)={0x4, {{0xa, 0x4e21, 0x6, @ipv4={[], [], @remote}, 0xffffffffffffaa48}}}, 0x88) pread64(r1, 0x0, 0x0, 0x3) 13:47:49 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x1000000}) [ 2471.748530] binder: 27798:27799 ioctl c0306201 20000600 returned -14 13:47:49 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x60ffffffffff, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) [ 2471.816279] binder: release 27798:27799 transaction 3514 in, still active [ 2471.841456] binder: undelivered TRANSACTION_COMPLETE [ 2471.859459] binder: undelivered TRANSACTION_ERROR: 29189 13:47:49 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) pread64(r1, 0x0, 0x0, 0x0) r2 = gettid() ioctl$sock_inet_SIOCGIFADDR(r0, 0x8915, &(0x7f0000000080)={'syzkaller1\x00', {0x2, 0x4e23, @multicast2}}) r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000140)='memory.current\x00', 0x0, 0x0) write$9p(r3, &(0x7f0000000180)="e3ec02e6d9e5e7f28b639494f92db2f4062dc3a5b662e970f7b869950c499bff2534480a64ed66cf7c245de3a357dd835ada9040e3fe971540520dc4f808c9ad7ba93dacaea1875fe8313dac8a2eb5fb09e24b26b9d81be3ad290a19d15c5dc62d5b828464ceaf987a203d", 0x6b) ioctl$SNDRV_SEQ_IOCTL_CLIENT_ID(r3, 0x80045301, &(0x7f0000000240)) timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)=0x0) clock_gettime(0x0, &(0x7f0000001100)={0x0}) ioctl$TIOCLINUX6(r3, 0x541c, &(0x7f0000000200)={0x6, 0x3}) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) timer_settime(r4, 0x1, &(0x7f0000000000)={{r6, r7+10000000}, {r5}}, 0x0) r8 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) dup2(r8, r1) tkill(r2, 0x15) 13:47:49 executing program 1: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-vsock\x00', 0x2, 0x0) clone(0x100002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ubi_ctrl\x00', 0x280, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x24, &(0x7f0000000100)=0x13, 0x4) setsockopt$inet_tcp_TLS_RX(r1, 0x6, 0x2, &(0x7f0000000140), 0x4) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x80000000, 0x0, 0x40000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r0) write$binfmt_misc(r2, &(0x7f0000000140)=ANY=[], 0x1e2ba62e) recvfrom(r2, 0x0, 0x0, 0x0, 0x0, 0x0) recvfrom(r3, &(0x7f0000000180)=""/184, 0xfffffffffffffd84, 0x10100, 0x0, 0xfffffffffffffd51) 13:47:49 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x2000000}) [ 2471.908704] binder: 27919:27921 ioctl c0306201 20000600 returned -14 13:47:50 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x740000000000, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) [ 2471.979281] binder: undelivered TRANSACTION_ERROR: 29189 [ 2472.020427] binder: 27930:27931 ioctl c0306201 20000600 returned -14 13:47:50 executing program 4: signalfd4(0xffffffffffffffff, &(0x7f0000000ff8), 0x8, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000340), 0x10000014c) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0xb00000000000000}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 13:47:50 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x3000000}) 13:47:50 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x7fffffffefff, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:47:50 executing program 1: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-vsock\x00', 0x2, 0x0) clone(0x100002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = dup2(r2, r0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1e2ba62e) recvfrom(r1, 0x0, 0x0, 0x0, 0x0, 0x0) recvfrom(r3, &(0x7f0000000180)=""/184, 0xb8, 0x10100, 0x0, 0x0) 13:47:50 executing program 2: socket$netlink(0x10, 0x3, 0x0) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='fdinfo/3\x00') ioctl$NBD_SET_SIZE_BLOCKS(r0, 0xab07, 0x1) r1 = semget(0x1, 0x7, 0x21) ioctl$sock_bt_bnep_BNEPGETCONNINFO(r0, 0x800442d3, &(0x7f0000002cc0)={0xfffffffffffff001, 0x80000000, 0x22e6, @dev={[], 0xe}, 'veth1_to_bridge\x00'}) semctl$SETALL(r1, 0x0, 0x11, &(0x7f0000002c00)=[0xfffffffffffffffd, 0x6]) exit(0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000280)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000240)={0xffffffffffffffff}}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f00000002c0)={0xe, 0xffffffffffffff8c, 0xfa00, @id_resuseaddr={&(0x7f0000000340)=0x1, r2}}, 0x20) ioctl$KVM_S390_UCAS_MAP(r0, 0x4018ae50, &(0x7f0000002b80)={0x8, 0x3, 0xf504}) recvmmsg(r0, &(0x7f0000002a80)=[{{&(0x7f0000000080)=@isdn, 0x80, &(0x7f0000001440)=[{&(0x7f0000000100)=""/143, 0x8f}, {&(0x7f00000001c0)=""/127, 0x7f}, {&(0x7f0000000380)=""/4096, 0x1000}, {&(0x7f0000000300)=""/4, 0x4}, {&(0x7f0000001380)=""/138, 0x8a}], 0x5, &(0x7f00000014c0)=""/4096, 0x1000}, 0x3}, {{&(0x7f00000024c0)=@xdp={0x2c, 0x0, 0x0}, 0x80, &(0x7f0000002940)=[{&(0x7f0000002540)=""/181, 0xb5}, {&(0x7f0000002600)=""/94, 0x5e}, {&(0x7f0000002680)=""/240, 0xf0}, {&(0x7f0000002780)=""/86, 0x56}, {&(0x7f0000002800)=""/182, 0xb6}, {&(0x7f00000028c0)=""/19, 0x13}, {&(0x7f0000002900)=""/11, 0xb}], 0x7, &(0x7f00000029c0)=""/162, 0xa2}}], 0x2, 0x40000001, &(0x7f0000002b00)) ioctl$sock_SIOCGSKNS(r0, 0x894c, &(0x7f0000002bc0)) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000002b40)={@empty, r3}, 0x14) pread64(r0, 0x0, 0x0, 0x3) ioctl$EVIOCSFF(r0, 0x40304580, &(0x7f0000000000)={0x54, 0xff, 0xffffffffffffffff, {0x4, 0xff}, {0x6, 0x1000}, @const={0x1c, {0x4, 0xffffffff, 0x1, 0x3}}}) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f0000002c40)={&(0x7f0000ffd000/0x2000)=nil, 0x2000}, &(0x7f0000002c80)=0x10) 13:47:50 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x4000000}) [ 2472.804294] binder: 28037:28044 ioctl c0306201 20000600 returned -14 13:47:50 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x940000000000, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:47:50 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x5000000}) [ 2472.950869] binder: 28153:28154 ioctl c0306201 20000600 returned -14 13:47:53 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x100002890f, &(0x7f0000000100)="0adc1f123c123f3188b070") r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) pread64(r1, 0x0, 0x0, 0x0) r2 = gettid() ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f0000000040)={r1}) r4 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000140)='SEG6\x00') sendmsg$SEG6_CMD_GET_TUNSRC(r3, &(0x7f0000000200)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB, @ANYRES16=r4, @ANYBLOB="00022bbd7000fddbdf25040000000c000400e4ae00000800000014000100fe880000000000000000000000000101"], 0x34}, 0x1, 0x0, 0x0, 0x20000000}, 0x4000004) timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)=0x0) clock_gettime(0x0, &(0x7f0000001100)={0x0}) timer_settime(r5, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r6}}, 0x0) r7 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) dup2(r7, r1) tkill(r2, 0x15) 13:47:53 executing program 1: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-vsock\x00', 0x2, 0x0) clone(0x100002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) dup2(r2, r0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1e2ba62e) recvfrom(r0, 0x0, 0x0, 0x2000, 0x0, 0xffffffffffffffc2) recvfrom(r2, &(0x7f0000000180)=""/184, 0xfffffffffffffd84, 0x10100, 0x0, 0xfffffffffffffd51) 13:47:53 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x30710000000000, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:47:53 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x6000000}) 13:47:53 executing program 2: socket$netlink(0x10, 0x3, 0x0) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='fdinfo/3\x00') exit(0x4) pread64(r0, 0x0, 0x0, 0x3) 13:47:53 executing program 4: signalfd4(0xffffffffffffffff, &(0x7f0000000ff8), 0x8, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000340), 0x10000014c) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0xb00020000000000}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 13:47:53 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x7000000}) [ 2475.040504] binder: 28166:28170 ioctl c0306201 20000600 returned -14 13:47:53 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0xa0500000000000, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) [ 2475.106803] binder_thread_release: 4 callbacks suppressed [ 2475.106817] binder: release 28166:28170 transaction 3524 in, still active [ 2475.148609] binder_send_failed_reply: 5 callbacks suppressed [ 2475.148658] binder: send failed reply for transaction 3524 to 28166:28170 13:47:53 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) pread64(r1, 0x0, 0x0, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000001100)={0x0}) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r3}}, 0x0) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) modify_ldt$read(0x0, &(0x7f00000004c0)=""/214, 0xd6) fgetxattr(r0, &(0x7f0000000480)=ANY=[@ANYBLOB="737973748d790bf302399d90a4b3e2c1fa26656d2e76626f45bc0cfaaf1c"], &(0x7f00000003c0)=""/85, 0x55) exit_group(0x2) getsockopt$IP_VS_SO_GET_DESTS(r4, 0x0, 0x484, &(0x7f0000000240)=""/252, &(0x7f0000000340)=0xfc) dup2(r4, r1) getsockopt$IPT_SO_GET_ENTRIES(r4, 0x0, 0x41, &(0x7f0000000100)={'filter\x00', 0xf9, "a9b21fc06d67e8dea8c9f52d5f459c19565f794da53136578f317215088337ac221948d43e174cba84d9288ba424daa5f9ad015cea3d9f4be463c98a7f660ddada69e6a48dd9b9192eefda6dbe5d24c87270b17f915bd0245d1d260abb7beb67f5cb23a9cc3b75c29f16e51ef32a24b7ba3e678ecd57a1934f754348035c0a0981607f0b3c1470757c653fb505114397bc7bf7af41b11d1b6dc6d5840139c8ecf56d29751875c3f8cd233ddcfd954cf187d7313b7e34ae3a1324f36c10c3babbbc53150f3d25c21dc2c103d1bd83f093fa21f2a7d04d223a6e96b5ede0abd19816c5d4b84dd3e9a340a83dc293c1ccc0e14420f22f0fd990f9"}, &(0x7f0000000080)=0x11d) bind$isdn_base(r4, &(0x7f0000000380)={0x22, 0xf90d, 0x8, 0x1, 0x4}, 0x6) tkill(r2, 0x15) 13:47:53 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x8000000}) [ 2475.202978] binder_release_work: 4 callbacks suppressed [ 2475.202985] binder: undelivered TRANSACTION_COMPLETE [ 2475.232727] binder_release_work: 3 callbacks suppressed [ 2475.232734] binder: undelivered TRANSACTION_ERROR: 29189 13:47:53 executing program 1: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-vsock\x00', 0x2, 0x0) clone(0x20004, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x100000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = dup2(r2, r0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1e2ba62e) recvfrom(r1, 0x0, 0x0, 0x0, 0x0, 0x0) write$cgroup_type(r3, &(0x7f00000000c0)='threaded\x00', 0x9) statx(r3, &(0x7f0000000100)='./file0\x00', 0x1000, 0xd00, &(0x7f0000000240)) recvfrom(r2, &(0x7f0000000180)=""/184, 0xfffffffffffffd84, 0x10100, 0x0, 0xfffffffffffffd51) 13:47:53 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0xa0700000000000, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) [ 2475.256319] binder: 28269:28286 ioctl c0306201 20000600 returned -14 [ 2475.287704] binder: release 28269:28286 transaction 3526 in, still active [ 2475.306628] binder: send failed reply for transaction 3526 to 28269:28286 [ 2475.330673] binder: undelivered TRANSACTION_COMPLETE 13:47:53 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0xa000000}) [ 2475.353522] binder: undelivered TRANSACTION_ERROR: 29189 [ 2475.372339] binder: 28294:28296 ioctl c0306201 20000600 returned -14 13:47:53 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) pread64(r1, 0x0, 0x0, 0x0) syz_open_dev$dmmidi(&(0x7f0000000080)='/dev/dmmidi#\x00', 0x4, 0x400000) r2 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000001100)={0x0}) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r3}}, 0x0) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) dup2(r4, r1) tkill(r2, 0x3d) 13:47:53 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x10000000}) 13:47:53 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x100000000000000, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) [ 2475.470112] binder: release 28294:28296 transaction 3528 in, still active [ 2475.480895] binder: send failed reply for transaction 3528 to 28294:28296 [ 2475.501494] binder: undelivered TRANSACTION_COMPLETE [ 2475.538172] binder: undelivered TRANSACTION_ERROR: 29189 [ 2475.572990] binder: 28407:28408 ioctl c0306201 20000600 returned -14 [ 2475.648291] binder: release 28407:28408 transaction 3530 in, still active [ 2475.655290] binder: send failed reply for transaction 3530 to 28407:28408 [ 2475.668253] binder: undelivered TRANSACTION_COMPLETE [ 2475.673416] binder: undelivered TRANSACTION_ERROR: 29189 13:47:53 executing program 2: socket$netlink(0x10, 0x3, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x9, &(0x7f0000000040)='fdinfo/3\x00', 0xffffffffffffffff}, 0x30) r1 = syz_open_procfs(r0, &(0x7f0000000000)='fdinfo/3\x00') exit(0x0) ioctl$NBD_DISCONNECT(r1, 0xab08) pread64(r1, 0x0, 0x0, 0x3) 13:47:54 executing program 4: signalfd4(0xffffffffffffffff, &(0x7f0000000ff8), 0x8, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000340), 0x10000014c) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0xd00000000000000}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 13:47:54 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x1a0f0000}) 13:47:54 executing program 1: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-vsock\x00', 0x2, 0x0) clone(0x100002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) dup2(r2, r0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1e2ba62e) recvfrom(r1, 0x0, 0x0, 0x0, 0x0, 0x0) lgetxattr(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)=@known='trusted.overlay.nlink\x00', &(0x7f0000000240)=""/195, 0xc3) recvfrom(r2, &(0x7f0000000180)=""/184, 0xfffffffffffffd84, 0x10100, 0x0, 0xfffffffffffffd51) 13:47:54 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) pread64(r1, 0x0, 0x0, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000001100)) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) dup2(r3, r1) openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x80000) tkill(r2, 0x15) ioctl$IMHOLD_L1(r3, 0x80044948, &(0x7f0000000080)=0x7ff) 13:47:54 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x200000000000000, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:47:54 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x1f000000}) [ 2476.055883] binder: 28417:28421 ioctl c0306201 20000600 returned -14 13:47:54 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x300000000000000, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) [ 2476.097326] binder: release 28417:28421 transaction 3532 in, still active [ 2476.105015] binder: send failed reply for transaction 3532 to 28417:28421 [ 2476.113737] binder: undelivered TRANSACTION_COMPLETE [ 2476.119093] binder: undelivered TRANSACTION_ERROR: 29189 13:47:54 executing program 1: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-vsock\x00', 0x2, 0x0) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f0000000240)={0x0, @in6={{0xa, 0x4e24, 0x4, @ipv4={[], [], @remote}, 0x10001}}}, &(0x7f0000000100)=0x84) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(r2, 0x84, 0x7c, &(0x7f0000000140)={r3, 0x2, 0xfffffffffffffffa}, &(0x7f0000000300)=0x8) clone(0x200, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) setsockopt$inet6_dccp_int(r1, 0x21, 0xb, &(0x7f0000000040)=0x5, 0x4) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r5, r0) write$binfmt_misc(r4, &(0x7f0000000140)=ANY=[], 0x1e2ba62e) recvfrom(r4, 0x0, 0x0, 0x0, 0x0, 0x0) recvfrom(r5, &(0x7f0000000180)=""/184, 0xfffffffffffffd84, 0x10100, 0x0, 0xfffffffffffffd51) keyctl$session_to_parent(0x12) 13:47:54 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x20000000}) [ 2476.186200] binder: 28480:28516 ioctl c0306201 20000600 returned -14 13:47:54 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x400000000000000, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) [ 2476.299076] binder: release 28480:28516 transaction 3534 in, still active [ 2476.314541] binder: send failed reply for transaction 3534 to 28480:28516 [ 2476.348924] binder: undelivered TRANSACTION_COMPLETE [ 2476.367675] binder: undelivered TRANSACTION_ERROR: 29189 13:47:54 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x3f000000}) [ 2476.402956] binder: 28542:28544 ioctl c0306201 20000600 returned -14 [ 2476.442309] binder: release 28542:28544 transaction 3536 in, still active [ 2476.463905] binder: send failed reply for transaction 3536 to 28542:28544 [ 2476.488223] binder: undelivered TRANSACTION_COMPLETE [ 2476.505791] binder: undelivered TRANSACTION_ERROR: 29189 13:47:54 executing program 2: socket$netlink(0x10, 0x3, 0x0) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='fdinfo/3\x00') getsockopt$inet_sctp_SCTP_I_WANT_MAPPED_V4_ADDR(r0, 0x84, 0xc, &(0x7f0000000000), &(0x7f0000000040)=0x4) exit(0x0) pread64(r0, 0x0, 0x0, 0x3) 13:47:55 executing program 4: signalfd4(0xffffffffffffffff, &(0x7f0000000ff8), 0x8, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000340), 0x10000014c) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0xe00000000000000}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 13:47:55 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x500000000000000, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:47:55 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x48000000}) [ 2477.066348] binder: 28656:28657 ioctl c0306201 20000600 returned -14 [ 2477.105670] binder: release 28656:28657 transaction 3538 in, still active [ 2477.122745] binder: send failed reply for transaction 3538 to 28656:28657 [ 2477.143317] binder: undelivered TRANSACTION_COMPLETE [ 2477.152035] binder: undelivered TRANSACTION_ERROR: 29189 13:48:05 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) r2 = syz_open_dev$mice(&(0x7f0000000080)='/dev/input/mice\x00', 0x0, 0x0) write$FUSE_INIT(r2, &(0x7f0000000100)={0xffffffffffffffbb, 0x0, 0x3, {0x7, 0x1c, 0x10001, 0x2000, 0x100, 0x7fffffff, 0x101}}, 0xfffffffffffffec3) pread64(r1, 0x0, 0x0, 0x0) prctl$PR_SET_THP_DISABLE(0x29, 0x1) getsockopt$inet_IP_IPSEC_POLICY(r2, 0x0, 0x10, &(0x7f0000000180)={{{@in=@loopback, @in6=@mcast1}}, {{@in6=@empty}, 0x0, @in6=@mcast1}}, &(0x7f0000000280)=0xe8) r3 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000001100)={0x0}) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r4}}, 0x0) r5 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) dup2(r5, r1) tkill(r3, 0x15) 13:48:05 executing program 1: r0 = syz_open_dev$video(&(0x7f0000000240)='/dev/video#\x00', 0x5, 0x4000) ioctl$VIDIOC_ENUMSTD(r0, 0xc0485619, &(0x7f0000000280)={0x15, 0x10003, "a9c75fe243589900f301594c3fbb4cfe7cc31a031347e7a7", {0x8, 0x4}, 0x8}) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-vsock\x00', 0x2, 0x0) clone(0x100002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$sock_netrom_SIOCDELRT(r1, 0x890c, &(0x7f0000000100)={0x1, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @rose={'rose', 0x0}, 0x5, 'syz1\x00', @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, 0x6, 0x0, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}) r4 = dup2(r3, r1) write$binfmt_misc(r2, &(0x7f0000000280)=ANY=[], 0x2bc375f) recvfrom(r2, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$TUNSETOFFLOAD(r4, 0x400454d0, 0x4) ioctl$KVM_CREATE_PIT2(r4, 0x4040ae77, &(0x7f00000000c0)={0x82}) recvfrom(r3, &(0x7f0000000180)=""/184, 0xfffffffffffffd84, 0x10100, 0x0, 0xfffffffffffffd51) 13:48:05 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x4c000000}) 13:48:05 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x600000000000000, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:48:05 executing program 2: socket$netlink(0x10, 0x3, 0x0) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='fdinfo/3\x00') exit(0x0) pread64(r0, 0x0, 0x0, 0x3) setsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r0, 0x84, 0x13, &(0x7f0000000000)=0x62d31455, 0x4) 13:48:05 executing program 4: signalfd4(0xffffffffffffffff, &(0x7f0000000ff8), 0x8, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000340), 0x10000014c) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0xf00000000000000}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 13:48:05 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x60000000}) [ 2487.646229] binder: 28673:28675 ioctl c0306201 20000600 returned -14 13:48:05 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x700000000000000, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) [ 2487.695825] binder: release 28673:28675 transaction 3540 in, still active [ 2487.719614] binder: send failed reply for transaction 3540 to 28673:28675 [ 2487.743580] binder: undelivered TRANSACTION_COMPLETE 13:48:05 executing program 1: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-vsock\x00', 0x2, 0x0) clone(0x100002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = dup2(r2, r0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1e2ba62e) recvfrom(r1, 0x0, 0x0, 0x0, 0x0, 0x0) recvfrom(r2, &(0x7f0000000180)=""/184, 0xfffffffffffffd84, 0x10100, 0x0, 0xfffffffffffffd51) r4 = getpgrp(0x0) perf_event_open(&(0x7f00000000c0)={0x7, 0x70, 0x3, 0x3, 0x10000, 0x9, 0x0, 0x81, 0x2000, 0x6, 0xff, 0xafe, 0xe0ea, 0x1, 0x287ea523, 0x81, 0xfffffffffffff801, 0x100, 0x4, 0x5, 0x1, 0xd43, 0x800, 0x0, 0x1, 0x8, 0x3670, 0x0, 0xf8ed, 0x3, 0x6144, 0x72, 0x5, 0x5, 0x6, 0x200, 0xaa, 0x4, 0x0, 0x5, 0x6, @perf_config_ext={0x1, 0x10001}, 0x490, 0x0, 0x3, 0x8, 0x6, 0x8001, 0xf15}, r4, 0xd, r3, 0x0) 13:48:05 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) pread64(r1, 0x0, 0x0, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) r3 = syz_open_dev$midi(&(0x7f0000000080)='/dev/midi#\x00', 0x1, 0x101000) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000100)={0x0, 0xff, 0x7}, &(0x7f0000000140)=0x8) getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF(r3, 0x84, 0x66, &(0x7f0000000180)={r4}, &(0x7f00000001c0)=0x8) clock_gettime(0x0, &(0x7f0000001100)={0x0}) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r5}}, 0x0) r6 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) ioctl$PPPIOCGIDLE(r6, 0x8010743f, &(0x7f0000000200)) dup2(r6, r1) tkill(r2, 0x15) [ 2487.772769] binder: undelivered TRANSACTION_ERROR: 29189 [ 2487.804014] binder: 28786:28788 ioctl c0306201 20000600 returned -14 13:48:05 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x68000000}) 13:48:05 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0xa00000000000000, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) [ 2487.905833] binder: release 28786:28788 transaction 3542 in, still active [ 2487.943323] binder: send failed reply for transaction 3542 to 28786:28788 13:48:06 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x6c000000}) [ 2487.982783] binder: undelivered TRANSACTION_COMPLETE 13:48:06 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) pread64(r1, 0x0, 0x0, 0x0) write$binfmt_misc(r1, &(0x7f0000000100)={'syz0', "6e75b35681370073e881524c9ea669a9245acb142676432de7609385727a0b5c3a27bfaa43c2dc83d59b3ac348562a05ad7026fb949a2390ac6e87dc35193a9f997bdda31d774a88e74ba3b221fcd10b38"}, 0x55) r2 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000001100)={0x0}) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r3}}, 0x0) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) dup2(r4, r1) tkill(r2, 0x15) [ 2488.004325] binder: undelivered TRANSACTION_ERROR: 29189 [ 2488.042467] binder: 28827:28835 ioctl c0306201 20000600 returned -14 13:48:06 executing program 1: openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-vsock\x00', 0x2, 0x0) clone(0x100002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) dup2(r1, r2) write$binfmt_misc(r0, &(0x7f0000000140)=ANY=[], 0x1e2ba62e) recvfrom(r0, 0x0, 0x0, 0x0, 0x0, 0x0) recvfrom(r1, &(0x7f0000000180)=""/184, 0xfffffffffffffd84, 0x10100, 0x0, 0xfffffffffffffd51) 13:48:06 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x2000000000000000, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) [ 2488.132935] binder: release 28827:28835 transaction 3544 in, still active [ 2488.147219] binder: send failed reply for transaction 3544 to 28827:28835 [ 2488.181443] binder: undelivered TRANSACTION_COMPLETE [ 2488.203688] binder: undelivered TRANSACTION_ERROR: 29189 [ 2488.225640] binder: 28909:28910 ioctl c0306201 20000600 returned -14 [ 2488.293118] binder: release 28909:28910 transaction 3546 in, still active [ 2488.305269] binder: send failed reply for transaction 3546 to 28909:28910 [ 2488.331175] binder: undelivered TRANSACTION_COMPLETE [ 2488.347027] binder: undelivered TRANSACTION_ERROR: 29189 13:48:06 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) pread64(r1, 0x0, 0x0, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000001100)={0x0}) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r3}}, 0x0) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) dup2(r4, r1) setsockopt$inet6_tcp_TCP_CONGESTION(r4, 0x6, 0xd, &(0x7f0000000080)='veno\x00', 0x5) tkill(r2, 0x15) 13:48:06 executing program 4: signalfd4(0xffffffffffffffff, &(0x7f0000000ff8), 0x8, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000340), 0x10000014c) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1000000000000000}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 13:48:06 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x74000000}) 13:48:06 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x4800000000000000, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:48:06 executing program 2: socket$netlink(0x10, 0x3, 0xfffffffffffffffd) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='fdinfo/3\x00') exit(0x0) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f0000000200)={0x0, @in6={{0xa, 0x4e21, 0x101, @mcast1, 0xfff}}, 0x9, 0x0, 0x1000, 0x10000, 0x16f0}, &(0x7f00000002c0)=0x98) setsockopt$inet_sctp_SCTP_AUTH_KEY(r0, 0x84, 0x17, &(0x7f0000000300)={r1, 0x5, 0xaa, "ba24f79dae1cfce2d95879a281964bfd7f01faa6de5f6cd23679d88a1f77b6804c41e9f33317e80f4f79c7a514f5027229036f2d5a4dd5397ca5bf0c995b8688f567e2008eea0d0e954d6418ab3595cd2b97163e99ae74f585faef9b90808ec8274ac95a94a2409fa2d4e6fb2799c65bfdab4e9c0903aa94d1fc45c1203a1578d7989f9045b53ef986e66d68fe26365a107ea18446dda60061ae2092271b3a6702731f5b0e4cfe7b8b4e"}, 0xb2) pread64(r0, 0x0, 0x0, 0x3) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000040)='TIPCv2\x00') sendmsg$TIPC_NL_MON_GET(r0, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000180)={&(0x7f00000000c0)={0x84, r2, 0x0, 0x70bd2b, 0x25dfdbfb, {}, [@TIPC_NLA_SOCK={0x30, 0x2, [@TIPC_NLA_SOCK_ADDR={0x8}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x8}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x99}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x4}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x1f}]}, @TIPC_NLA_NET={0x1c, 0x7, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0x7}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x42}]}, @TIPC_NLA_MON={0x24, 0x9, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x1f}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x7}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x3}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x6}]}]}, 0x84}, 0x1, 0x0, 0x0, 0x840}, 0x1) 13:48:06 executing program 1: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-vsock\x00', 0x2, 0x0) clone(0x100002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = dup2(r2, r0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1e2ba62e) recvfrom(r1, 0x0, 0x6, 0x40000040, 0x0, 0x32f) memfd_create(&(0x7f00000000c0)='self^--%$\x00', 0x1) recvfrom(r2, &(0x7f0000000180)=""/184, 0xfffffffffffffd84, 0x10101, 0x0, 0xffffffffffffff17) setsockopt$ALG_SET_AEAD_AUTHSIZE(r3, 0x117, 0x5, 0x0, 0x3) 13:48:06 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) sysinfo(&(0x7f0000000080)=""/42) pread64(r1, 0x0, 0x0, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000001100)={0x0}) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r3}}, 0x0) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) dup2(r4, r1) tkill(r2, 0x1e) [ 2488.658329] binder: 29029:29030 ioctl c0306201 20000600 returned -14 13:48:06 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x7a000000}) 13:48:06 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x4c00000000000000, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) [ 2488.728718] binder: release 29029:29030 transaction 3548 in, still active [ 2488.736922] binder: send failed reply for transaction 3548 to 29029:29030 [ 2488.758646] binder: undelivered TRANSACTION_COMPLETE [ 2488.778491] binder: undelivered TRANSACTION_ERROR: 29189 13:48:06 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/qat_adf_ctl\x00', 0x40, 0x0) ioctl$KVM_SET_IDENTITY_MAP_ADDR(r1, 0x4008ae48, &(0x7f0000000100)=0xf000) r2 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) pread64(r2, 0x0, 0x0, 0x0) r3 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000001100)={0x0}) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r4}}, 0x0) r5 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/vcs\x00', 0x10000000000, 0x0) dup2(r5, r2) tkill(r3, 0x15) 13:48:06 executing program 1: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-vsock\x00', 0x2, 0x0) clone(0x100002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = dup2(r2, r0) ioctl$VIDIOC_ENUMAUDIO(r3, 0xc0345641, &(0x7f00000000c0)={0xffffffffffffff00, "198bc3e07ad7f9948e06b44de489496d7c33824d92dfb34931d6710bd214d54f", 0x2, 0x1}) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1e2ba62e) recvfrom(r1, 0x0, 0x0, 0x0, 0x0, 0x0) recvfrom(r2, &(0x7f0000000180)=""/184, 0xfffffffffffffd84, 0x10100, 0x0, 0xfffffffffffffd51) 13:48:06 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x8aaa0300}) [ 2488.842918] binder: 29115:29116 ioctl c0306201 20000600 returned -14 [ 2488.910401] QAT: Invalid ioctl 13:48:06 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x6000000000000000, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) [ 2488.941978] binder: release 29115:29116 transaction 3550 in, still active [ 2488.951501] binder: send failed reply for transaction 3550 to 29115:29116 [ 2488.967387] binder: undelivered TRANSACTION_COMPLETE [ 2488.990685] binder: undelivered TRANSACTION_ERROR: 29189 [ 2488.997781] QAT: Invalid ioctl [ 2489.033593] binder: 29155:29157 ioctl c0306201 20000600 returned -14 [ 2489.155817] binder: release 29155:29157 transaction 3552 in, still active [ 2489.169103] binder: send failed reply for transaction 3552 to 29155:29157 [ 2489.206077] binder: undelivered TRANSACTION_COMPLETE [ 2489.227093] binder: undelivered TRANSACTION_ERROR: 29189 13:48:07 executing program 4: signalfd4(0xffffffffffffffff, &(0x7f0000000ff8), 0x8, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000340), 0x10000014c) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1100000000000000}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 13:48:07 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x8baa0300}) 13:48:07 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) pread64(r1, 0x0, 0x0, 0x0) gettid() ioctl$sock_TIOCINQ(r0, 0x541b, &(0x7f00000002c0)) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) clock_gettime(0x0, &(0x7f0000000200)={0x0, 0x0}) openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f00000003c0)='/proc/capi/capi20ncci\x00', 0x82, 0x0) timerfd_settime(r3, 0x1, &(0x7f0000000240)={{0x77359400}, {r4, r5+30000000}}, &(0x7f0000000280)) timer_create(0x100000000000, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000001100)={0x0}) r7 = openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/sequencer\x00', 0x20002, 0x0) getsockopt$ARPT_SO_GET_INFO(r7, 0x0, 0x60, &(0x7f0000000100)={'filter\x00'}, &(0x7f0000000180)=0x44) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r6}}, 0x0) r8 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) dup2(r8, r1) r9 = syz_genetlink_get_family_id$tipc(&(0x7f0000000380)='TIPC\x00') sendmsg$TIPC_CMD_SHOW_LINK_STATS(r3, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000400)={&(0x7f0000000500)=ANY=[@ANYBLOB="3802000045cad89bc8516dd54c50339dee9fa22b5275ed47e650828d4c9e81939fcf205755f4c3efc70c2592551c1303dd57225170fc52e054baf3f70959e795e4a75107f63e548ab30994838f99fbf4cdb5e51ac75bbdbb8bd2df199efde6d3404aa4dbe0641708d6609f24e2a121bd1f3230a41f4245cace575cdbe0b894e08132030ae0a55bd02f74d6154a47893722fa63fce7ba4cd208639f1e15aa006eb4373c74aff3a8bb1af7dea4fbfa8535e296a37e3b3890b73a0cf26136767619c9320cd6279f0898276e4559c7fa4dd561af3824d18ed6707872594105000000513315c9a7cce9031b5b809340fd836812ed78dfd26e0e931ccc3aa504d569e5bdea053d947938f07f18a5dcef987dd32a", @ANYRES16=r9, @ANYBLOB="080228bd7000fbdbdf2501000000000000000b0000000014001462726f6164636173742d6c696e6b0000"], 0x30}, 0x1, 0x0, 0x0, 0x40000}, 0x880) ioctl$VT_RESIZEX(r2, 0x560a, &(0x7f0000000300)={0x54, 0x4, 0x5, 0x249, 0x4, 0x71}) 13:48:07 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x6800000000000000, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:48:07 executing program 1: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-vsock\x00', 0x2, 0x0) clone(0x100002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = syz_open_dev$amidi(&(0x7f0000000340)='/dev/amidi#\x00', 0x0, 0x200400) ioctl$VIDIOC_ENUM_FREQ_BANDS(r1, 0xc0405665, &(0x7f00000004c0)={0x80000001, 0x7, 0x100000001, 0x400, 0x1a8000000000, 0x7fffffff, 0x4}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$EVIOCGKEYCODE(r1, 0x80084504, &(0x7f0000000500)=""/61) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r4 = dup2(r3, r0) chroot(&(0x7f0000000100)='./file0\x00') write$binfmt_misc(r2, &(0x7f0000000140)=ANY=[], 0x1e2ba62e) accept4$netrom(r4, &(0x7f0000000240)={{0x3, @rose}, [@rose, @remote, @netrom, @netrom, @netrom, @default, @netrom, @null]}, &(0x7f0000000140)=0x48, 0x80000) setsockopt$inet_dccp_int(r4, 0x21, 0x5, &(0x7f00000000c0)=0x9, 0x4) ioctl$VIDIOC_TRY_DECODER_CMD(r4, 0xc0485661, &(0x7f00000002c0)={0x7, 0x2, @start={0x44d}}) recvfrom(r2, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffb2) recvfrom(r3, &(0x7f0000000180)=""/184, 0x30803189b458ea52, 0x10041, 0x0, 0xfe8a) setsockopt$ARPT_SO_SET_REPLACE(r4, 0x0, 0x60, &(0x7f0000000980)=ANY=[@ANYBLOB="66696c746572000000000000000000000000000000000000000000000000000007000000040000007004000040010000000000007002000088030000880300008803000004000000848c0407467f9e4f91b8ed48ce31e434bdb404c22697166b33264a9636ec2d136aa30bc2a60e78a5b1e6bd1777d99db5a18d65197bff66f33c43f5ab10823dd4c40226886cff3d983960eeabbfb2e2414f3d0d3eb125bc74d1cacedaab16a2cd8112f7169a5eb67760878ede0413fa4b357c0121c656765e68ca15b85712f3b55b465a7c61d686af3866d68c0e1c54d157a239c12cd82d7867c54ff8a0fd31fbb83ade7d6bcd07ba85c5d750dd8f05aa8d74d4972a6426ab0229953e6b031a381f8fc7cc1c5df14510d2af22", @ANYPTR=&(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000052b51e81cea8967451ac3a125fa44aff7659ccc799554e9db20bc2f4e469392bbad3a83391cbae5347a624996e0cab0e2dc55682c1a77cee925ffdd39e064eea82aae29051c1be91a9be8d15ba5d48c13500a1833a6f597ad755cafca5bc5100cb42636ee916718c01a8a8c9756c93ff7a8e9b9a63c4904c669481b92f752cc0dc59f16e037cd6874d1e7138e001e58385d47805213c63a010cc4061a0c5fe162f6d2e8e5cde8f97095688d1788c08dba3dea435b9763431bff1f3f941"], @ANYBLOB="000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0004001000000000000000000000000000000000000000000000000000050006d616e676c6500000000000000000000000000000000000000000000000000000000000000000000000000000000aaaaaaaaaabb00000000000000000000ac1e0001ac1e010148000000ffffffffffffffffe0000001000000ffffffff000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000aaaaaaaaaaaa000000000000000000000000000000000000ff0000ffff00000000000000000000000003000500000fff000900016970366772657461703000000000000076657468315f746f5f6272696467650000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000f00030010000000000000000000000000000000000000000000000000000400052415445455354000000000000000000000000000000000000000000000073797a3000000000000000000000000008ff0000000000000000008000000000ac1414aa00000000ffffffffff000000000000000000000000000000000000000000000000000000ff0000ffffff00000000000000000000000000000000000000000000000000000000000000000000000000ff0000000000000000000000000022000700050000000500006e7230000000000000000000000000007465616d5f736c6176655f300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a10000000000000000000000f0001801000000000000000000000000000000000000000000000000000028004e465155455545000000000000000000000000000000000000000000000302007000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c000e8000000000000000000000000000000000000000000000000002800000000000000000000000000000000000000000000000000000000000000feffffff00000000"], 0x4c0) 13:48:07 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='fdinfo/3\x00') exit(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000040)={0x2000}) pread64(r1, 0x0, 0x0, 0x3) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000)='/dev/hwrng\x00', 0x224202, 0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f00000000c0)={0x10000000}) 13:48:07 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0xe4ffffff}) [ 2489.663125] binder: 29262:29267 ioctl c0306201 20000600 returned -14 13:48:07 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x6c00000000000000, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) [ 2489.756839] binder: release 29262:29267 transaction 3554 in, still active [ 2489.766518] binder: send failed reply for transaction 3554 to 29262:29267 [ 2489.776701] binder: undelivered TRANSACTION_COMPLETE [ 2489.782967] binder: undelivered TRANSACTION_ERROR: 29189 13:48:07 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0xfdfdffff}) [ 2489.816975] binder: 29323:29337 ioctl c0306201 20000600 returned -14 13:48:07 executing program 1: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-vsock\x00', 0x2, 0x0) clone(0x100002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) dup2(r1, r0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1e2ba62e) recvfrom(r1, 0x0, 0x0, 0x0, 0x0, 0x0) recvfrom(r2, &(0x7f0000000180)=""/184, 0xfffffffffffffd84, 0x10100, 0x0, 0xfffffffffffffd51) 13:48:07 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x7400000000000000, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) [ 2489.901022] binder: release 29323:29337 transaction 3556 in, still active [ 2489.925522] binder: send failed reply for transaction 3556 to 29323:29337 13:48:08 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0xfffffdfd}) [ 2489.952101] binder: undelivered TRANSACTION_COMPLETE [ 2489.970701] binder: undelivered TRANSACTION_ERROR: 29189 [ 2489.987263] binder: 29389:29390 ioctl c0306201 20000600 returned -14 [ 2490.080468] binder: release 29389:29390 transaction 3558 in, still active [ 2490.092924] binder: send failed reply for transaction 3558 to 29389:29390 [ 2490.121282] binder: undelivered TRANSACTION_COMPLETE [ 2490.142183] binder: undelivered TRANSACTION_ERROR: 29189 13:48:08 executing program 4: signalfd4(0xffffffffffffffff, &(0x7f0000000ff8), 0x8, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000340), 0x10000014c) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x2000000000000000}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 13:48:08 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x7a00000000000000, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:48:08 executing program 1: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-vsock\x00', 0x2, 0x0) clone(0x503fffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r4 = dup2(r2, r0) write$binfmt_misc(r2, &(0x7f0000000300)=ANY=[@ANYRESHEX=r4, @ANYPTR, @ANYRES64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYRES32=r1, @ANYRESHEX=r4, @ANYPTR64, @ANYBLOB="66349fe53bc3cfcf63af6fa32fb97a7f53505cfe48c93b64dae07b6b76ecf5cce8026ed85ff6c45740ca4218faf22f3593787231130d7b269604bc7268125d7df898b4279041b5ac89a39d7db3c5263e318ef2b60e7ea48fcc0bed945b42189c9da5a8c6db24acffcf438ca5fcdde8eb4902bf4d14dde294bd033e563ca84ba1255492c25d4fa1fa9f101d449d0320ac", @ANYRES32=r4, @ANYRES16=r0], @ANYRES32, @ANYRES32=r3, @ANYRESDEC, @ANYBLOB="4ad2", @ANYRESOCT=r3], 0x5f) recvfrom(r1, 0x0, 0xfffffffffffffeda, 0x0, 0x0, 0x0) setsockopt(r2, 0x0, 0x4, &(0x7f00000000c0)="7305f22257a2459871fd6be041412ec7bd430e96628d0230f3d5d095b6a4e4e1e98432bb58f380ab78fb5336a41145e91627f00a717c73bb465234da90cd", 0x3e) recvfrom(r2, &(0x7f0000000180)=""/184, 0xfffffffffffffd84, 0x10100, 0x0, 0xfffffffffffffd51) 13:48:08 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0xffffff7f}) 13:48:08 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) pread64(r1, 0x0, 0x0, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) open(&(0x7f0000000140)='./file0\x00', 0x402000, 0x1) clock_gettime(0x0, &(0x7f0000001100)={0x0}) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r3}}, 0x0) ioctl$DRM_IOCTL_GEM_OPEN(r1, 0xc010640b, &(0x7f0000000080)={0x0, 0x0, 0x8}) ioctl$DRM_IOCTL_GEM_CLOSE(r1, 0x40086409, &(0x7f0000000100)={r4}) r5 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) dup2(r5, r1) tkill(r2, 0x15) 13:48:08 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='fdinfo/3\x00') r2 = fcntl$getown(r0, 0x9) ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r1, 0xc1105511, &(0x7f00000000c0)={{0x5, 0x3, 0x1, 0x100, '\x00', 0xfff}, 0x5, 0x13, 0x9, r2, 0x0, 0x3, 'syz1\x00', &(0x7f0000000000), 0x0, [], [0x80, 0x4, 0xc, 0x6728]}) exit(0x0) pread64(r1, 0x0, 0x0, 0x3) 13:48:08 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0xffffffe4}) [ 2490.697732] binder: 29508:29510 ioctl c0306201 20000600 returned -14 13:48:08 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0xffefffffff7f0000, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:48:08 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) pread64(r1, 0x0, 0x0, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x25, 0x1, @thr={&(0x7f0000000100)="78424693bd2a554bbce1d9574cb08e25df152a012abdcea95890ca7b6fd5a3cf2371592602e0b10ded27b4b795221770e4efac407a541179c840d9318151faa8b596df449e595032f10cf11885e78473574b3d7a9d45026c25a773c78a90250ce4a2baad2f5d024e298af9a19be1a4539c52bcbe0b9560ada9ea44705c12315dab4e5a973277f6066b2e19e5d8e0221db20dda7331e84fc841a72f9832ce18e192114f13981d62fedb8975d6ed3c16186d451dadcc19fd", &(0x7f00000001c0)="807383ec7079c2c9a7303cfb13ed8437c2f655a0a2b5e691da0f47d900dc36066e298557ab40a1d6133feb33efea82ad315a172b8c7c8e8b46539f32d3c24009de150725283085868510b1716b20330a5bc5d9c307945174371449a2441da7799c64292bca2d22c5e96b4bcf99ae0d7098"}}, &(0x7f0000000080)) clock_gettime(0x0, &(0x7f0000001100)={0x0}) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x989680}, {r3}}, 0x0) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) dup2(r4, r1) tkill(r2, 0x15) 13:48:08 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x1000000000}) [ 2490.835791] binder: 29522:29523 ioctl c0306201 20000600 returned -14 13:48:08 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x1000000000000}) 13:48:08 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0xffffffffff600000, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) [ 2490.965276] binder: 29531:29533 ioctl c0306201 20000600 returned -14 13:48:09 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x630b, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:48:09 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x100000000000000}) 13:48:09 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x800, 0x0) prctl$PR_TASK_PERF_EVENTS_ENABLE(0x20) ioctl$EVIOCGUNIQ(r1, 0x80404508, &(0x7f0000000040)=""/49) setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r0, 0x10e, 0x8, &(0x7f00000000c0)=0x3f, 0x4) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='fdinfo/3\x00') exit(0x0) write$binfmt_aout(r0, &(0x7f00000001c0)={{0x10b, 0x76eac45, 0x100, 0x283, 0x84, 0x3, 0x8d, 0x336}, "25f10cc62db0243dec3129b401d204640533ea06012029b4eb2c709e87dce2a2fd9cc47b8a4f52e09c02471c899552141b997ad026ba5ae76f7d7fafd22bcacc9541e4c5a800cb79fceab3d02da22705c87a95df0ecdfca40b462e8ece2ade4b09637db94f6f0311ec90e17a88bac482738845b0affb8085256406a6094e71bb9d3b3c2b8b89844d8616c879ed9a08dbddeb72c950b6eeba55f0a04cdf58cdc0c01b036e8b38e9cd2e0cb41bb29a38433878edaf84fbba8dcb030ae26d5c8c290951ab39b930aa"}, 0xe7) r3 = memfd_create(&(0x7f0000000380)='\vem1\xc1\xf8\xa6\x8dN\xc0\xa3\\\xe2\xcb\xa2\xba\xe5\xf4\x97\xac#*\xff', 0x2) r4 = syz_open_dev$sndpcmp(&(0x7f0000000140)='/dev/snd/pcmC#D#p\x00', 0x8, 0x8000) write(r3, &(0x7f0000000040)="0600", 0x2) write$FUSE_NOTIFY_STORE(r3, &(0x7f00000002c0)=ANY=[@ANYBLOB="40000000000025000400000005007c00000000000000280000000000"], 0x1c) ioctl$VIDIOC_S_PRIORITY(r4, 0x40045644, 0x3) ioctl$PPPIOCGNPMODE(r2, 0xc008744c, &(0x7f0000000180)) sendfile(r3, r3, &(0x7f0000001000), 0xffff) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x552d27a132292a21, 0x80011, r1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x7000)=nil, 0x7000, 0x80000000004, 0x11, r3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f000001a000)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r5, 0x1, 0x1a, &(0x7f000002eff0)={0x32b, &(0x7f0000000000)=[{}]}, 0x10) pread64(r2, 0x0, 0x0, 0x3) 13:48:09 executing program 4: signalfd4(0xffffffffffffffff, &(0x7f0000000ff8), 0x8, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000340), 0x10000014c) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x3372331ebc010000}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 13:48:09 executing program 1: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-vsock\x00', 0x2, 0x0) clone(0x100002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = dup2(r2, r0) write$binfmt_misc(r1, &(0x7f00000000c0)=ANY=[], 0xfffffffffffffcd0) getsockopt$bt_rfcomm_RFCOMM_LM(r3, 0x12, 0x3, &(0x7f00000000c0), &(0x7f0000000100)=0x4) recvfrom(r1, 0x0, 0x0, 0x0, 0x0, 0x0) recvfrom(r2, &(0x7f0000000180)=""/184, 0xfffffffffffffd84, 0x10100, 0x0, 0xfffffffffffffd51) [ 2491.732006] binder: 29642:29643 ERROR: BC_REGISTER_LOOPER called after BC_ENTER_LOOPER [ 2491.758605] binder: 29642:29643 unknown command 0 13:48:09 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x200000000000000}) [ 2491.779629] binder: 29642:29643 ioctl c0306201 20000600 returned -22 13:48:09 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x300000000000000}) 13:48:09 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x630c, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) [ 2491.882523] syz-executor.1 invoked oom-killer: gfp_mask=0x7080c0(GFP_KERNEL_ACCOUNT|__GFP_ZERO), order=3, oom_score_adj=1000 [ 2491.940307] CPU: 1 PID: 29641 Comm: syz-executor.1 Not tainted 5.0.0+ #6 [ 2491.947217] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2491.957119] Call Trace: [ 2491.959756] dump_stack+0x172/0x1f0 [ 2491.963459] dump_header+0x10f/0xb6c [ 2491.967213] ? _raw_spin_unlock_irqrestore+0xa4/0xe0 [ 2491.972360] ? ___ratelimit+0x60/0x595 [ 2491.976292] ? do_raw_spin_unlock+0x57/0x270 [ 2491.980751] oom_kill_process.cold+0x10/0x6f5 [ 2491.985298] ? task_will_free_mem+0x139/0x6e0 [ 2491.989857] out_of_memory+0x79a/0x1280 [ 2491.993876] ? mem_cgroup_unmark_under_oom+0x8d/0xb0 [ 2491.999027] ? oom_killer_disable+0x280/0x280 [ 2492.003566] ? mem_cgroup_unmark_under_oom+0x8d/0xb0 [ 2492.008719] mem_cgroup_out_of_memory+0x99/0xe0 [ 2492.008997] binder: 29675:29676 unknown command 0 [ 2492.013433] ? memcg_memory_event+0x40/0x40 [ 2492.013457] ? _raw_spin_unlock+0x2d/0x50 [ 2492.013472] ? mem_cgroup_unmark_under_oom+0x8d/0xb0 [ 2492.013486] try_charge+0xfec/0x1570 [ 2492.013501] ? find_held_lock+0x35/0x130 [ 2492.013522] ? mem_cgroup_oom_trylock+0x1a0/0x1a0 [ 2492.013538] ? get_mem_cgroup_from_mm+0x10b/0x2b0 [ 2492.013556] ? find_held_lock+0x35/0x130 [ 2492.032909] binder: 29675:29676 ioctl c0306201 20000600 returned -22 [ 2492.035787] ? get_mem_cgroup_from_mm+0x10b/0x2b0 [ 2492.035816] memcg_kmem_charge_memcg+0x7c/0x130 [ 2492.035833] ? memcg_kmem_put_cache+0xb0/0xb0 [ 2492.035853] ? get_mem_cgroup_from_mm+0x128/0x2b0 [ 2492.035870] memcg_kmem_charge+0x13b/0x340 [ 2492.035891] __alloc_pages_nodemask+0x437/0x710 [ 2492.088098] ? __alloc_pages_slowpath+0x2900/0x2900 [ 2492.093172] ? lockdep_hardirqs_on+0x415/0x5d0 [ 2492.097789] ? trace_hardirqs_on+0x67/0x230 [ 2492.102156] copy_process.part.0+0x3e0/0x79a0 [ 2492.106691] ? __free_object+0xe2/0x1f0 [ 2492.110694] ? find_held_lock+0x35/0x130 [ 2492.114792] ? __free_object+0xe2/0x1f0 [ 2492.118797] ? kasan_check_read+0x11/0x20 [ 2492.122978] ? _raw_spin_unlock_irqrestore+0x6b/0xe0 [ 2492.128101] ? __free_object+0xe2/0x1f0 [ 2492.132107] ? _raw_spin_unlock_irqrestore+0x6b/0xe0 [ 2492.137263] ? __cleanup_sighand+0x70/0x70 [ 2492.141531] ? _raw_spin_unlock_irqrestore+0xa4/0xe0 [ 2492.146694] ? __free_object+0xe2/0x1f0 [ 2492.150699] ? _raw_spin_unlock_irqrestore+0xa4/0xe0 [ 2492.155843] ? __hrtimer_init+0xe1/0x250 [ 2492.159950] _do_fork+0x257/0xfe0 [ 2492.163444] ? fork_idle+0x1d0/0x1d0 [ 2492.167192] ? blkcg_maybe_throttle_current+0x5d4/0xfd0 [ 2492.172595] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 2492.177384] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 2492.182365] ? do_syscall_64+0x26/0x610 [ 2492.186352] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 2492.191726] ? do_syscall_64+0x26/0x610 [ 2492.195715] __x64_sys_clone+0xbf/0x150 [ 2492.199709] do_syscall_64+0x103/0x610 [ 2492.203610] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 2492.208811] RIP: 0033:0x45a7f9 [ 2492.212013] Code: ff 48 85 f6 0f 84 d7 8e fb ff 48 83 ee 10 48 89 4e 08 48 89 3e 48 89 d7 4c 89 c2 4d 89 c8 4c 8b 54 24 08 b8 38 00 00 00 0f 05 <48> 85 c0 0f 8c ae 8e fb ff 74 01 c3 31 ed 48 f7 c7 00 00 01 00 75 [ 2492.230929] RSP: 002b:00007ffe94f55588 EFLAGS: 00000202 ORIG_RAX: 0000000000000038 [ 2492.238663] RAX: ffffffffffffffda RBX: 00007fc7dfbef700 RCX: 000000000045a7f9 [ 2492.245958] RDX: 00007fc7dfbef9d0 RSI: 00007fc7dfbeedb0 RDI: 00000000003d0f00 [ 2492.253248] RBP: 00007ffe94f55790 R08: 00007fc7dfbef700 R09: 00007fc7dfbef700 [ 2492.260537] R10: 00007fc7dfbef9d0 R11: 0000000000000202 R12: 0000000000000000 [ 2492.267830] R13: 00007ffe94f5563f R14: 0000000000020000 R15: 00000000014aeb70 [ 2492.298836] memory: usage 307172kB, limit 307200kB, failcnt 36 [ 2492.309006] memory+swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 2492.322621] kmem: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 2492.334347] Memory cgroup stats for /syz1: cache:104KB rss:194296KB rss_huge:2048KB shmem:184KB mapped_file:0KB dirty:0KB writeback:0KB swap:0KB inactive_anon:0KB active_anon:194400KB inactive_file:0KB active_file:0KB unevictable:0KB [ 2492.362722] oom-kill:constraint=CONSTRAINT_NONE,nodemask=(null),cpuset=syz1,mems_allowed=0-1,oom_memcg=/syz1,task_memcg=/syz1,task=syz-executor.1,pid=26391,uid=0 [ 2492.384558] Memory cgroup out of memory: Kill process 26391 (syz-executor.1) score 1160 or sacrifice child [ 2492.406849] Killed process 26391 (syz-executor.1) total-vm:73236kB, anon-rss:16580kB, file-rss:35796kB, shmem-rss:0kB [ 2492.436953] oom_reaper: reaped process 26391 (syz-executor.1), now anon-rss:0kB, file-rss:34836kB, shmem-rss:0kB 13:48:11 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x9, &(0x7f0000000300)="aa10df8737d18a2c944d1219c5b1641fa34c7e29ea2a7d5ee866b33c380fcb80a7ce638b0ec5bf913ee14625881601b35c8a01cd8f93071dc2e79316fdf335c877dcee67458813222dbe30fc455916b0a26f08fc319c2392d0dfcb7b135a83f3d2085a8884435c08967b87e97be53744f320abd8e3bf6d7f4820c7bd20") r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) pread64(r1, 0x0, 0x0, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000001100)={0x0}) r4 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000240)='/dev/btrfs-control\x00', 0x40, 0x0) ioctl$TCSETAF(r4, 0x5408, &(0x7f0000000180)={0x3, 0x80000001, 0xff, 0x0, 0x11, 0x7, 0x94f8, 0x100, 0x3, 0x28}) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r3}}, 0x0) setsockopt$inet_sctp6_SCTP_I_WANT_MAPPED_V4_ADDR(r4, 0x84, 0xc, &(0x7f00000001c0)=0xfffffffffffffffd, 0x4) r5 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) dup2(r5, r1) tkill(r2, 0x15) accept4$x25(r5, &(0x7f0000000080), &(0x7f0000000100)=0x12, 0x800) ioctl$DRM_IOCTL_AGP_ALLOC(r1, 0xc0206434, &(0x7f0000000140)={0x1, 0x0, 0x10001, 0x200}) ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$DRM_IOCTL_AGP_FREE(r5, 0x40206435, &(0x7f0000000200)={0x3, r6, 0x2, 0x6}) 13:48:11 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x400000000000000}) 13:48:11 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x630d, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:48:11 executing program 2: r0 = syz_open_dev$sndpcmp(&(0x7f0000000340)='/dev/snd/pcmC#D#p\x00', 0x8, 0x100) connect$can_bcm(r0, &(0x7f0000000380), 0x10) socket$netlink(0x10, 0x3, 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x50000, 0x0) ioctl$BLKZEROOUT(r1, 0x127f, &(0x7f0000000040)={0x5bd, 0x10000}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x48, 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="0c6300000063c02f493e4be7e5b6f5e7fcdde3342278a33fa20000c6eeda7641d618360000c46d44720200000000000000000000d1755bbd2f72740daf0db1a142af579184f1fa4b13adbe31e2bf19fa161fb4036f40af034f477ff8019088a401aaa68d82716cd418e51e087e001000004b629dc4e0d1b8b4c0a2729551cd124fb984efb57745ddd7fbf5a0295367e581aedfafc599cc89daf0120b19cfd288aadb9d6f970079d4f642aaa6eaf27275fc05294f0251b5fcda168b4161224ff78b94e586ca1c8eed51", @ANYPTR=&(0x7f0000000040)=ANY=[], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB='0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00\x00']], 0xa1, 0x0, &(0x7f0000000180)="2425fb58fb8c2d9fd92d9dffc23140b11c57d619bdcd8e2239826d4f16e719ff39d8c95b3e7ca301fc2418fd4b753d1ffef5d4250c8c2c0df3e734eac1c5122e878b3d3c094e4313365c0fd78233a85e7293e44ea6c6696665d217dc7e2f4112d533b4615ec634b4b1abb9147792d09585cca21630af028b9c9940c6101e77dac4010e44d71692294e3c8c2cc13c707e9f08ff29dcad5302c12a45e63e4d733016"}) ioctl$LOOP_GET_STATUS(r1, 0x4c03, &(0x7f0000000280)) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='fdinfo/3\x00') exit(0x0) pread64(r2, 0x0, 0x0, 0x3) 13:48:11 executing program 4: signalfd4(0xffffffffffffffff, &(0x7f0000000ff8), 0x8, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000340), 0x10000014c) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x4000000000000000}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 13:48:11 executing program 1: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-vsock\x00', 0x2, 0x0) clone(0x100002102201ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = syz_open_dev$radio(&(0x7f0000000140)='/dev/radio#\x00', 0x1, 0x2) ioctl$SIOCX25SCUDMATCHLEN(r3, 0x89e7, &(0x7f0000000100)={0x6b}) sendmsg$nl_crypto(r3, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000180)={&(0x7f00000003c0)=@getstat={0xe0, 0x15, 0x300, 0x70bd26, 0x25dfdbfb, {{'drbg_nopr_hmac_sha256\x00'}, [], [], 0x2000, 0x400}, [""]}, 0xe0}, 0x1, 0x0, 0x0, 0x40010}, 0x40004) r4 = dup2(r2, r0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1e2ba62e) recvfrom(r1, 0x0, 0x0, 0x0, 0x0, 0x0) recvfrom(r2, &(0x7f00000002c0)=""/184, 0xffffffffffffff71, 0x10100, 0x0, 0x62) ioctl$KVM_SET_PIT2(r4, 0x4070aea0, &(0x7f0000000240)={[{0xfffffffffffffff8, 0x3f, 0x7, 0xfffffffeffffffff, 0x4, 0x6, 0x100, 0x800, 0x3, 0x2, 0x8, 0x0, 0x100000001}, {0x7, 0x0, 0x8e3, 0x40, 0x7fffffff, 0xfffffffffffffc01, 0x200, 0x8, 0x2, 0x0, 0x1, 0xffffffff, 0x7ff}, {0x9, 0x7, 0xb56, 0x714a, 0x8, 0x3, 0xffffffffffff5b6a, 0x3, 0x2, 0x9, 0x5, 0x5, 0x102da075}], 0xffffffffffffffc0}) 13:48:11 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x500000000000000}) [ 2493.930845] binder: 29846:29848 unknown command 0 [ 2493.942513] binder: 29846:29848 ioctl c0306201 20000600 returned -22 13:48:12 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40046302, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) [ 2494.002438] binder_thread_release: 5 callbacks suppressed [ 2494.002452] binder: release 29846:29848 transaction 3570 in, still active 13:48:12 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) pread64(r0, 0x0, 0x2c9, 0x0) r2 = syz_open_dev$media(&(0x7f0000000080)='/dev/media#\x00', 0x4, 0x1) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000140)='TIPCv2\x00') sendmsg$TIPC_NL_NET_GET(r2, &(0x7f0000000280)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000240)={&(0x7f0000000300)=ANY=[@ANYBLOB="98000000", @ANYRES16=r3, @ANYBLOB="020026bd7000fddbdf250e000000080006000400020014000900080002000008000008000100050000001400050008000100696200000800012f324fd1b7e0ed7c4d5fd7bd5e8232006574680054000100380004001400010002004e22000000000000000000000000200002000a004e2200000005ff020000000000000000000000000001080000000800030000000000080003000200000008000300"], 0x98}, 0x1, 0x0, 0x0, 0x44000}, 0x4) r4 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000001100)={0x0}) clock_gettime(0x0, &(0x7f00000002c0)={0x0, 0x0}) timer_settime(0x0, 0x1, &(0x7f0000000000)={{r6, r7+10000000}, {r5}}, 0x0) r8 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) dup2(r8, r1) tkill(r4, 0x15) [ 2494.046870] binder_send_failed_reply: 5 callbacks suppressed [ 2494.046882] binder: send failed reply for transaction 3570 to 29846:29848 13:48:12 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x600000000000000}) [ 2494.097013] binder_release_work: 5 callbacks suppressed [ 2494.097112] binder: undelivered TRANSACTION_COMPLETE [ 2494.108196] binder: BC_ACQUIRE_RESULT not supported [ 2494.121398] binder_release_work: 5 callbacks suppressed [ 2494.121406] binder: undelivered TRANSACTION_ERROR: 29189 [ 2494.135499] binder: 29865:29866 ioctl c0306201 20000600 returned -22 13:48:12 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40046304, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) [ 2494.211674] binder: release 29865:29866 transaction 3572 in, still active [ 2494.226102] binder: send failed reply for transaction 3572 to 29865:29866 [ 2494.256607] binder: undelivered TRANSACTION_COMPLETE [ 2494.276365] binder: undelivered TRANSACTION_ERROR: 29189 13:48:12 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x700000000000000}) [ 2494.304543] binder: 29873:29874 unknown command 0 [ 2494.319427] binder: 29873:29874 ioctl c0306201 20000600 returned -22 13:48:12 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40046307, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) [ 2494.384536] binder: release 29873:29874 transaction 3574 in, still active [ 2494.398905] binder: send failed reply for transaction 3574 to 29873:29874 [ 2494.431258] binder: undelivered TRANSACTION_COMPLETE [ 2494.452708] binder: undelivered TRANSACTION_ERROR: 29189 [ 2494.488776] binder: 29878:29879 DecRefs 0 refcount change on invalid ref 0 ret -22 13:48:12 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x800000000000000}) [ 2494.514737] binder: 29878:29879 unknown command 0 [ 2494.534490] binder: 29878:29879 ioctl c0306201 20000600 returned -22 13:48:12 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40086303, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) [ 2494.596964] binder: release 29878:29879 transaction 3577 in, still active [ 2494.607026] binder: send failed reply for transaction 3577 to 29878:29879 [ 2494.648036] binder: undelivered TRANSACTION_COMPLETE [ 2494.670006] binder: undelivered TRANSACTION_ERROR: 29189 [ 2494.702337] binder: 29883:29884 BC_FREE_BUFFER u0000000000000000 no match [ 2494.730775] binder: 29883:29884 unknown command 0 [ 2494.743015] binder: 29883:29884 ioctl c0306201 20000600 returned -22 13:48:12 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='fdinfo/3\x00') mmap$xdp(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x200000e, 0x10, r1, 0x0) exit(0x3) ioctl$PPPIOCATTACH(r1, 0x4004743d, &(0x7f0000000100)=0x1) ioctl$PPPIOCATTCHAN(r1, 0x40047438, &(0x7f0000000000)=0x1) ioctl$EXT4_IOC_MIGRATE(r0, 0x6609) getpeername$packet(r1, &(0x7f0000001200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000001240)=0x14) recvfrom$packet(r1, &(0x7f0000000140)=""/4096, 0x1000, 0x40, &(0x7f0000001280)={0x11, 0x1d, r2, 0x1, 0x7, 0x6, @dev={[], 0x17}}, 0x14) getsockopt$inet6_tcp_int(r1, 0x6, 0x1e, &(0x7f0000000040), &(0x7f00000000c0)=0x4) ioctl$SNDRV_RAWMIDI_IOCTL_PARAMS(r1, 0xc0305710, &(0x7f00000012c0)={0x1, 0xd17, 0x8da2, 0x6}) syz_kvm_setup_cpu$x86(r1, r1, &(0x7f0000fe7000/0x18000)=nil, &(0x7f0000001180)=[@text16={0x10, &(0x7f0000001140)="f30f100c652e660f6240dfc647000066f2c870c10066b8a6c9e3da0f23c00f21f86635010002000f23f80fc72cf30f12cadf2bba4200b8b083ef0f9ca90000", 0x3f}], 0x1, 0x2, &(0x7f00000011c0)=[@dstype0={0x6, 0x3}, @vmwrite={0x8, 0x0, 0x2, 0x0, 0x6, 0x0, 0xd8, 0x0, 0x400}], 0x2) fchmod(r1, 0x84) pread64(r1, 0x0, 0xffffff58, 0xfffffffffffffffd) [ 2494.814350] binder: release 29883:29884 transaction 3579 in, still active [ 2494.825989] binder: send failed reply for transaction 3579 to 29883:29884 [ 2494.848562] binder: undelivered TRANSACTION_COMPLETE 13:48:12 executing program 4: signalfd4(0xffffffffffffffff, &(0x7f0000000ff8), 0x8, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000340), 0x10000014c) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x401f000000000000}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) [ 2494.861884] binder: undelivered TRANSACTION_ERROR: 29189 13:48:13 executing program 1: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-vsock\x00', 0x2, 0x0) clone(0x100002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffff9c, 0x29, 0x23, &(0x7f0000000e80)={{{@in=@loopback, @in6=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@initdev}, 0x0, @in=@local}}, &(0x7f0000000f80)=0xe8) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000340)={0x0, 0x0}, &(0x7f00000003c0)=0xc) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffff9c, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast1, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@empty}, 0x0, @in=@multicast2}}, &(0x7f0000000500)=0xe8) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000540)={{{@in6=@loopback, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast2}, 0x0, @in6=@ipv4={[], [], @remote}}}, &(0x7f0000000640)=0xe8) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffff9c, 0x29, 0x22, &(0x7f0000000680)={{{@in6=@initdev, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@initdev}, 0x0, @in=@initdev}}, &(0x7f0000000780)=0xe8) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f00000007c0)={{{@in=@broadcast, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6}, 0x0, @in=@local}}, &(0x7f00000008c0)=0xe8) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000900)={{{@in6=@mcast2, @in=@initdev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@dev}, 0x0, @in6}}, &(0x7f0000000a00)=0xe8) stat(&(0x7f0000000a40)='./file0\x00', &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000b00)={{{@in=@empty, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@broadcast}}}, &(0x7f0000000c00)=0xe8) r12 = getgid() getgroups(0x4, &(0x7f0000000c40)=[0xee01, 0xee01, 0xffffffffffffffff, 0xee01]) getgroups(0x2, &(0x7f0000000c80)=[0xffffffffffffffff, 0xee01]) lstat(&(0x7f0000000cc0)='./file0\x00', &(0x7f0000000d00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) setxattr$system_posix_acl(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='system.posix_acl_default\x00', &(0x7f0000000d80)={{}, {0x1, 0x2}, [{0x2, 0x5, r3}, {0x2, 0x2, r4}, {0x2, 0xc4cab631bace059b, r5}, {0x2, 0x2, r6}, {0x2, 0x7, r7}, {0x2, 0x7c46119e5dc0f70e, r8}, {0x2, 0x1, r9}, {0x2, 0x4, r10}, {0x2, 0x0, r11}], {0x4, 0x1}, [{0x8, 0x3, r12}, {0x8, 0x4, r13}, {0x8, 0x1, r14}, {0x8, 0x2, r15}], {0x10, 0x4}, {0x20, 0x1}}, 0x8c, 0x1) r16 = dup2(r2, r0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1e2ba62e) recvfrom(r1, 0x0, 0x0, 0x0, 0x0, 0x0) recvfrom(r2, &(0x7f0000000180)=""/184, 0xfffffffffffffd84, 0x10100, 0x0, 0xfffffffffffffd51) setsockopt$l2tp_PPPOL2TP_SO_LNSMODE(r16, 0x111, 0x4, 0x1, 0x31d) 13:48:13 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0xa00000000000000}) 13:48:13 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x4008630a, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) [ 2495.020601] binder: BC_ATTEMPT_ACQUIRE not supported [ 2495.039498] binder: 29996:29999 ioctl c0306201 20000600 returned -22 [ 2495.086319] binder: release 29996:29999 transaction 3581 in, still active [ 2495.097848] binder: send failed reply for transaction 3581 to 29996:29999 [ 2495.126048] binder: undelivered TRANSACTION_COMPLETE [ 2495.133995] binder: undelivered TRANSACTION_ERROR: 29189 [ 2495.374734] syz-executor.1 invoked oom-killer: gfp_mask=0x6142c0(GFP_KERNEL|__GFP_NOWARN|__GFP_COMP|__GFP_NOMEMALLOC), order=1, oom_score_adj=1000 [ 2495.389976] CPU: 0 PID: 30004 Comm: syz-executor.1 Not tainted 5.0.0+ #6 [ 2495.396859] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2495.406243] Call Trace: [ 2495.408864] dump_stack+0x172/0x1f0 [ 2495.412535] dump_header+0x10f/0xb6c [ 2495.416293] ? _raw_spin_unlock_irqrestore+0xa4/0xe0 [ 2495.421441] ? ___ratelimit+0x60/0x595 [ 2495.425360] ? do_raw_spin_unlock+0x57/0x270 [ 2495.429812] oom_kill_process.cold+0x10/0x6f5 [ 2495.434357] ? task_will_free_mem+0x139/0x6e0 [ 2495.438898] out_of_memory+0x79a/0x1280 [ 2495.442910] ? mem_cgroup_unmark_under_oom+0x8d/0xb0 [ 2495.448058] ? oom_killer_disable+0x280/0x280 [ 2495.452590] ? mem_cgroup_unmark_under_oom+0x8d/0xb0 [ 2495.457746] mem_cgroup_out_of_memory+0x99/0xe0 [ 2495.462458] ? memcg_memory_event+0x40/0x40 [ 2495.466828] ? _raw_spin_unlock+0x2d/0x50 [ 2495.471013] ? mem_cgroup_unmark_under_oom+0x8d/0xb0 [ 2495.476170] try_charge+0xfec/0x1570 [ 2495.479935] ? mem_cgroup_oom_trylock+0x1a0/0x1a0 [ 2495.484825] ? rcu_lockdep_current_cpu_online+0xe3/0x130 [ 2495.490319] ? rcu_read_lock_sched_held+0x110/0x130 [ 2495.495375] ? __alloc_pages_nodemask+0x5e9/0x710 [ 2495.500256] ? do_raw_spin_unlock+0x57/0x270 [ 2495.504707] memcg_kmem_charge_memcg+0x7c/0x130 [ 2495.509419] ? memcg_kmem_put_cache+0xb0/0xb0 [ 2495.513945] ? cache_grow_begin+0x5a2/0x8c0 [ 2495.518307] ? lockdep_hardirqs_on+0x415/0x5d0 [ 2495.522921] ? trace_hardirqs_on+0x67/0x230 [ 2495.527282] cache_grow_begin+0x25f/0x8c0 [ 2495.531471] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 2495.537045] ? __cpuset_node_allowed+0x136/0x540 [ 2495.541856] fallback_alloc+0x1fd/0x2d0 [ 2495.545875] ____cache_alloc_node+0x1be/0x1e0 [ 2495.550416] kmem_cache_alloc_node_trace+0xec/0x720 [ 2495.555491] __kmalloc_node_track_caller+0x3d/0x70 [ 2495.560464] __kmalloc_reserve.isra.0+0x40/0xf0 [ 2495.565193] __alloc_skb+0x10b/0x5e0 [ 2495.568945] ? skb_scrub_packet+0x440/0x440 [ 2495.573298] ? _raw_spin_unlock_irqrestore+0x6b/0xe0 [ 2495.578438] ? finish_wait+0x18c/0x260 [ 2495.582361] ? _raw_spin_unlock_irqrestore+0x6b/0xe0 [ 2495.587502] ? lockdep_hardirqs_on+0x415/0x5d0 [ 2495.592131] alloc_skb_with_frags+0x93/0x580 [ 2495.596590] ? _raw_spin_unlock_irqrestore+0xa4/0xe0 [ 2495.601739] sock_alloc_send_pskb+0x72d/0x8a0 [ 2495.606292] ? sock_wmalloc+0x120/0x120 [ 2495.610306] ? lock_downgrade+0x810/0x810 [ 2495.614485] ? finish_wait+0x260/0x260 [ 2495.618408] ? kasan_check_read+0x11/0x20 [ 2495.622599] unix_stream_sendmsg+0x5f7/0x990 [ 2495.627049] ? unix_stream_sendpage+0xb10/0xb10 [ 2495.631751] ? __lock_acquire+0x53b/0x4700 [ 2495.636021] ? smack_socket_sendmsg+0xb1/0x1a0 [ 2495.640632] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 2495.646243] ? security_socket_sendmsg+0x93/0xc0 [ 2495.651030] ? unix_stream_sendpage+0xb10/0xb10 [ 2495.655727] sock_sendmsg+0xdd/0x130 [ 2495.659471] sock_write_iter+0x27c/0x3e0 [ 2495.663555] ? sock_sendmsg+0x130/0x130 [ 2495.667562] ? __fget+0x340/0x540 [ 2495.671040] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 2495.676605] ? iov_iter_init+0xea/0x220 [ 2495.680606] __vfs_write+0x613/0x8e0 [ 2495.684344] ? kernel_read+0x120/0x120 [ 2495.688273] ? rw_verify_area+0x118/0x360 [ 2495.692469] vfs_write+0x20c/0x580 [ 2495.696028] ksys_write+0xea/0x1f0 [ 2495.699585] ? __ia32_sys_read+0xb0/0xb0 [ 2495.703666] ? do_syscall_64+0x26/0x610 [ 2495.707661] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 2495.713049] ? do_syscall_64+0x26/0x610 [ 2495.717050] __x64_sys_write+0x73/0xb0 [ 2495.720964] do_syscall_64+0x103/0x610 [ 2495.724876] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 2495.730085] RIP: 0033:0x457e29 [ 2495.733292] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 2495.752234] RSP: 002b:00007fc7dfbeec78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 2495.759966] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000457e29 [ 2495.767259] RDX: 000000001e2ba62e RSI: 0000000020000140 RDI: 0000000000000004 [ 2495.774555] RBP: 000000000073bfa0 R08: 0000000000000000 R09: 0000000000000000 [ 2495.781852] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fc7dfbef6d4 [ 2495.789168] R13: 00000000004c7260 R14: 00000000004dcde8 R15: 00000000ffffffff [ 2495.825616] memory: usage 307168kB, limit 307200kB, failcnt 105 [ 2495.837332] memory+swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 2495.850595] kmem: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 2495.892673] Memory cgroup stats for /syz1: cache:104KB rss:187932KB rss_huge:4096KB shmem:184KB mapped_file:0KB dirty:0KB writeback:0KB swap:0KB inactive_anon:0KB active_anon:188016KB inactive_file:0KB active_file:0KB unevictable:0KB [ 2495.946257] oom-kill:constraint=CONSTRAINT_NONE,nodemask=(null),cpuset=syz1,mems_allowed=0-1,oom_memcg=/syz1,task_memcg=/syz1,task=syz-executor.1,pid=25676,uid=0 [ 2495.967957] Memory cgroup out of memory: Kill process 25676 (syz-executor.1) score 1160 or sacrifice child [ 2495.984426] Killed process 25676 (syz-executor.1) total-vm:72972kB, anon-rss:16556kB, file-rss:35804kB, shmem-rss:0kB [ 2496.044515] syz-executor.1 invoked oom-killer: gfp_mask=0x7080c0(GFP_KERNEL_ACCOUNT|__GFP_ZERO), order=3, oom_score_adj=1000 [ 2496.095176] CPU: 0 PID: 30006 Comm: syz-executor.1 Not tainted 5.0.0+ #6 [ 2496.102077] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2496.111447] Call Trace: [ 2496.114061] dump_stack+0x172/0x1f0 [ 2496.117718] dump_header+0x10f/0xb6c [ 2496.121472] ? _raw_spin_unlock_irqrestore+0xa4/0xe0 [ 2496.126610] ? ___ratelimit+0x60/0x595 [ 2496.130526] ? do_raw_spin_unlock+0x57/0x270 [ 2496.134982] oom_kill_process.cold+0x10/0x6f5 [ 2496.139521] ? task_will_free_mem+0x139/0x6e0 [ 2496.144059] out_of_memory+0x79a/0x1280 [ 2496.148074] ? oom_killer_disable+0x280/0x280 [ 2496.152599] ? mem_cgroup_unmark_under_oom+0x8d/0xb0 [ 2496.157747] mem_cgroup_out_of_memory+0x99/0xe0 [ 2496.162453] ? memcg_memory_event+0x40/0x40 [ 2496.166815] ? _raw_spin_unlock+0x2d/0x50 [ 2496.170989] ? mem_cgroup_unmark_under_oom+0x8d/0xb0 [ 2496.176126] try_charge+0xb4a/0x1570 [ 2496.179878] ? find_held_lock+0x35/0x130 [ 2496.183979] ? mem_cgroup_oom_trylock+0x1a0/0x1a0 [ 2496.188858] ? get_mem_cgroup_from_mm+0x10b/0x2b0 [ 2496.193734] ? find_held_lock+0x35/0x130 [ 2496.197826] ? get_mem_cgroup_from_mm+0x10b/0x2b0 [ 2496.202714] memcg_kmem_charge_memcg+0x7c/0x130 [ 2496.207417] ? memcg_kmem_put_cache+0xb0/0xb0 [ 2496.211947] ? get_mem_cgroup_from_mm+0x128/0x2b0 [ 2496.216827] memcg_kmem_charge+0x13b/0x340 [ 2496.221093] __alloc_pages_nodemask+0x437/0x710 [ 2496.225799] ? __alloc_pages_slowpath+0x2900/0x2900 [ 2496.230846] ? lockdep_hardirqs_on+0x415/0x5d0 [ 2496.235459] ? trace_hardirqs_on+0x67/0x230 [ 2496.239814] copy_process.part.0+0x3e0/0x79a0 [ 2496.244348] ? mark_held_locks+0x100/0x100 [ 2496.248623] ? __might_fault+0x12b/0x1e0 [ 2496.252717] ? __cleanup_sighand+0x70/0x70 [ 2496.256978] ? lock_downgrade+0x810/0x810 [ 2496.261181] _do_fork+0x257/0xfe0 [ 2496.264666] ? fork_idle+0x1d0/0x1d0 [ 2496.268415] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 2496.273211] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 2496.277993] ? do_syscall_64+0x26/0x610 [ 2496.281983] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 2496.287366] ? do_syscall_64+0x26/0x610 [ 2496.291370] __x64_sys_clone+0xbf/0x150 [ 2496.295369] do_syscall_64+0x103/0x610 [ 2496.299286] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 2496.304489] RIP: 0033:0x457e29 [ 2496.307691] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 2496.326613] RSP: 002b:00007fc7dfbacc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 [ 2496.334348] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000000457e29 [ 2496.341629] RDX: 9999999999999999 RSI: 0000000000000000 RDI: 0100002102001ffc [ 2496.348908] RBP: 000000000073c0e0 R08: ffffffffffffffff R09: 0000000000000000 [ 2496.356205] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fc7dfbad6d4 [ 2496.363492] R13: 00000000004be1d9 R14: 00000000004ce8e0 R15: 00000000ffffffff [ 2496.426555] memory: usage 298168kB, limit 307200kB, failcnt 125 [ 2496.437537] memory+swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 2496.445585] kmem: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 2496.456811] Memory cgroup stats for /syz1: cache:104KB rss:177760KB rss_huge:10240KB shmem:184KB mapped_file:0KB dirty:0KB writeback:0KB swap:0KB inactive_anon:0KB active_anon:177744KB inactive_file:0KB active_file:0KB unevictable:0KB [ 2496.484597] oom-kill:constraint=CONSTRAINT_NONE,nodemask=(null),cpuset=syz1,mems_allowed=0-1,oom_memcg=/syz1,task_memcg=/syz1,task=syz-executor.1,pid=25760,uid=0 [ 2496.505455] Memory cgroup out of memory: Kill process 25760 (syz-executor.1) score 1160 or sacrifice child [ 2496.518957] Killed process 25760 (syz-executor.1) total-vm:72972kB, anon-rss:16556kB, file-rss:35796kB, shmem-rss:0kB [ 2496.574258] syz-executor.1 invoked oom-killer: gfp_mask=0x7080c0(GFP_KERNEL_ACCOUNT|__GFP_ZERO), order=3, oom_score_adj=1000 [ 2496.595750] CPU: 0 PID: 30001 Comm: syz-executor.1 Not tainted 5.0.0+ #6 [ 2496.602701] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2496.612089] Call Trace: [ 2496.614701] dump_stack+0x172/0x1f0 [ 2496.618357] dump_header+0x10f/0xb6c [ 2496.622088] ? _raw_spin_unlock_irqrestore+0xa4/0xe0 [ 2496.627215] ? ___ratelimit+0x60/0x595 [ 2496.631122] ? do_raw_spin_unlock+0x57/0x270 [ 2496.635567] oom_kill_process.cold+0x10/0x6f5 [ 2496.640089] ? task_will_free_mem+0x139/0x6e0 [ 2496.644611] out_of_memory+0x79a/0x1280 [ 2496.648611] ? oom_killer_disable+0x280/0x280 [ 2496.653127] ? mem_cgroup_unmark_under_oom+0x8d/0xb0 [ 2496.658277] mem_cgroup_out_of_memory+0x99/0xe0 [ 2496.662971] ? memcg_memory_event+0x40/0x40 [ 2496.667318] ? _raw_spin_unlock+0x2d/0x50 [ 2496.671483] ? mem_cgroup_unmark_under_oom+0x8d/0xb0 [ 2496.676603] try_charge+0xb4a/0x1570 [ 2496.680335] ? find_held_lock+0x35/0x130 [ 2496.684416] ? mem_cgroup_oom_trylock+0x1a0/0x1a0 [ 2496.689280] ? get_mem_cgroup_from_mm+0x10b/0x2b0 [ 2496.694146] ? find_held_lock+0x35/0x130 [ 2496.698231] ? get_mem_cgroup_from_mm+0x10b/0x2b0 [ 2496.703102] memcg_kmem_charge_memcg+0x7c/0x130 [ 2496.707792] ? memcg_kmem_put_cache+0xb0/0xb0 [ 2496.712313] ? get_mem_cgroup_from_mm+0x128/0x2b0 [ 2496.717196] memcg_kmem_charge+0x13b/0x340 [ 2496.721447] __alloc_pages_nodemask+0x437/0x710 [ 2496.726147] ? __alloc_pages_slowpath+0x2900/0x2900 [ 2496.731196] ? lockdep_hardirqs_on+0x415/0x5d0 [ 2496.735793] ? trace_hardirqs_on+0x67/0x230 [ 2496.740136] copy_process.part.0+0x3e0/0x79a0 [ 2496.744670] ? psi_memstall_leave+0x11c/0x180 [ 2496.749196] ? sched_clock+0x2e/0x50 [ 2496.752926] ? psi_memstall_leave+0x12e/0x180 [ 2496.757434] ? find_held_lock+0x35/0x130 [ 2496.761517] ? __lock_acquire+0x53b/0x4700 [ 2496.765784] ? __cleanup_sighand+0x70/0x70 [ 2496.770039] ? mark_held_locks+0x100/0x100 [ 2496.774298] ? rcu_read_lock_sched_held+0x110/0x130 [ 2496.779341] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 2496.784903] ? try_to_free_mem_cgroup_pages+0x410/0x960 [ 2496.790299] _do_fork+0x257/0xfe0 [ 2496.793782] ? fork_idle+0x1d0/0x1d0 [ 2496.797517] ? blkcg_maybe_throttle_current+0x5d4/0xfd0 [ 2496.802906] ? lock_downgrade+0x810/0x810 [ 2496.807083] ? blkcg_exit_queue+0x30/0x30 [ 2496.811251] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 2496.816027] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 2496.820799] ? do_syscall_64+0x26/0x610 [ 2496.824783] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 2496.830171] ? do_syscall_64+0x26/0x610 [ 2496.834181] __x64_sys_clone+0xbf/0x150 [ 2496.838184] do_syscall_64+0x103/0x610 [ 2496.842110] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 2496.847327] RIP: 0033:0x45a7f9 [ 2496.850556] Code: ff 48 85 f6 0f 84 d7 8e fb ff 48 83 ee 10 48 89 4e 08 48 89 3e 48 89 d7 4c 89 c2 4d 89 c8 4c 8b 54 24 08 b8 38 00 00 00 0f 05 <48> 85 c0 0f 8c ae 8e fb ff 74 01 c3 31 ed 48 f7 c7 00 00 01 00 75 [ 2496.869487] RSP: 002b:00007ffe94f55588 EFLAGS: 00000202 ORIG_RAX: 0000000000000038 [ 2496.877207] RAX: ffffffffffffffda RBX: 00007fc7dfb8c700 RCX: 000000000045a7f9 [ 2496.884489] RDX: 00007fc7dfb8c9d0 RSI: 00007fc7dfb8bdb0 RDI: 00000000003d0f00 [ 2496.891776] RBP: 00007ffe94f55790 R08: 00007fc7dfb8c700 R09: 00007fc7dfb8c700 [ 2496.899058] R10: 00007fc7dfb8c9d0 R11: 0000000000000202 R12: 0000000000000000 [ 2496.906341] R13: 00007ffe94f5563f R14: 00007fc7dfb8c9c0 R15: 000000000073c18c [ 2496.927172] memory: usage 281484kB, limit 307200kB, failcnt 125 [ 2496.933732] memory+swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 2496.946067] kmem: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 2496.952393] Memory cgroup stats for /syz1: cache:104KB rss:161324KB rss_huge:10240KB shmem:184KB mapped_file:0KB dirty:0KB writeback:0KB swap:0KB inactive_anon:0KB active_anon:161224KB inactive_file:0KB active_file:0KB unevictable:0KB [ 2496.977996] oom-kill:constraint=CONSTRAINT_NONE,nodemask=(null),cpuset=syz1,mems_allowed=0-1,oom_memcg=/syz1,task_memcg=/syz1,task=syz-executor.1,pid=25965,uid=0 [ 2496.993249] Memory cgroup out of memory: Kill process 25965 (syz-executor.1) score 1160 or sacrifice child [ 2497.003670] Killed process 25965 (syz-executor.1) total-vm:72972kB, anon-rss:16556kB, file-rss:35792kB, shmem-rss:0kB [ 2497.038574] oom_reaper: reaped process 25965 (syz-executor.1), now anon-rss:0kB, file-rss:34832kB, shmem-rss:0kB 13:48:15 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$dri(&(0x7f0000000480)='/dev/dri/card#\x00', 0x100007, 0x0) pread64(r1, 0x0, 0x0, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_gettime(0x7, &(0x7f00000003c0)={0x0}) r4 = add_key$keyring(&(0x7f0000000340)='keyring\x00', &(0x7f0000000380)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffff8) keyctl$setperm(0x5, r4, 0x100) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r3}}, 0x0) r5 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) timer_create(0x2, &(0x7f00000000c0)={0x0, 0x25, 0x0, @tid=r2}, &(0x7f0000000300)) r6 = dup2(r5, r1) tkill(r2, 0x15) write$FUSE_WRITE(r6, &(0x7f0000000080)={0x18, 0x0, 0x3, {0x1}}, 0x18) 13:48:15 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x1000000000000000}) 13:48:15 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40086310, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:48:15 executing program 2: socket$netlink(0x10, 0x3, 0xfffffffffffffffc) r0 = gettid() r1 = syz_open_procfs(r0, &(0x7f0000000300)='cmdline\x00') exit(0x0) openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm_plock\x00', 0x800, 0x0) pread64(r1, 0x0, 0x0, 0x3) 13:48:15 executing program 4: signalfd4(0xffffffffffffffff, &(0x7f0000000ff8), 0x8, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000340), 0x10000014c) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x4d01000000000000}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) [ 2497.160280] binder: 30019:30021 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 2497.167714] binder: 30019:30021 unknown command 0 [ 2497.192368] binder: 30019:30021 ioctl c0306201 20000600 returned -22 13:48:15 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x400c630e, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:48:15 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x1a0f000000000000}) 13:48:15 executing program 1: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-vsock\x00', 0x2, 0x0) clone(0x100002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r0) socket$pppoe(0x18, 0x1, 0x0) accept$nfc_llcp(r3, &(0x7f0000000040), &(0x7f00000000c0)=0x60) mlockall(0x7) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1e2ba62e) recvfrom(r1, 0x0, 0x0, 0x0, 0x0, 0x0) recvfrom(r2, &(0x7f0000000180)=""/184, 0xfffffffffffffd84, 0x10100, 0x0, 0xfffffffffffffd51) [ 2497.250651] binder: release 30019:30021 transaction 3583 in, still active [ 2497.260080] binder: send failed reply for transaction 3583 to 30019:30021 13:48:15 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) r2 = openat(0xffffffffffffffff, &(0x7f0000000080)='./file0\x00', 0x40101, 0x59) ioctl$KVM_GET_CPUID2(r2, 0xc008ae91, &(0x7f0000000100)={0x1, 0x0, [{}]}) pread64(r1, 0x0, 0x0, 0x0) timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000001100)={0x0}) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r3}}, 0x0) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) dup2(r4, r1) tkill(0x0, 0x15) [ 2497.291273] binder: undelivered TRANSACTION_COMPLETE [ 2497.311493] binder: undelivered TRANSACTION_ERROR: 29189 [ 2497.351176] binder: 30034:30039 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 13:48:15 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x1f00000000000000}) [ 2497.388205] binder: 30034:30039 unknown command 0 [ 2497.402809] binder: 30034:30039 ioctl c0306201 20000600 returned -22 13:48:15 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x400c630f, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) [ 2497.466455] binder: release 30034:30039 transaction 3585 in, still active [ 2497.476984] binder: send failed reply for transaction 3585 to 30034:30039 13:48:15 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x2000000000000000}) [ 2497.517819] binder: undelivered TRANSACTION_COMPLETE [ 2497.535115] binder: undelivered TRANSACTION_ERROR: 29189 [ 2497.542252] binder: 30049:30050 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 2497.557510] binder: 30049:30050 unknown command 0 [ 2497.564129] binder: 30049:30050 ioctl c0306201 20000600 returned -22 13:48:15 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x3f00000000000000}) 13:48:15 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40106308, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) [ 2497.646989] binder: release 30049:30050 transaction 3587 in, still active [ 2497.663876] binder: send failed reply for transaction 3587 to 30049:30050 [ 2497.687663] binder: undelivered TRANSACTION_COMPLETE [ 2497.706782] binder: undelivered TRANSACTION_ERROR: 29189 13:48:15 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x4800000000000000}) [ 2497.730346] binder: 30055:30056 BC_INCREFS_DONE node 3588 has no pending increfs request [ 2497.753893] binder: 30055:30056 unknown command 0 [ 2497.771122] binder: 30055:30056 ioctl c0306201 20000600 returned -22 [ 2497.859915] binder: release 30055:30056 transaction 3589 in, still active [ 2497.872199] binder: send failed reply for transaction 3589 to 30055:30056 [ 2497.892953] binder: undelivered TRANSACTION_COMPLETE [ 2497.901592] binder: undelivered TRANSACTION_ERROR: 29189 13:48:16 executing program 2: socket$netlink(0x10, 0x3, 0x0) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='fdinfo/3\x00') exit(0x0) pread64(r0, 0x0, 0x0, 0x3) ioctl$DRM_IOCTL_AUTH_MAGIC(r0, 0x40046411, &(0x7f0000000000)=0x5) 13:48:16 executing program 4: signalfd4(0xffffffffffffffff, &(0x7f0000000ff8), 0x8, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000340), 0x10000014c) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x7c15000000000000}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 13:48:16 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:48:16 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x4c00000000000000}) 13:48:16 executing program 1: r0 = syz_open_dev$cec(&(0x7f00000052c0)='/dev/cec#\x00', 0x2, 0x2) getsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000005300), &(0x7f0000005340)=0x14) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/vhost-vsock\x00', 0x2, 0x0) clone(0x100002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCBRDELBR(r2, 0x89a1, &(0x7f0000000100)='caif0\x00') getsockopt$inet_sctp_SCTP_ASSOCINFO(r0, 0x84, 0x1, &(0x7f0000000240)={0x0, 0x0, 0x2, 0x6, 0x10001, 0x10001}, &(0x7f0000000280)=0x14) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f0000000300)={r4, 0x0, 0x1}, 0x8) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vga_arbiter\x00', 0x0, 0x0) mkdirat(r0, &(0x7f0000000000)='./file0\x00', 0x84) r6 = dup2(r3, r1) write$binfmt_misc(r2, &(0x7f0000000140)=ANY=[], 0x1e2ba62e) setsockopt$l2tp_PPPOL2TP_SO_RECVSEQ(r5, 0x111, 0x2, 0x0, 0x4) ioctl$NBD_DISCONNECT(r6, 0xab08) syz_open_dev$video4linux(&(0x7f0000000140)='/dev/v4l-subdev#\x00', 0x8, 0x0) recvfrom(r2, 0x0, 0x0, 0x0, 0x0, 0x0) recvfrom(r3, &(0x7f0000000180)=""/184, 0xfffffffffffffd84, 0x10100, 0x0, 0xfffffffffffffd51) [ 2498.104874] binder: 30069:30070 BC_ACQUIRE_DONE node 3590 has no pending acquire request [ 2498.122587] binder: 30069:30070 unknown command 0 [ 2498.132724] binder: 30069:30070 ioctl c0306201 20000600 returned -22 13:48:16 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) pread64(r1, 0x0, 0x0, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) ioctl$RTC_UIE_OFF(r0, 0x7004) clock_gettime(0x0, &(0x7f0000001100)={0x0}) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r3}}, 0x0) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) dup2(r4, r1) tkill(r2, 0x15) 13:48:16 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x6000000000000000}) 13:48:16 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:48:16 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x6800000000000000}) [ 2498.263995] binder: 30085:30086 got transaction to context manager from process owning it [ 2498.306024] binder: 30085:30086 transaction failed 29201/-22, size 0-0 line 2887 [ 2498.342110] binder: 30085:30086 ioctl c0306201 20000600 returned -14 13:48:16 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) pread64(r1, 0x0, 0x0, 0x0) r2 = gettid() r3 = syz_open_dev$sndpcmc(&(0x7f0000000100)='/dev/snd/pcmC#D#c\x00', 0x3, 0x175282) ioctl$EVIOCSMASK(r3, 0x40104593, &(0x7f0000000200)={0x1f, 0x2f, &(0x7f00000001c0)="84087db304365160470fc8c5602a37ffc82bc4a2bece6404d448d8a72ab87224daa76131fd85190ca17c5cc01997dd"}) ioctl$KVM_ENABLE_CAP(r3, 0x4068aea3, &(0x7f0000000140)={0x79, 0x0, [0x6, 0xee1, 0x4, 0x7]}) clock_gettime(0x0, &(0x7f0000000240)={0x0}) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r4}}, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TIMER(r3, 0xc0605345, &(0x7f0000000280)={0x8, 0x2, {0x3, 0x1, 0x7}}) r5 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) r6 = dup2(r5, r1) tkill(r2, 0x15) setsockopt$inet_sctp6_SCTP_AUTO_ASCONF(r6, 0x84, 0x1e, &(0x7f0000000080)=0x2, 0x4) 13:48:16 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x6c00000000000000}) 13:48:16 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406302, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) [ 2498.527372] binder: 30100:30103 unknown command 1077961474 [ 2498.553998] binder: 30100:30103 ioctl c0306201 20000600 returned -22 13:48:16 executing program 2: socket$netlink(0x10, 0x3, 0x0) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='fdinfo/3\x00') ioctl$TIOCGWINSZ(r0, 0x5413, &(0x7f0000000040)) exit(0x0) pread64(r0, 0x0, 0x0, 0x3) getsockopt$bt_hci(r0, 0x0, 0x3, &(0x7f00000000c0)=""/207, &(0x7f0000000000)=0xcf) ioctl$EVIOCGMASK(r0, 0x80104592, &(0x7f0000000280)={0x1f, 0x88, &(0x7f00000001c0)="97099158105a454ac9c6c5473a12b4ad2ece577b43fde2cb1099defcb1f52850386d6eb82f5fec3b114bd6a45455e2b2068d6bb75145e39ddd1fd618045e77d9e6acd0c091e3f3cbb09ee2afd2430b475a78e26965c0d66f31cf129c52b1873ffe9ab03f5f73554d03d6164b5e9285f87bf1f632f02136b8f0f76b9f113176384d551bf0341617f9"}) 13:48:17 executing program 4: signalfd4(0xffffffffffffffff, &(0x7f0000000ff8), 0x8, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000340), 0x10000014c) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x9a02000000000000}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 13:48:17 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x7400000000000000}) 13:48:17 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406304, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:48:17 executing program 1: msgget$private(0x0, 0x200) r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-vsock\x00', 0x2, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) writev(r1, &(0x7f0000000000)=[{&(0x7f0000000080)="39000000130003746900cd4ee22844f2d09a80e72a0000004c0001075500001419000a0010000000000083f500001024000087ce54b3c5b2da", 0x39}], 0x1) clone(0x100002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x2) r4 = openat$cachefiles(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/cachefiles\x00', 0x101000, 0x0) setsockopt$SO_VM_SOCKETS_BUFFER_MAX_SIZE(r4, 0x28, 0x2, &(0x7f0000000100)=0x3, 0x8) dup2(r3, r0) write$binfmt_misc(r2, &(0x7f0000000140)=ANY=[], 0x1e2ba62e) recvfrom(r2, 0x0, 0x0, 0x3, 0x0, 0x0) recvfrom(r3, &(0x7f0000000180)=""/184, 0xfffffffffffffd84, 0x10100, 0x0, 0xfffffffffffffd51) 13:48:17 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x7a00000000000000}) [ 2499.141136] binder: 30115:30118 unknown command 1077961476 [ 2499.160002] binder: 30115:30118 ioctl c0306201 20000600 returned -22 [ 2499.168960] netlink: 'syz-executor.1': attribute type 10 has an invalid length. 13:48:17 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x4040630a, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) [ 2499.207160] binder_thread_release: 3 callbacks suppressed [ 2499.207174] binder: release 30115:30118 transaction 3598 in, still active [ 2499.232561] binder_send_failed_reply: 3 callbacks suppressed [ 2499.232573] binder: send failed reply for transaction 3598 to 30115:30118 13:48:17 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x8aaa030000000000}) [ 2499.276980] binder_release_work: 3 callbacks suppressed [ 2499.276988] binder: undelivered TRANSACTION_COMPLETE [ 2499.301796] binder: 30131:30132 unknown command 1077961482 [ 2499.307769] binder_release_work: 4 callbacks suppressed [ 2499.307777] binder: undelivered TRANSACTION_ERROR: 29189 [ 2499.326616] binder: 30131:30132 ioctl c0306201 20000600 returned -22 13:48:17 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406312, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) [ 2499.392556] binder: release 30131:30132 transaction 3600 in, still active [ 2499.413011] binder: send failed reply for transaction 3600 to 30131:30132 [ 2499.442551] binder: undelivered TRANSACTION_COMPLETE [ 2499.462398] binder: undelivered TRANSACTION_ERROR: 29189 [ 2499.479987] binder: 30136:30137 unknown command 1077961490 [ 2499.486598] binder: 30136:30137 ioctl c0306201 20000600 returned -22 [ 2499.527397] binder: release 30136:30137 transaction 3602 in, still active [ 2499.542647] binder: send failed reply for transaction 3602 to 30136:30137 [ 2499.573547] binder: undelivered TRANSACTION_COMPLETE [ 2499.592683] binder: undelivered TRANSACTION_ERROR: 29189 [ 2499.972573] netlink: 'syz-executor.1': attribute type 10 has an invalid length. 13:48:19 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) r2 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000200)='/dev/sequencer\x00', 0x4282, 0x0) setsockopt$inet_sctp6_SCTP_MAX_BURST(r2, 0x84, 0x14, &(0x7f0000000240)=@int=0xd9, 0x4) pread64(r1, 0x0, 0x0, 0x0) prctl$PR_SET_TSC(0x1a, 0x3) r3 = gettid() syz_open_dev$dspn(&(0x7f0000000280)='/dev/dsp#\x00', 0x1, 0x400800) timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f00000001c0)={0x0}) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r4}}, 0x0) r5 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) r6 = dup2(r5, r1) tkill(r3, 0x15) recvfrom$x25(r6, &(0x7f0000000100)=""/158, 0x9e, 0x0, &(0x7f0000000080)={0x9, @remote={[], 0x1}}, 0x12) 13:48:19 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x8baa030000000000}) 13:48:19 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406325, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:48:19 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='fdinfo/3\x00') sendmsg(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000001380)=[{&(0x7f00000000c0)="f9f193bededce85245f6dd5df6da3786811f22e0039d2f10b26fb48cc3776416fe139e83e7cf5b272ecf6cd9b32d0c8ec065747345e24db01b186ea78b9533fa7946248ab4ab7e1d8698aad820ff4c1284fcc41afc7f8406d1b0e17706c8ab71a701026a516c67131e72cc006e9a6dfef89f485e451751e1b0e5124a857048c9cffaa68ad97226b926f54189563969f48c98bf0bd437c6fed2a8a942a6b6fb41e2cb47a22a11196854170f2197e353574ae554f66424c172c930103ff0972bdd1cad20d76198330c6ea46d00", 0xcc}, {&(0x7f00000001c0)="1f393d1a416d737767a415a50f9bd59c5d0be2101a3cc155a2fc0d341d585a3cfe46b7d107454e34a41a8bbf66c04897bec0651cb9eb780e5fe7c373c96fd1c242a786cc274fac37eea02e0a77add7b5d072f2a533a919d7d46b54db41c50b2f6f3849e5a64c0285c13b71e409fc1a3a4efa1b3d142f1140c7e04defb661ec47cb8f47329267e618af83d97a0872fdabe9e641cd03d410115abe0bc9786829538b2aad6747ac69f66e5bbbce6e424384517296a1d415", 0xb6}, {&(0x7f0000000280)="d5b10ae4a8f3bdbd2ae4f271b8b3630b888a82d562ddd287a1bdd72f8db0db9527cc1f200eee931d8e5217c1369ff9dcc184fff26a4530ac8f45b59b9709ac587b5b88209936e2f4a4e2f45ae9164562dbc51fb0fe9eadc6b8173acb3696c4afd512cdd46e8710aea8e28664701f745b2f68c586633cf8191d1ccfd666bc281a51ea4b5149b314475ca214effdf6c068d8c92dd8894641f411ba221ed8d6eb3688506d6aea0325b8a6883e04c52e1153c56287cc62fbc31f66a3e9f6d7c33ad3175762181f1413b24a55e2c540808a12b46f9719d84ab941bc2306106f4f395ea6613770e2aa832c090821d0a10321c3c972988cefcd40519ec8304e170790243ec894829c4ed244b7e70ae6b763cadda544589579dbee37034f6ea61c36d1eaa43263a3d5aef0568366d7d3af11b7ac45094425e9ba5f3a1e90bd692d9db2184f8e846d8dd844284bd8a3fbb2e9ea5c3d8ea60d91e200b1ef4a6ccecd10cf6c571c4f76ea68923a5e77220e03fd9597587e54748b6ac9f279f085b0768988c8733f895c6ab79342ff711333fa272ef24a612a3ce8759030f47d7a768731032e0d45caeaba3f667a312cfb90914f3e8f4b2d60083f8760319bb7a37bc51ad10e60fa80df269ef909d738ab2e440b67555ed7bd2261b6d2d417670fcd3e4fdf72d6273807ea9b8c60c7894a56bca63dd98cb0d9e448977bf61fae3bcbea79d78d17a5b35e981f3c789b836e7c519cc9cc9623d1919cd69dcd5ff5fb39f8f82aaa2b95faba81c1a77d7f35e1d68d35e655c31e3bd5a08098d698506aabe4c06c75b80e81ac4f3c4589e786d869d3240c0dd41dfcc7b1112ab6bfedadb9157576c00e48724e014e9f2a96e1bc2482311b57f6daf2b154bdef34f736a7b0bfde92bd63779f63631f88574591b1bb4f6f664a4c7231f4a29a632387b50daa3da780aa4dd282c372ca693412e9d8648ccd93def42cf6c88867061e916cf7322755ff13a11902cf9050350913211b139a397600762580e31b1fb81726a70f11eb6d25b83faa2807d675fe2f762c560cc4feb8b73c03ffc24e2c8f9e1be9a7232ca8dcc62af91ac4e86e50227f5db300fafbcc9cef9e72165a5b3fa31b847a453f8b6fe023f93cf1a6b089e72242bb3cb9820ade19c2afd3043a0264a185465026c6948cb6fa8f1d8024aca1dfba210baf058336e7509b71798f8de35118d5ef7163494ad668a098168456e29dc9d3641ce0531b0566ddec29ef86a27a0588d85b531cbf8a597dc7604414739acf0956c1768bd8c6a89c881dc259a7e802fadf580188b5d8d1e0bfcce6c2affb2bb1c0932804be38f4e014a5737c597f7eb8a5745c39eafb43a2e0301ba16596b47afb2fbced5792f68e8e3a5943aff998d2929d2301e93f0082ea9aaf61b88939da09391a5f701a69e6107c66a5f3acf0a3dd3dc72cc5fc06edb902b4a6c1ca177a39736b3828f48a025a4c489febd922d9781bcb0a2d976f7e99b4536516dbc7b3bf50a7e0ceb7e11b9da87885a14f3110f98b99f5e00652ca996e919bc9edebdb03f763a0203d90dfd8b5fb1acc4f1a860b8486929bdb9baf3391b6072867c095268c3a30e06da7fa3d6fb351b6d79802cc5c478a7eb000205fadd16d05d75bdb150e41a8e0dec52f1d48f81badc3047bed172deb43e74855ebc4634c412dc06ccd04650f5cd3d59892d0f69c819ca8e4c73509e81206ab42e162459d123a3ba33ad790b430c4edf5f69e1f50999b3e6439dac27951cf3259f1adc2b18840ab542202036d4e5c71f42484fed2e96e96e417b1bac4ac439d2d59dae69bb7dd84552faad1a621f1f2ce762109d2382dc249a18e737fd941f75a92aa8151b30df43574b191cc815217539ab86d6b8bbdebd99e2c76602078e0e8f113a6a8fbcda63ed5f7445031e4051418c6fd2fb7b3940e08abd42aca1a5754c746051d9a2a021b80075123813a4eb1098fd05923ade105d4b1fb1b54d9a998a1edf99b74f892d5bc4f6726a3415fd3259aaf350e8b1eac01dca2cd5fdb6ee3b041f499fa67e5102af39b64d39483b9cf7a52479e5902b0dd314eafe6c5736eaf1626d93a4b700d01a78925ee79e4976cd0e9e71717c214fe8df4503f8a42b4553ab292ea69a59526b0659b40f96bba77b40669998b3b8aad248ab9461f3d30c00b47aece151f57783fb578fca123b1d3cc573f1b36952ac98ce4bba16594d3fe92c26e69eca7be795e7ccb11d0d08594ebed314b4ce087d297b37b0b81d502ed491a25f4c598f512b88be77a8a5ff06558b89a55ec70837c9d24094d37d2bf17cc6cbeface2dcd8273e4fc1f551cb2a010e6f1f6bc037b374b117ebaf1b8e7665df5e635ea60a0567c92cad335f547411a729aeaa6098b615644472cf60bf941b6367922f96621a4657cc30aefbb4698ac5cc1e915edf095b086363f6f43b74a85827baf5eee283c18622e1d8dc0b0dd6367dcb0d34e3c69483108d6ee9a44453d3eeebf73f3d8233f36d42e05b95ffc4e565f56efe493ac549ca983884f577fda0048965af7098f1234e78c1bb8cf01b7a7c94b77fae68d8228c77fa7e30514186a697a56d9d0025a4014808e5a8a711ee25c0aa751e1993cd8cd9a4329c233569d7671f6a00389d60501d87d75fa86ec1c03948ba9b0a6cc7d382a18b7b8cb4cf47077da41a02e4d4345fb400649e0209fa4ecbd17cf5cf5f3bd3e16afae5c226299ffebf2772dc91793d1d24453a0d3c881a420c4ffcccddcb342b31ee65ae7c26e6890e4de82a5a6752c320a24bf3fe6ed2cb6086fcd789047de6244838c9ecaf6ebec316ef8e6d408708e204d461bdea5289063c3da3833b608c626619ed7fedcd542a80a8bd16fd54936c1bfdef4724c7add20f5b4c60d95af9ce86aa1f1e751c73c000e8747b86f3e06411ed2d2229ea1990ad53bddc11aacff8967e52890e214bb84fb8e16a71640643f50d6fd0082813d6bd85df6aa809ec243b0c524b1cdc5b03c7792ffd718c606fea0763ac03602ad814d27148f4b2115ad3605ce9bea19b3e221f05b457ad94dca8a85228b0fa60d040b2d1309e4aa8f1304dba38e0891947b912ed8c0048d0e9c449a4a53ade6df72c40fe1452314a6d4329cbaf9bc463c15d6b858b4573da1a3833f1382175bd914617ca6aff4adfff121f02cfee1bb5a848ae3b174af9dfa14e493728fc1b3ee6768b909648ff9297686aa3c0214908931ba3f6d0206ecfd0e677b1171e982dfce0961d0199ccb55300375146e9546e1ffc45b318917846be38116feb2d066b42c95bf0d7ef8de82bd8ca4544dd1fd90c146ed9d0cdea86db067ca4d0541b562f8ee44bf1e7e05daa8848d14ecbff675158e1893cbd98558223fff1c8408bcaa43e9cb2ea85aa0165d7d7b77825690fab6115f5cfb1c66d9e4aeedad97e661139a6fa31822c421bd53dea3f08c066680dd07656e278a73051a8523bdff99b0e27615cd06a55b48b7d1cf9a37c0c5a486e2fc9b15e21da089a05b1eb8be8d48f0edbba33590de6ff55a6fd03383f9f19d7a43afbfecaa34b348d14290d0ea9ed32ae080d66fb3c54ca97107f50c8eaca5669431d19c35613d7c175a72bda6345488fd871c2145b90ae4684f3e80d97a67be51af084645ced67af0435c029a4c4f50cd3deb79677ac8ee6f1fe0f59ebc9722247c9315ef86ffcf04a883fa766260549c7e215414a5cfce4e3ec929da835e6d84bfb49568b4c69a86790061669d176aca5425297a766ec2c431e66d4b44bdb8cb30849ee761e234304f9e1523f09bcff2ee2176a81bf041c9d67e8faba2e60e28854b2f6329610d29dca3720d43d1593afe0feec64db6b6e0a9d48ac549ed5a0814a51f6c61475847095b6ec37226d40a102a6003324ebfa529b9a3d7412a12dd17e9af692c3980e0925b432a06f6a8a756b9a4963a47b82374d099627e1a6558b940dbfdc2619043bc5aa3f36e1f6a767576f5b1dc356f19d1542f04e34a2b40563c735ee65d8e237bd156dbb28fc83af75efcf344c0f86a1c413dbef5d0da347fb19a16628fad81e2afa1a88d2400dc2ee1220f19fd867940aa978bff931b940a81274011b4364a5fb0b2acba5268ce55d85061bee5ca0f9be796a7479ddcc5fcde3dade659efd9c3e4b7d300715377d8af7c7d691e6fd8859d7012b4b1e1bd8ffa001e15cc570b17dbbf450d9bd553e8a4c9343ed1e59b3dc9636883596071cec9e9741f70f6b5fc2edc476f8dd62636bc00c083bfc4d4be8bb2ffbd293734660c46c7dd17fcad53c0a005eadc9ab6f63aaed1267f1823d01e62a9aae3fe0d157e43179b55cddbe0746a4944f52f325f5f9b24b593312b7b7d204879501c058b5894963b7d918ed290e178f4d006cf75e61ae35441cc5e56ffcb47782cd278f9e40930a78c913afbed2cdc921fb15a0aef6560630b00b477ef3e4e4df3b931aecb17844c9614e1ecfe51cce08791a3b02bc6e04bf51c8688df8a2d1378a317d69b1e1e3738d50d6c9e82e2f6986b19b17546b876d4c90fb9b882736b2396cf0bee9f037c3823185b8014d273084e60dee40fa6ede31a96d541b643a47b2095077d0c7efbd8585f9b9e2f0080ed24b597f7445fe2e235279b697a2104285807aad4a361a3b7ef1472d4aea29a8c1b2655ddb462b71ee1d32ce26c42ebf9052001259dd73234a9f5c7422ca67b041efc1d044591cd513577b06b3ab3369efd43d87fcbfd6b0dda3a87ea40936e4e5b2c30eb5cc7e4fa22ba48756823a206ae1db8254f471dd4225eba9a29d13e21d429319d7a437860b0060b9450abf7f7786a9be6ec27c2f44fbc0f1ae2ac6eb86a2fa8a47df3babcafe6351c0235160cc7e7df248aad3ed9189858debb3cbcdcb29b76d28f63de30a3f24ea95c77b3d0cceacb4c8ba8472455acbf5b6010986b00c5b02efdb80003b264c2f30b13658f9c58e10524205a242d7a4687ed71950c49756e57dfca64c6e8f4463246779d5cb32094d4a52ab8d2bbf80c523d7a9257a031b626520d80139074b2e2e763547c4aab2156fbc92e0e2af8afeb287adec14cedc4cb5adca818cfe7be2aabafffdc75edc507786401c30732a58db2aa400cc53400d83f4ebc30e199c539eafdbca682c13877b33adee1a8757be87a52ff3dbca45767f676c736f8f27d1c43d4b53d2feaa875b51698463b907b75de94a0262ad7c9360aa2baf31fcb392f625cfd8abdf5883c3ab8704b4a81761794f6051ddc3dcdfa07deef0b386f97232634698f54ac7f7f0337ef706b9ee07b86ee97642bd7da30aceeb447d8cc9bfda9ae03519daf90c8b24a4e14e49f6213bfec9bf6324c83a8e6701677abb65ad0b501e939241f118c7617023ad35492c8143d0f08756495db8c1cfe82e175b08fc6a89e2827ac205529ce45a32becf4c6b45b6ba2dd289030fce9ad49a5ff3a662fccf5fe56546bd14a56b400776b86ee2a2b9d23910ce509665a4636eba29b1faeb6d299136f09a439e206ab44546e74db848ad8ccd79eedd96a58bfb4d558e82b664c045dbecaf53e29aa712bbf35a9c3bfd8d4394deeee068267cebdecfbb52914339d6a0256953475af952da7b579c3d1aa58b7eee1e4031eb3930692f6de3a37fdb33a95621d4225b31169f309c1f565553eb8864af9c27c97a077763230267de60fcfc6bdc7576ee20304e8e77eaa18676d8146530ebb6c06fefa19bc6448d6f963dd11710e55254a2f100394160d71de9cd49af2a0ef5447a52c22feef40c80edcf341b02084d340532ea1d0119f5f149eedd8da1e0e29d2", 0x1000}, {&(0x7f0000001280)="df00da1aea07fbbf2eb550570edbc4eb8727d7c5d93e73c4ab4a9bae1c9df5be9dcc66c888504326e18b331f2d022ff8f5d89a400e73caca955bb1baf59720f73756d72f01d484ed2e9ab6087982b864c18062092799f2218a25d1e7427a58eaeae059c29b4ec1ff54675208456f006279ae606921f8d16bda96e4f0a6912ff3e09f7780772c19f065941ee2ff5b09817b71313a74ba5892fc5994095bab03e7104d95aaa2842861fbff0f5bc2d330f2ec10c5c6a410e799fdc869126202ce3e184adba7a2256309828dc62cb7517f7030515b4ef4d5a1ab0c78ec4430829fa726bb4a77003248541af6d8dfc5", 0xed}, {&(0x7f0000000000)="9d85ddd72c39b3cd725d0f381b", 0xd}], 0x5, &(0x7f0000001400)=[{0x78, 0x11, 0x10001, "5d3db6976a019fed75111d547f67152567ceb9911fbc3c29c1fefd5e845121619ee8f0f18787b20a76d1feb5d9016ea732a10f77e087bc813868361feb20bf29f75e208315beecb142d2defc141d2a8464521e82f2cbf04c57077ded5df2d47b85e8b9e5dfd9150c"}, {0x48, 0x11f, 0x8, "119c82286533033568db0f1479eb9bebe59d67bb2401594404b8dd3ffe77a2b4316169a7d77d3fd17922873a833f7b876b"}, {0x28, 0x0, 0x9, "4f0181772a80bf2ca81525f9640e123e2e313e18a78fa9"}, {0x90, 0x11f, 0x6, "bfbde4764f6b8958022e6a04c94e9d9f559a75a9691c209fb5b9b9924ddd726f7f3c28773ec402c3e7fcff7194c9ccf23c200108484993271132f7a18c5cf96f5b38d054cf4a76e6d9ef2fc58dbc3a6f96debd2635c9ae075dd39850254176a9441513f076c87a1852c53f66fa8542e785cfb048f2271b95d7"}, {0x78, 0x110, 0x10000, "1598069c4acd9e2bc96e81933f170a091aa3b525957b4299a88e829822dd7882ac3fde95462a543c313cd9ef9c6e2907741d6873a6ce00fd36c1ce6e82bce21cf33feb26d5dd313252944878fa5b19f2e2cbb0fe1631f303475822c5b9d3715619ea96"}, {0x40, 0x119, 0x7ff, "e339da087f47f23679ecd41321e4a9d6828a242f5b93b2194a78d90d69abd5c93f60e780a6fd135ac066"}], 0x230}, 0x800) exit(0x0) pread64(r1, 0x0, 0x0, 0x3) 13:48:19 executing program 4: signalfd4(0xffffffffffffffff, &(0x7f0000000ff8), 0x8, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000340), 0x10000014c) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0xfeffffff00000000}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 13:48:19 executing program 1: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-vsock\x00', 0x2, 0x0) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000300)='/dev/sequencer2\x00', 0x200101000, 0x0) ioctl$SG_GET_TIMEOUT(r1, 0x2202, 0x0) clone(0x100002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) write$cgroup_subtree(r1, &(0x7f00000000c0)=ANY=[@ANYBLOB="2d696f202b637075202b70696473202d6d656d6f7279202f7069647320fb9f743981d4f26d6f727920ce3923e73342"], 0x2b) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$DRM_IOCTL_RM_MAP(r1, 0x4028641b, &(0x7f0000000100)={0x0, 0xbf, 0x5, 0x1, &(0x7f0000ff9000/0x4000)=nil, 0x4}) r4 = dup2(r3, r0) write$binfmt_misc(r2, &(0x7f0000000140)=ANY=[], 0x1e2ba62e) recvfrom(r2, 0x0, 0x0, 0x0, 0x0, 0x0) recvfrom(r3, &(0x7f0000000180)=""/184, 0xfffffffffffffd84, 0x10100, 0x0, 0xfffffffffffffd51) sendto$inet6(r4, &(0x7f0000000240)="06c1760f1be6b38222daa02cb4791083177c038affb419018da7ee186154c3fa9091da0989ef65168def807b80eb66d3b0d3f4ab21bb6bbadb64d0197cac276a98fd8275f1d579a9236e05d696a1c9e053ab8309d058e45e7e30bf9fe365ab508222c402875cd51af82a610d1790e99ce33e", 0x72, 0x40844, 0x0, 0x0) 13:48:19 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0xe4ffffff00000000}) [ 2501.514778] binder: 30150:30152 unknown command 1077961509 [ 2501.529835] binder: 30150:30152 ioctl c0306201 20000600 returned -22 13:48:19 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x4040633d, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) [ 2501.593736] binder: release 30150:30152 transaction 3604 in, still active [ 2501.602792] binder: send failed reply for transaction 3604 to 30150:30152 [ 2501.621848] binder: undelivered TRANSACTION_COMPLETE [ 2501.639815] binder: undelivered TRANSACTION_ERROR: 29189 13:48:19 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0xfdfdffff00000000}) 13:48:19 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000240)={{{@in6=@mcast1, @in6=@initdev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast1}, 0x0, @in6=@loopback}}, &(0x7f0000000340)=0xe8) stat(&(0x7f0000000380)='./file0\x00', &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000480)={0x0, 0x0}, &(0x7f00000004c0)=0xc) mount$9p_tcp(&(0x7f0000000080)='127.0.0.1\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='9p\x00', 0x800, &(0x7f0000000500)={'trans=tcp,', {'port', 0x3d, 0x4e22}, 0x2c, {[{@dfltuid={'dfltuid', 0x3d, r2}}, {@aname={'aname', 0x3d, '/dev/vcs\x00'}}, {@cache_mmap='cache=mmap'}, {@noextend='noextend'}, {@loose='loose'}, {@version_9p2000='version=9p2000'}], [{@euid_gt={'euid>', r3}}, {@fowner_lt={'fowner<', r4}}, {@fowner_gt={'fowner>', r5}}]}}) pread64(r1, 0x0, 0x0, 0x0) r6 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000001100)={0x0}) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r7}}, 0x0) r8 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) dup2(r8, r1) ioctl$BLKROSET(r8, 0x125d, &(0x7f0000000600)=0x1) tkill(r6, 0x15) [ 2501.717347] binder: 30169:30170 unknown command 1077961533 [ 2501.748314] binder: 30169:30170 ioctl c0306201 20000600 returned -22 13:48:19 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0xffffff7f00000000}) 13:48:19 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406348, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) [ 2501.837369] binder: release 30169:30170 transaction 3606 in, still active [ 2501.849532] binder: send failed reply for transaction 3606 to 30169:30170 [ 2501.873003] binder: undelivered TRANSACTION_COMPLETE [ 2501.890408] binder: undelivered TRANSACTION_ERROR: 29189 [ 2501.954753] binder: 30177:30180 unknown command 1077961544 13:48:20 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0xffffffff00000000}) 13:48:20 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) pread64(r1, 0x0, 0x0, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x24, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000001100)={0x0}) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r3}}, 0x0) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) dup2(r4, r1) tkill(r2, 0x15) [ 2502.002014] binder: 30177:30180 ioctl c0306201 20000600 returned -22 13:48:20 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x4040634d, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) [ 2502.146558] binder: release 30177:30180 transaction 3608 in, still active [ 2502.161099] binder: send failed reply for transaction 3608 to 30177:30180 [ 2502.195823] binder: undelivered TRANSACTION_COMPLETE [ 2502.222711] binder: undelivered TRANSACTION_ERROR: 29189 [ 2502.254879] binder: 30189:30190 unknown command 1077961549 [ 2502.269918] binder: 30189:30190 ioctl c0306201 20000600 returned -22 13:48:20 executing program 2: socket$netlink(0x10, 0x3, 0x0) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='fdinfo/3\x00') exit(0x0) ioctl$DRM_IOCTL_RES_CTX(r0, 0xc0106426, &(0x7f0000000040)={0x7, &(0x7f0000000000)=[{}, {}, {0x0}, {}, {}, {}, {}]}) ioctl$DRM_IOCTL_LOCK(r0, 0x4008642a, &(0x7f00000000c0)={r1, 0x15}) pread64(r0, 0x0, 0x0, 0x3) setsockopt$netlink_NETLINK_NO_ENOBUFS(r0, 0x10e, 0x5, &(0x7f0000000100)=0x800, 0x4) syz_open_dev$vbi(&(0x7f0000000140)='/dev/vbi#\x00', 0x3, 0x2) [ 2502.329853] binder: release 30189:30190 transaction 3610 in, still active [ 2502.348038] binder: send failed reply for transaction 3610 to 30189:30190 [ 2502.368288] binder: undelivered TRANSACTION_COMPLETE [ 2502.373486] binder: undelivered TRANSACTION_ERROR: 29189 13:48:20 executing program 4: signalfd4(0xffffffffffffffff, &(0x7f0000000ff8), 0x8, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000340), 0x10000014c) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0xffffff7f00000000}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 13:48:20 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0x2}) 13:48:20 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) pread64(r1, 0x0, 0x0, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000001100)={0x0}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r3}}, 0x0) r4 = syz_open_dev$cec(&(0x7f0000000140)='/dev/cec#\x00', 0x3, 0x2) ioctl$VHOST_SET_VRING_ENDIAN(r4, 0x4008af13, &(0x7f0000000180)={0x2, 0x4}) r5 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000080)='/proc/capi/capi20ncci\x00', 0x20000, 0x0) ioctl$SNDRV_RAWMIDI_IOCTL_STATUS(r5, 0xc0385720, &(0x7f0000000100)={0x1, {}, 0x0, 0x8}) r6 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) dup2(r6, r1) tkill(r2, 0x15) 13:48:20 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406353, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:48:20 executing program 1: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-vsock\x00', 0x2, 0x0) stat(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)) clone(0x100002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$vim2m(0xffffffffffffff9c, &(0x7f0000000240)='/dev/video35\x00', 0x2, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) dup2(r2, r0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1e2ba62e) recvfrom(r1, 0x0, 0x0, 0x0, 0x0, 0x0) read(r2, &(0x7f00000003c0)=""/4096, 0x1000) recvfrom(r2, &(0x7f0000000180)=""/184, 0xfffffffffffffd84, 0x10100, 0x0, 0xfffffffffffffd51) [ 2502.520833] binder: 30201:30203 unknown command 1077961555 [ 2502.526541] binder: 30201:30203 ioctl c0306201 20000600 returned -22 13:48:20 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0x3}) 13:48:20 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:48:20 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) r2 = syz_open_dev$swradio(&(0x7f0000000080)='/dev/swradio#\x00', 0x0, 0x2) setsockopt$packet_buf(r2, 0x107, 0x5, &(0x7f0000000100)="b3494c3d0adc23b824f54cb63c31b26474425e3c8555d43a369f04db2133cfa83bd695e7a85057a9631d53386cadefccb8ffd7b2532badd0b9dd5640369cb323d1852988b1f3a54edc62e09b55e9544c390a281b180a05a880e96a2f39ad02d4365451c2746dad7f29b793080c32e9bb3702c1e2a72a81f67b2cbf714bf447ded5a5a2b87b276f4615d09fc9d29eb34274cf3dfb08316838e040ef2a75a7d61042f4421e2fc961d4c4941ac2b56b6284273f85930033135087dda74be45880d024532393e87f3fe61c9faa09c43b0b04b821b3838db42e88d910cdd90ec665b10e62ab9d76bf", 0xe6) pread64(r1, 0x0, 0x0, 0x0) r3 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000001100)={0x0}) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r4}}, 0x0) r5 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) dup2(r5, r1) tkill(r3, 0x15) [ 2502.608539] syz-executor.1 invoked oom-killer: gfp_mask=0x7000c0(GFP_KERNEL_ACCOUNT), order=0, oom_score_adj=1000 [ 2502.620049] binder: release 30201:30203 transaction 3612 in, still active [ 2502.627024] binder: send failed reply for transaction 3612 to 30201:30203 [ 2502.648572] binder: undelivered TRANSACTION_COMPLETE [ 2502.653745] binder: undelivered TRANSACTION_ERROR: 29189 [ 2502.659469] CPU: 1 PID: 30193 Comm: syz-executor.1 Not tainted 5.0.0+ #6 [ 2502.666447] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2502.675835] Call Trace: [ 2502.678469] dump_stack+0x172/0x1f0 [ 2502.682132] dump_header+0x10f/0xb6c [ 2502.685906] ? _raw_spin_unlock_irqrestore+0xa4/0xe0 [ 2502.691042] ? ___ratelimit+0x60/0x595 [ 2502.694958] ? do_raw_spin_unlock+0x57/0x270 [ 2502.699401] oom_kill_process.cold+0x10/0x6f5 [ 2502.703935] ? task_will_free_mem+0x139/0x6e0 [ 2502.708467] out_of_memory+0x79a/0x1280 [ 2502.712475] ? mem_cgroup_unmark_under_oom+0x8d/0xb0 [ 2502.713094] binder: 30219:30220 got transaction to context manager from process owning it [ 2502.717616] ? oom_killer_disable+0x280/0x280 [ 2502.717634] ? mem_cgroup_unmark_under_oom+0x8d/0xb0 [ 2502.717668] mem_cgroup_out_of_memory+0x99/0xe0 [ 2502.717686] ? memcg_memory_event+0x40/0x40 [ 2502.717714] ? _raw_spin_unlock+0x2d/0x50 [ 2502.745788] binder: 30219:30220 transaction failed 29201/-22, size 0-0 line 2887 [ 2502.749004] ? mem_cgroup_unmark_under_oom+0x8d/0xb0 [ 2502.749021] try_charge+0xfec/0x1570 [ 2502.749037] ? find_held_lock+0x35/0x130 [ 2502.749059] ? mem_cgroup_oom_trylock+0x1a0/0x1a0 [ 2502.749076] ? get_mem_cgroup_from_mm+0x10b/0x2b0 [ 2502.749090] ? find_held_lock+0x35/0x130 [ 2502.749106] ? get_mem_cgroup_from_mm+0x10b/0x2b0 [ 2502.749129] memcg_kmem_charge_memcg+0x7c/0x130 [ 2502.749170] ? memcg_kmem_put_cache+0xb0/0xb0 [ 2502.749191] ? get_mem_cgroup_from_mm+0x128/0x2b0 [ 2502.749207] memcg_kmem_charge+0x13b/0x340 [ 2502.749228] __alloc_pages_nodemask+0x437/0x710 [ 2502.763401] binder: 30219:30220 ioctl c0306201 20000600 returned -14 [ 2502.765788] ? kasan_kmalloc+0x9/0x10 [ 2502.765809] ? __alloc_pages_slowpath+0x2900/0x2900 [ 2502.765849] ? __alloc_skb+0x3cd/0x5e0 [ 2502.765867] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 2502.765889] alloc_pages_current+0x107/0x210 [ 2502.765908] alloc_skb_with_frags+0x1a5/0x580 [ 2502.765930] sock_alloc_send_pskb+0x72d/0x8a0 [ 2502.765956] ? sock_wmalloc+0x120/0x120 [ 2502.853906] ? lock_downgrade+0x810/0x810 [ 2502.853928] ? rcu_read_unlock_special+0xf3/0x210 [ 2502.853951] unix_stream_sendmsg+0x5f7/0x990 [ 2502.867427] ? unix_stream_sendpage+0xb10/0xb10 [ 2502.872132] ? __lock_acquire+0x53b/0x4700 [ 2502.876428] ? smack_socket_sendmsg+0xb1/0x1a0 [ 2502.881045] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 2502.886614] ? security_socket_sendmsg+0x93/0xc0 [ 2502.891408] ? unix_stream_sendpage+0xb10/0xb10 [ 2502.896110] sock_sendmsg+0xdd/0x130 [ 2502.899883] sock_write_iter+0x27c/0x3e0 [ 2502.903976] ? sock_sendmsg+0x130/0x130 [ 2502.908007] ? __fget+0x340/0x540 [ 2502.911493] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 2502.917057] ? iov_iter_init+0xea/0x220 [ 2502.921065] __vfs_write+0x613/0x8e0 [ 2502.924827] ? kernel_read+0x120/0x120 [ 2502.928799] ? rw_verify_area+0x118/0x360 [ 2502.932982] vfs_write+0x20c/0x580 [ 2502.936558] ksys_write+0xea/0x1f0 [ 2502.940130] ? __ia32_sys_read+0xb0/0xb0 [ 2502.944252] ? do_syscall_64+0x26/0x610 [ 2502.948258] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 2502.953666] ? do_syscall_64+0x26/0x610 [ 2502.957692] __x64_sys_write+0x73/0xb0 [ 2502.961629] do_syscall_64+0x103/0x610 [ 2502.965570] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 2502.970793] RIP: 0033:0x457e29 [ 2502.974016] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 2502.992974] RSP: 002b:00007fc7dfbcdc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 2503.000721] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000457e29 13:48:20 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) [ 2503.008023] RDX: 000000001e2ba62e RSI: 0000000020000140 RDI: 000000000000000a [ 2503.015326] RBP: 000000000073c040 R08: 0000000000000000 R09: 0000000000000000 [ 2503.022635] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fc7dfbce6d4 [ 2503.030119] R13: 00000000004c7260 R14: 00000000004dcde8 R15: 00000000ffffffff [ 2503.059745] binder: release 30219:30220 transaction 3614 in, still active [ 2503.077983] binder: send failed reply for transaction 3614 to 30219:30220 [ 2503.085035] binder: undelivered TRANSACTION_ERROR: 29201 [ 2503.085277] binder: undelivered TRANSACTION_COMPLETE 13:48:21 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0x4}) [ 2503.108181] binder: undelivered TRANSACTION_ERROR: 29189 13:48:21 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0x5}) 13:48:21 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='fdinfo/3\x00') exit(0x0) pread64(r1, 0x0, 0x0, 0x3) r2 = syz_genetlink_get_family_id$fou(&(0x7f0000000040)='fou\x00') sendmsg$FOU_CMD_ADD(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x2c, r2, 0xb30, 0x70bd27, 0x25dfdbfb, {}, [@FOU_ATTR_TYPE={0x8, 0x4, 0x3}, @FOU_ATTR_AF={0x8, 0x2, 0x2}, @FOU_ATTR_TYPE={0x8, 0x4, 0x1}]}, 0x2c}, 0x1, 0x0, 0x0, 0x80}, 0x10) [ 2503.450032] memory: usage 306592kB, limit 307200kB, failcnt 234 [ 2503.456914] memory+swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 2503.466346] kmem: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 2503.473258] Memory cgroup stats for /syz1: cache:104KB rss:178008KB rss_huge:10240KB shmem:184KB mapped_file:0KB dirty:0KB writeback:0KB swap:0KB inactive_anon:0KB active_anon:161624KB inactive_file:0KB active_file:0KB unevictable:16508KB [ 2503.506469] oom-kill:constraint=CONSTRAINT_NONE,nodemask=(null),cpuset=syz1,mems_allowed=0-1,oom_memcg=/syz1,task_memcg=/syz1,task=syz-executor.1,pid=30075,uid=0 [ 2503.522589] Memory cgroup out of memory: Kill process 30075 (syz-executor.1) score 1160 or sacrifice child [ 2503.533504] Killed process 30075 (syz-executor.1) total-vm:72972kB, anon-rss:16556kB, file-rss:35804kB, shmem-rss:0kB 13:48:21 executing program 4: signalfd4(0xffffffffffffffff, &(0x7f0000000ff8), 0x8, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000340), 0x10000014c) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0xffffffff00000000}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 13:48:21 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0x6}) 13:48:21 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) pread64(r1, 0x0, 0x0, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000001100)={0x0}) pivot_root(&(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='./file0\x00') timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r3}}, 0x0) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) dup2(r4, r1) tkill(r2, 0x15) [ 2503.573827] syz-executor.1 invoked oom-killer: gfp_mask=0x6000c0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 2503.680066] CPU: 1 PID: 30208 Comm: syz-executor.1 Not tainted 5.0.0+ #6 [ 2503.687020] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2503.696412] Call Trace: [ 2503.699044] dump_stack+0x172/0x1f0 [ 2503.702803] dump_header+0x10f/0xb6c [ 2503.706567] ? _raw_spin_unlock_irqrestore+0xa4/0xe0 [ 2503.711719] ? ___ratelimit+0x60/0x595 [ 2503.715647] ? do_raw_spin_unlock+0x57/0x270 [ 2503.720114] oom_kill_process.cold+0x10/0x6f5 [ 2503.724685] ? task_will_free_mem+0x139/0x6e0 [ 2503.729236] out_of_memory+0x79a/0x1280 [ 2503.733262] ? oom_killer_disable+0x280/0x280 [ 2503.737800] ? mem_cgroup_unmark_under_oom+0x8d/0xb0 [ 2503.742964] mem_cgroup_out_of_memory+0x99/0xe0 [ 2503.747690] ? memcg_memory_event+0x40/0x40 [ 2503.752065] ? _raw_spin_unlock+0x2d/0x50 [ 2503.756260] ? mem_cgroup_unmark_under_oom+0x8d/0xb0 [ 2503.761408] try_charge+0xb4a/0x1570 [ 2503.765188] ? find_held_lock+0x35/0x130 [ 2503.769305] ? mem_cgroup_oom_trylock+0x1a0/0x1a0 [ 2503.774223] ? kasan_check_read+0x11/0x20 [ 2503.778427] ? get_mem_cgroup_from_mm+0x128/0x2b0 [ 2503.783321] mem_cgroup_try_charge+0x24d/0x5e0 [ 2503.787962] mem_cgroup_try_charge_delay+0x1f/0xa0 [ 2503.792941] wp_page_copy+0x408/0x1740 [ 2503.796868] ? find_held_lock+0x35/0x130 [ 2503.800981] ? pmd_pfn+0x1d0/0x1d0 [ 2503.804566] ? lock_downgrade+0x810/0x810 [ 2503.808751] ? __pte_alloc_kernel+0x220/0x220 [ 2503.813293] ? kasan_check_read+0x11/0x20 [ 2503.817486] ? do_raw_spin_unlock+0x57/0x270 [ 2503.822256] do_wp_page+0x2ed/0x1520 [ 2503.826017] ? rwlock_bug.part.0+0x90/0x90 [ 2503.830308] ? lock_acquire+0x16f/0x3f0 [ 2503.834332] ? finish_mkwrite_fault+0x4f0/0x4f0 [ 2503.839052] ? add_mm_counter_fast.part.0+0x40/0x40 [ 2503.844130] __handle_mm_fault+0x22db/0x3f20 [ 2503.848625] ? vmf_insert_mixed_mkwrite+0x40/0x40 [ 2503.853524] ? find_held_lock+0x35/0x130 [ 2503.857634] ? handle_mm_fault+0x322/0xb30 [ 2503.861944] ? kasan_check_read+0x11/0x20 [ 2503.866173] handle_mm_fault+0x43f/0xb30 [ 2503.870294] __do_page_fault+0x5da/0xd60 [ 2503.874415] do_page_fault+0x71/0x581 [ 2503.878264] page_fault+0x1e/0x30 [ 2503.881757] RIP: 0010:copy_user_enhanced_fast_string+0xe/0x20 [ 2503.887815] Code: 89 d1 c1 e9 03 83 e2 07 f3 48 a5 89 d1 f3 a4 31 c0 0f 1f 00 c3 0f 1f 80 00 00 00 00 0f 1f 00 83 fa 40 0f 82 70 ff ff ff 89 d1 a4 31 c0 0f 1f 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 83 [ 2503.906730] RSP: 0018:ffff8881be207728 EFLAGS: 00010206 [ 2503.912106] RAX: 0000000000000000 RBX: 0000000000008000 RCX: 0000000000006640 [ 2503.919410] RDX: 0000000000008000 RSI: ffff88814d8019c0 RDI: 0000000020049000 [ 2503.926707] RBP: ffff8881be207760 R08: ffffed1029b01000 R09: 0000000000000000 [ 2503.933987] R10: ffffed1029b00fff R11: ffff88814d807fff R12: 0000000020047640 [ 2503.941270] R13: ffff88814d800000 R14: 000000002004f640 R15: 00007ffffffff000 [ 2503.948581] ? copyout+0xe2/0x100 [ 2503.952547] _copy_to_iter+0x27e/0x1080 [ 2503.956541] ? unix_stream_read_generic+0x13e6/0x1c20 [ 2503.961760] ? iov_iter_copy_from_user_atomic+0xb80/0xb80 [ 2503.967319] ? check_stack_object+0x114/0x160 [ 2503.971829] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 2503.977379] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 2503.982934] ? __phys_addr_symbol+0x30/0x70 [ 2503.987284] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 2503.992347] ? __check_object_size+0x3d/0x42f [ 2503.996891] simple_copy_to_iter+0x36/0x40 [ 2504.001193] __skb_datagram_iter+0x480/0x750 [ 2504.005643] ? __lock_is_held+0xb6/0x140 [ 2504.009755] ? skb_kill_datagram+0x130/0x130 [ 2504.014256] skb_copy_datagram_iter+0x92/0x310 [ 2504.018944] unix_stream_read_actor+0x7f/0xc0 [ 2504.023484] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 2504.029076] unix_stream_read_generic+0x876/0x1c20 [ 2504.034081] ? unix_release+0x90/0x90 [ 2504.037923] ? __fget+0x340/0x540 [ 2504.041426] ? lock_downgrade+0x810/0x810 [ 2504.045618] ? finish_wait+0x260/0x260 [ 2504.049556] ? __fget+0x367/0x540 [ 2504.053056] unix_stream_recvmsg+0xc3/0x100 [ 2504.057442] ? unix_stream_splice_read+0x220/0x220 [ 2504.062420] ? unix_state_double_unlock+0x70/0x70 [ 2504.067323] ? security_socket_recvmsg+0x9b/0xd0 [ 2504.072124] ? unix_stream_splice_read+0x220/0x220 [ 2504.077121] sock_recvmsg+0xd0/0x110 [ 2504.080904] __sys_recvfrom+0x1ff/0x350 [ 2504.084917] ? __ia32_sys_send+0x100/0x100 [ 2504.089248] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 2504.094829] ? put_timespec64+0xda/0x140 [ 2504.098928] ? nsecs_to_jiffies+0x30/0x30 [ 2504.103128] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 2504.107950] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 2504.112752] ? do_syscall_64+0x26/0x610 [ 2504.116773] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 2504.122211] __x64_sys_recvfrom+0xe1/0x1a0 [ 2504.126509] do_syscall_64+0x103/0x610 [ 2504.130448] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 2504.135682] RIP: 0033:0x457e29 [ 2504.138910] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 2504.157846] RSP: 002b:00007fc7dfc0fc78 EFLAGS: 00000246 ORIG_RAX: 000000000000002d [ 2504.165591] RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 0000000000457e29 [ 2504.172892] RDX: fffffffffffffd84 RSI: 0000000020000180 RDI: 0000000000000006 13:48:22 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0x7}) [ 2504.180212] RBP: 000000000073bf00 R08: 0000000000000000 R09: fffffffffffffd51 [ 2504.187516] R10: 0000000000010100 R11: 0000000000000246 R12: 00007fc7dfc106d4 [ 2504.194829] R13: 00000000004c4a98 R14: 00000000004d8528 R15: 00000000ffffffff [ 2504.310801] memory: usage 306456kB, limit 307200kB, failcnt 234 [ 2504.318305] memory+swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 2504.325346] kmem: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 2504.333134] Memory cgroup stats for /syz1: cache:104KB rss:178008KB rss_huge:10240KB shmem:184KB mapped_file:0KB dirty:0KB writeback:0KB swap:0KB inactive_anon:11036KB active_anon:161624KB inactive_file:0KB active_file:0KB unevictable:5472KB [ 2504.415984] oom-kill:constraint=CONSTRAINT_NONE,nodemask=(null),cpuset=syz1,mems_allowed=0-1,oom_memcg=/syz1,task_memcg=/syz1,task=syz-executor.1,pid=26192,uid=0 [ 2504.528012] Memory cgroup out of memory: Kill process 26192 (syz-executor.1) score 1160 or sacrifice child [ 2504.608021] Killed process 26192 (syz-executor.1) total-vm:72840kB, anon-rss:16548kB, file-rss:35800kB, shmem-rss:0kB [ 2504.638561] device bridge_slave_1 left promiscuous mode [ 2504.644180] bridge0: port 2(bridge_slave_1) entered disabled state [ 2504.684962] oom_reaper: reaped process 26192 (syz-executor.1), now anon-rss:0kB, file-rss:34840kB, shmem-rss:0kB 13:48:22 executing program 1: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-vsock\x00', 0x2, 0x0) openat$pfkey(0xffffffffffffff9c, &(0x7f0000000100)='/proc/self/net/pfkey\x00', 0x301201, 0x0) clone(0x100002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = creat(&(0x7f00000000c0)='./file0\x00', 0x20) write$FUSE_DIRENT(r3, &(0x7f0000000240)={0xb0, 0x0, 0x3, [{0x1, 0x10000, 0x11, 0x1, '/dev/vhost-vsock\x00'}, {0x6, 0x2, 0xf, 0x4db1, 'em1keyring%!GPL'}, {0x5, 0x80000001, 0x11, 0x1ff, '/dev/vhost-vsock\x00'}, {0x6, 0x7fffffff, 0x0, 0x1}]}, 0xb0) dup2(r2, r0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1e2ba62e) recvfrom(r1, 0x0, 0x0, 0x0, 0x0, 0x0) recvfrom(r2, &(0x7f0000000180)=""/184, 0xfffffffffffffd84, 0x10100, 0x0, 0xfffffffffffffd51) [ 2504.763881] device bridge_slave_0 left promiscuous mode [ 2504.775930] bridge0: port 1(bridge_slave_0) entered disabled state 13:48:22 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0x8}) 13:48:22 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) pread64(r1, 0x0, 0x0, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_gettime(0xfffffffffffffffc, &(0x7f0000000100)={0x0}) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r3}}, 0x0) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) dup2(r4, r1) tkill(r2, 0x15) 13:48:22 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/sys/net/ipv4/vs/sync_ports\x00', 0x2, 0x0) ioctl$SG_SCSI_RESET(r1, 0x2284, 0x0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='fdinfo/3\x00') exit(0x0) r3 = add_key(&(0x7f0000000280)='dns_resolver\x00', &(0x7f00000002c0)={'syz', 0x3}, &(0x7f0000000300)="e75f82dca05a79eae706e865dac27a5e6c2f0af76b8ff44bc287bc4425d531b371809c05dbc8aece0775d362fedbedc1f44aae5c41d8e08b2e27b8c0c24fa65ca9939d69e7380f41cd8ba3fdbcbedf6a38b2a18668889855b933be9d37755a5c01e7f7205f8949bc27a72a531921b930d8b721003b83cab3e1507c58474bcfbc8179b1ab6829316e069209ea24bc00507e667af80d75b7bd1517c390c4a0c4a555a7f20dabfcefac28867b1b740dbfdabc8e993cb8dfa9f4f0252fd2e1d74f5cc05a4128b34651025b0adad992386a86a112af063a79132c97f65a8ddcc0e2d665", 0xe1, 0xfffffffffffffffd) r4 = socket(0xa, 0x802, 0x0) setsockopt$inet_int(r1, 0x0, 0x12, &(0x7f00000004c0)=0x1fd, 0x4) bind$inet6(r4, &(0x7f0000000280), 0x1c) keyctl$restrict_keyring(0x1d, r3, 0x0, &(0x7f0000000400)='\x00') ioctl$SCSI_IOCTL_SEND_COMMAND(r1, 0x1, &(0x7f00000001c0)=ANY=[@ANYBLOB="8200000004000000f8ffffff7c5a1189004dfebdcf8f74ea454830b4d7b7d128b8d8840b60062ba907bffee5cf8c7c48a1e09cd380b7921259036c459ff5f56bb513d563b602ddd72aadfdefb5e60cc42e781683be9e8f18086ea9f09060b92a01dacc486fa552f86c2e839b99267e6389dc19570468dfef00011ef669f3387590b96ca17884006175781886a250"]) setsockopt$l2tp_PPPOL2TP_SO_RECVSEQ(r2, 0x111, 0x2, 0x1, 0x4) ioctl$SNDRV_TIMER_IOCTL_INFO(r1, 0x80e85411, &(0x7f0000000440)=""/30) getsockopt$inet_buf(r2, 0x0, 0x2f, &(0x7f0000000000)=""/110, &(0x7f00000000c0)=0x6e) pread64(r2, 0x0, 0x0, 0x3) getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(r2, 0x84, 0x73, &(0x7f0000000480)={0x0, 0x9, 0x0, 0x248, 0xa1c}, &(0x7f0000000500)=0x18) setsockopt$inet_sctp_SCTP_CONTEXT(r1, 0x84, 0x11, &(0x7f0000000540)={r5, 0x3}, 0x8) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, 0x0}, &(0x7f0000000140)=0xc) setfsgid(r6) [ 2505.094263] device hsr_slave_1 left promiscuous mode [ 2505.137030] device hsr_slave_0 left promiscuous mode [ 2505.201221] team0 (unregistering): Port device team_slave_1 removed [ 2505.232540] team0 (unregistering): Port device team_slave_0 removed [ 2505.263513] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 2505.341690] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 2505.512026] bond0 (unregistering): Released all slaves [ 2506.761021] IPVS: ftp: loaded support on port[0] = 21 [ 2506.972909] chnl_net:caif_netlink_parms(): no params data found [ 2507.057794] bridge0: port 1(bridge_slave_0) entered blocking state [ 2507.078047] bridge0: port 1(bridge_slave_0) entered disabled state [ 2507.086831] device bridge_slave_0 entered promiscuous mode [ 2507.109918] bridge0: port 2(bridge_slave_1) entered blocking state [ 2507.116499] bridge0: port 2(bridge_slave_1) entered disabled state [ 2507.138978] device bridge_slave_1 entered promiscuous mode [ 2507.159759] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 2507.169482] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 2507.190191] team0: Port device team_slave_0 added [ 2507.196819] team0: Port device team_slave_1 added [ 2507.320675] device hsr_slave_0 entered promiscuous mode [ 2507.368353] device hsr_slave_1 entered promiscuous mode [ 2507.416932] bridge0: port 2(bridge_slave_1) entered blocking state [ 2507.423407] bridge0: port 2(bridge_slave_1) entered forwarding state [ 2507.430134] bridge0: port 1(bridge_slave_0) entered blocking state [ 2507.436561] bridge0: port 1(bridge_slave_0) entered forwarding state [ 2507.551080] 8021q: adding VLAN 0 to HW filter on device bond0 [ 2507.580854] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 2507.589465] bridge0: port 1(bridge_slave_0) entered disabled state [ 2507.607408] bridge0: port 2(bridge_slave_1) entered disabled state [ 2507.616087] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 2507.637346] 8021q: adding VLAN 0 to HW filter on device team0 [ 2507.654937] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 2507.670519] bridge0: port 1(bridge_slave_0) entered blocking state [ 2507.676991] bridge0: port 1(bridge_slave_0) entered forwarding state [ 2507.741097] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 2507.757804] bridge0: port 2(bridge_slave_1) entered blocking state [ 2507.764291] bridge0: port 2(bridge_slave_1) entered forwarding state [ 2507.799015] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 2507.821913] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 2507.855467] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 2507.875367] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 2507.903576] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 2507.919440] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 2507.936134] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 2507.956645] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 2507.996761] binder_alloc: 30284: binder_alloc_buf, no vma [ 2508.018074] binder: 30284:30285 transaction failed 29189/-3, size 0-0 line 3035 [ 2508.025720] binder: send failed reply for transaction 3617 to 30284:30285 [ 2508.048097] binder: 30284:30285 ioctl c0306201 20000600 returned -14 13:48:26 executing program 1: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-vsock\x00', 0x2, 0x0) clone(0x100002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) dup2(r2, r0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1e2ba62e) recvfrom(r1, 0x0, 0x0, 0x0, 0x0, 0x0) recvfrom(r2, &(0x7f0000000180)=""/184, 0xfffffffffffffd84, 0x10100, 0x0, 0xfffffffffffffd51) socket$rds(0x15, 0x5, 0x0) 13:48:26 executing program 4: signalfd4(0xffffffffffffffff, &(0x7f0000000ff8), 0x8, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000340), 0x10000014c) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x2}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 13:48:26 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0xa}) 13:48:26 executing program 2: socket$netlink(0x10, 0x3, 0x0) exit(0x0) pread64(0xffffffffffffffff, 0x0, 0x0, 0x3) 13:48:26 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:48:26 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) pread64(r1, 0x0, 0x0, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000001100)={0x0}) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r3}}, 0x0) fcntl$setstatus(r0, 0x4, 0x46c00) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) r5 = dup2(r4, r1) ioctl$TUNSETNOCSUM(r5, 0x400454c8, 0x0) tkill(r2, 0x19) [ 2508.094026] binder: undelivered TRANSACTION_ERROR: 29190 [ 2508.100644] binder: undelivered TRANSACTION_COMPLETE [ 2508.143693] binder: undelivered TRANSACTION_ERROR: 29189 [ 2508.168103] binder_alloc: 30297: binder_alloc_buf, no vma [ 2508.185085] binder: 30297:30299 transaction failed 29189/-3, size 0-0 line 3035 13:48:26 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0x10}) 13:48:26 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) pread64(r1, 0x0, 0x0, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000001100)={0x0}) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r3}}, 0x0) r4 = getpid() r5 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f00000012c0)={&(0x7f0000000000), 0xc, &(0x7f0000001280)={&(0x7f0000000900)=@newlink={0x38, 0x10, 0x501, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x18, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0xc, 0x2, [@tunl_policy=[@IFLA_IPTUN_LINK={0x8, 0x4001}]]}}}]}, 0x38}}, 0x0) rt_sigqueueinfo(r4, 0x1e, &(0x7f0000000100)={0x36, 0x5, 0x7}) dup2(r5, r1) tkill(r2, 0x15) [ 2508.208165] binder: send failed reply for transaction 3620 to 30297:30299 [ 2508.218713] binder: 30297:30299 ioctl c0306201 20000600 returned -14 13:48:26 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:48:26 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0x48}) [ 2508.318241] binder: undelivered TRANSACTION_ERROR: 29190 [ 2508.326354] binder: undelivered TRANSACTION_COMPLETE [ 2508.345367] binder: undelivered TRANSACTION_ERROR: 29189 [ 2508.424098] binder_alloc: 30312: binder_alloc_buf, no vma [ 2508.449159] binder: 30312:30316 transaction failed 29189/-3, size 0-0 line 3035 13:48:26 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) pread64(r1, 0x0, 0x0, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000001100)={0x0}) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r3}}, 0x0) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) ioctl$KVM_GET_SUPPORTED_CPUID(r4, 0xc008ae05, &(0x7f0000000100)=""/85) write$P9_RUNLINKAT(r4, &(0x7f0000000180)={0x7, 0x4d, 0x2}, 0x7) dup2(r4, r1) tkill(r2, 0x15) r5 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x0, 0x0) ioctl$TUNSETNOCSUM(r5, 0x400454c8, 0x1) [ 2508.471944] binder: send failed reply for transaction 3623 to 30312:30316 13:48:26 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0x4c}) [ 2508.497810] binder: 30312:30316 ioctl c0306201 20000600 returned -14 [ 2508.557496] binder: undelivered TRANSACTION_ERROR: 29190 [ 2508.564649] binder: undelivered TRANSACTION_COMPLETE [ 2508.580479] binder: undelivered TRANSACTION_ERROR: 29189 13:48:27 executing program 1: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-vsock\x00', 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cpuacct.usage_percpu_user\x00', 0x0, 0x0) setsockopt$sock_attach_bpf(r0, 0x1, 0x32, &(0x7f0000000100)=r1, 0x4) clone(0x100002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r4 = dup2(r3, r0) write$binfmt_misc(r2, &(0x7f0000000140)=ANY=[], 0x1e2ba62e) setsockopt$CAIFSO_LINK_SELECT(r4, 0x116, 0x7f, &(0x7f0000000140)=0xd26, 0x4) recvfrom(r2, 0x0, 0x0, 0x0, 0x0, 0x0) recvfrom(r3, &(0x7f0000000240)=""/184, 0x10e, 0x42, 0x0, 0xfffffffffffffff2) 13:48:27 executing program 4: signalfd4(0xffffffffffffffff, &(0x7f0000000ff8), 0x8, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000340), 0x10000014c) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 13:48:27 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:48:27 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0x60}) 13:48:27 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) pread64(r1, 0x0, 0x0, 0x0) r2 = gettid() ioctl$EXT4_IOC_PRECACHE_EXTENTS(r1, 0x6612) timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000001100)={0x0}) tgkill(r2, r2, 0x3f) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r3}}, 0x0) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/vcs\x00', 0x40, 0x0) setxattr$trusted_overlay_redirect(&(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='trusted.overlay.redirect\x00', &(0x7f0000000140)='./file0\x00', 0x8, 0x0) dup2(r4, r1) tkill(r2, 0x15) 13:48:27 executing program 2: socket$netlink(0x10, 0x3, 0x0) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='fdinfo/3\x00') exit(0x0) sendfile(r0, r0, &(0x7f0000000000), 0x4) pread64(r0, 0x0, 0x0, 0x3) [ 2509.130625] binder_alloc: 30430: binder_alloc_buf, no vma [ 2509.144398] binder: 30430:30437 transaction failed 29189/-3, size 0-0 line 3035 [ 2509.162776] binder: send failed reply for transaction 3626 to 30430:30437 13:48:27 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0x68}) [ 2509.176711] binder: 30430:30437 ioctl c0306201 20000600 returned -14 13:48:27 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) pread64(r1, 0x0, 0x0, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000001100)={0x0}) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r3}}, 0x0) ioctl$ASHMEM_GET_NAME(r1, 0x81007702, &(0x7f0000000100)=""/129) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) dup2(r4, r1) tkill(r2, 0x15) mount$bpf(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000001c0)='bpf\x00', 0x9000, &(0x7f0000000300)=ANY=[@ANYBLOB="6d6f64653d30303030303030303030303030303030303030373737372c6d6f64653d30303030303030303030303030303030303030303030332c6d6f64653d30303030303030303030303030313137353633373337302c6d6f64653d30303030303030303030303030303030303030303030372c7063723d30303030303030303030303030303030303034392c66756e633d4649524d574152455f434845434b2c7065726d69745f646972656374696f2c736d61636b6673726f6f743d29002c0083ee4a9a260bd36ff3be0d5196a3d3e8a46ab8bdf9d0c28c09"]) 13:48:27 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) [ 2509.226359] binder: undelivered TRANSACTION_ERROR: 29190 [ 2509.232636] binder: undelivered TRANSACTION_COMPLETE [ 2509.255497] binder: undelivered TRANSACTION_ERROR: 29189 13:48:27 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0x6c}) 13:48:27 executing program 1: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vhost-vsock\x00', 0x2, 0x0) clone(0x100002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) dup2(r2, r0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1e2ba62e) recvfrom(r1, 0x0, 0x0, 0x0, 0x0, 0x0) recvfrom(r2, &(0x7f0000000180)=""/184, 0xfffffffffffffd84, 0x10100, 0x0, 0xfffffffffffffd51) [ 2509.312089] binder_alloc: 30515: binder_alloc_buf, no vma [ 2509.325327] binder: 30515:30544 transaction failed 29189/-3, size 0-0 line 3035 [ 2509.335936] binder: send failed reply for transaction 3629 to 30515:30544 13:48:27 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) pread64(r1, 0x0, 0x0, 0x0) syz_init_net_socket$rose(0xb, 0x5, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000001100)={0x0}) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r3}}, 0x0) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) r5 = dup2(r4, r1) accept4$x25(r5, &(0x7f0000000100), &(0x7f0000000140)=0x12, 0x80000) connect$bt_sco(r4, &(0x7f0000000080)={0x1f, {0x8, 0x8, 0x5, 0x3f, 0x2, 0x7}}, 0x8) tkill(r2, 0x15) [ 2509.373577] binder: 30515:30544 ioctl c0306201 20000600 returned -14 13:48:27 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0x74}) [ 2509.470419] binder: undelivered TRANSACTION_ERROR: 29190 [ 2509.478894] binder: undelivered TRANSACTION_COMPLETE [ 2509.505336] binder: undelivered TRANSACTION_ERROR: 29189 13:48:28 executing program 4: signalfd4(0xffffffffffffffff, &(0x7f0000000ff8), 0x8, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000340), 0x10000014c) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 13:48:28 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:48:28 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0x7a}) 13:48:28 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) pread64(r1, 0x0, 0x0, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000001100)={0x0}) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r3}}, 0x0) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) r5 = dup2(r4, r1) r6 = syz_genetlink_get_family_id$tipc(&(0x7f00000001c0)='TIPC\x00') sendmsg$TIPC_CMD_SHOW_LINK_STATS(r5, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x28, r6, 0x700, 0x70bd2a, 0x25dfdbfe, {{}, 0x0, 0xb, 0x0, {0xc, 0x14, 'syz1\x00'}}, ["", ""]}, 0x28}, 0x1, 0x0, 0x0, 0x20040004}, 0x800) openat$pfkey(0xffffffffffffff9c, &(0x7f0000000140)='/proc/self/net/pfkey\x00', 0x80, 0x0) ioctl$sock_SIOCDELDLCI(r1, 0x8981, &(0x7f0000000100)={'vlan0\x00', 0xfffffffffffffdef}) tkill(r2, 0x15) write$FUSE_NOTIFY_INVAL_INODE(r4, &(0x7f0000000080)={0x28, 0x2, 0x0, {0x2, 0x3d3, 0x8}}, 0x28) 13:48:28 executing program 1: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-vsock\x00', 0x2, 0x0) clone(0x100002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = dup2(r2, r0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1e2ba62e) recvfrom(r1, 0x0, 0x0, 0x0, 0x0, 0x0) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000100)={r3, 0x28, &(0x7f00000000c0)}, 0x10) recvfrom(r2, &(0x7f0000000180)=""/184, 0xfffffffffffffd84, 0x10100, 0x0, 0xfffffffffffffd51) 13:48:28 executing program 2: socket$netlink(0x10, 0x3, 0x0) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='fdinfo/3\x00') exit(0x0) pread64(r0, 0x0, 0x0, 0x3) stat(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0}) r2 = getgid() stat(&(0x7f0000000140)='\x00', &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) getresgid(&(0x7f0000000200), &(0x7f0000000240)=0x0, &(0x7f0000000280)) fsetxattr$system_posix_acl(r0, &(0x7f0000000000)='system.posix_acl_access\x00', &(0x7f00000002c0)={{}, {0x1, 0x2}, [{0x2, 0x3, r1}], {}, [{0x8, 0x2, r2}, {0x8, 0x1, r3}, {0x8, 0x4, r4}], {0x10, 0x4}, {0x20, 0x1}}, 0x44, 0x2) 13:48:28 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0x300}) [ 2510.150364] binder_alloc: 30676: binder_alloc_buf, no vma [ 2510.165619] binder: 30676:30686 transaction failed 29189/-3, size 0-0 line 3035 13:48:28 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0x500}) 13:48:28 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) pread64(r1, 0x0, 0x0, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) ioctl$ASHMEM_SET_NAME(r1, 0x41007701, &(0x7f00000002c0)='\x00') r3 = syz_open_dev$sndpcmp(&(0x7f0000000080)='/dev/snd/pcmC#D#p\x00', 0x7ff, 0x80000) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r3, 0x40485404, &(0x7f0000000100)={{0x2, 0x3, 0x143, 0x0, 0x1ff}, 0xfffffffffffffffb, 0x8}) clock_gettime(0x0, &(0x7f0000001100)={0x0}) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f00000001c0)={0x0, 0x18, 0xfa00, {0x4, &(0x7f0000000180), 0x2, 0x1}}, 0x20) ioctl$EXT4_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000240)=0x151337cd6939691f) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r4}}, 0x0) setsockopt$netlink_NETLINK_PKTINFO(r3, 0x10e, 0x3, &(0x7f0000000280)=0x6, 0x4) ioctl$KVM_SET_SIGNAL_MASK(r3, 0x4004ae8b, &(0x7f0000001140)={0x1000, "712f4e54e6865778c5eea4898d8a047a4e596470894bf975099fa12161c51e2e87eb220023e07840f7526b1b855c1ee4fc6f01fa416b76caaa0e3e7b299f6c7cdc265f7a351e6c2fb6c96ff9aa4826ef46dbf72a529cc0cb0cd040f23d3fdf84591f404a8121e8f19a95d3c8f0a8e5262c997f03d72425f828952cb2cf475379978aedba391706984d3f73f61f5979190c5fbd2fdeaa684053f59e3041077bae1ee91ad1ab6f3170bb447ea9593907417a7423a4d2a05167e3d4e6d94af5c30ad41bcd7fc3ab5eb1d2eaca054c766a13d19606ec94cf2106ba51effe4ffb180da2d7e116e16b9c8e3921a69310b5fec1160aafb4620237e3c1b1e3819a8452ca64c716370f625e5f292035e0fef443d1487c949707e64c9c315dacac994b8ae8793b5f39df7d11dd39d68c035f926d5c17e6e39d97a2327f4d67aacb635ca9a902db7c6754ab4d1cff27c1df3f1b32ac29551d6280386acd95926cbeae406c2feaaaf6a47e876d733f0350e5b02ab4b5854395f30fd83ccb7cac2afffa61d00bfdd775c2f520d60e490f5412ef6b83929c706ece29ad8fa2785de6c5113a1d25a472fbd2e8003b4d4856b9d8944780281eaa3c9a5af7db47cb1be98a082fdbef8c2bbae3d9b188ce6ad4ef55a784c1e1cad72c05dc2b75afda2fe318abf58e0ac3afdf0d80ed7daceb2d9926b7710f7f5292ad36a5516564ec3a87f539f377dea3c4ce5d64e6da827a2e098ddcd4dbd4dbba101cf75c1da0ae2592828c4d0658cb39cac3b1399bf77cd5fa48a8cc3271c4ebadbad6dc33144fd085e27448560d2eeb24f28b8171d8b70034759985aa4f10ddf8130fc9d6d08571b0f962eac1a4dc78aa03e9d7b02fbb3a1cf948b2bbbb884e1b7ff077fc7612e124b1aace583ca0a743b9d38818341ee8c8b05c1845cd7afed2b72e6bea811c878b7db25be760b8fbeba4ed96dd466be857910d382a63009c9c4d6fa9cb481e8948f61773cbda485ef4bdbb42e975dc9ee3da32ee5508890b2e9208fea9b1649687bf9cfbfe586cb892651ce3c4c3ee4e250272240f9b6a80dfbeb8e92dd1a2895edb2d331f2d696d6459a5d6c121a86be4e02e4134f153c768a1feb54ebd5760075383a0dfaff0a839d3c8560def8a792bdef8f660d8eed2255f92d33f56496cd34944c0dad449a5028f26726b6c36f664959873096d17dea087f5c26533899a82cffaec4f0f16261408766e29fff1bb51aeeea6bb0a20700fb1ea3574e28d67e7b645d39a35f6e888fbfc0255364d9fe48443182b70228445db5b0607659bc9b32b0c05c248a9f76626627b88e9a8de67cb99e40810b5d65e6bdc576372d9d8a605d27967140ef6411bd5dc1c0b4c6e6ef921cc28501dde510495f80e6622079ede3c03f953e0ffcd24b2df0df2c1b8a9762a1f8d9ac9da87bc13ac863d20d513373d8f49b30e6553c8bef43676275b61f222ae5b3dd8a507bf50801e8d3c92f5ec0f0a30c11d0eab42528784b89147b5afd84581a9871cae15ff3e05e81f6d91d7d487012388cee0a64c107f2b84e3938aba53402c67f6dca7e08cd757a6bdeb9d890f52ad31e63b046dcf45df6193285fa4d6c12bc927430c64930ed725843ddefcf4fe8744eb34c1eb862df1b788b08f8377455f20a4a35ed72f16a506d28259cd9a25595c4776d05dcddebf65d03e4db1b754d225a10b75ef384b0d5a58d7c9b55a88e5885fda47438d871fadf5d1efb88d35f06229763292d2532fec712019c77908c9f86197258cae2c2d4eeab7faf681d17352b2b6fb909d60297a4c365bd2117f4696b47f7452f0f2f2257767207067f34a50abb2c3718a3d550070527965ee88a49ccc63c3023af6fa2c206d28db6512bacd4ba0b440fc38e84e190651abd79eed621982caf9c301f436447003fce4226ba4678c99907ae221b5e2bfc0beda81aa9acc4f817ea2ad80c28b9d19debe01a57599883ab9bb8c9c3f69e7acff8385b1d402fa0c6272839950516336d55dcded5a6a4bc6942bdd775e8bd1f4505d4b8e052233c9d1439c4c9b6b681acdd7073d37fcce6c93c200685ae8a0393901c66bf93aaa81e319383dc9ac07c66f7165a9559811c47db76f158694ac16c353c32cd8ea247234e808a1ced1f56331f3e92b4d3d3cf32c9413c8f60216c400b9ca7a6bb8d8187718860807e117cf40db21351df4205bcbb663cccacc7d399ad87b014191c6889f8e9589c36e6973468e3ea582eed0f9bb11a01802cafea92cd4b8f2b99b7053934deef9a1f78f3071387167c8e9d59677800021c9497cae93459830d1f8304b8dc6f1097d17d4e16e1a18594fa18ba0029c30ea12b878ad230f801eb321dbdac13d741ee3f518c0f1812d0cce8218f94a685ba207e22838bdd78156bb3a1197d71456615af1168c48918ab285e1ca1455a89a420a8608f22a1f85382473003b3bd9a162fb8247440ffa2c8f923d460f15f2f05ec1068b03ba6df8a9948a59fc4baaa9279d37242f8d08b2e3d07c49fca24b8d0f74512ac2fd574c4572c40e99c00a537999354fc77c558bef1c762ec851c226e161dfaacc2ac9c0aa95f73c63e853d511c29cbb36c7cfc8de2ab8c3595af3be82fae38831ec4e5737071a135da7e83fef02b9c5f52bfe480aa46f9600f0f3776946d7536241f17f081c475d28876a722599316aed158690e8db83bba1d5ca1cf17acf9139d0f6beb426b3658edaf9975c0a7fe1531236c94d6a54d51cd6fa26c237e947c3978f6f8f26514d11bc4b5c91e778e6241ce04225be48d4a112b9360c4319b1d467c93b247fd56349b703285dcda8a0e7b02bc5fad2acaeb9f7c875e1cbe22e47c895ac00918d49a982998c41af243c6060885b5313df50ee27282107b36f2b748dd997b70604451a3f3e98297bdc6bf899059584424030a25cc172ad623a6f88c842c0852ac7f712e18a00ef8e68a51a3d8f721642a6bcb91b58685ca56eb37f898afba1c94f2af84163948d53f047ba25d679a575430d3ff2bbb135f1187ec5aef578b3c37d880e1877fc7f4a5da6933e63269cfd3ca329deea363df1176b04c59187d27aa10c5a306a54df60e342d7c80f9c41a2f7ac209f7b11992709290d27cb2882e8daa7686ac5f3c7b9c71ab8fc09f63779fce8c491bc6d26db6426796ab410141dee93616803c2b32317fb20ee7f238bc60b7566e6e7ed3b164555c4f6304a781bae866ff76be659d7e4a21fc8f5a27b83a9869411dd3b9424d85cfa38e1df168d247727027e897cf8c9fb7406178c1d99d1199bc3da81a2b083ce96171e3db9f8427c6c7bfe246e30a97e7f83f5d253c270d60d05d2e9c1f6196c6088363907a09ca30764c57f0593ca9e41883c6ecc1d124bcd44cf7308de7eb24511721ceb6a83ddce4a46354b6b40e0fa1b3ae49529f145dad13f585d5ff52ad05dff0dbc9439a08c7db4fbf8daad4d33d48e70b28a3efb674eeeec4ec3e8152f261f46a35bb6545409de6a1453ecff540b70d6cdf27fda985be12e3a9f0d2a5ba97c11137fd7246f2f04e2075745513c00fb9cec98d88f692c84f53c83b551cb17ad34493e2b99505f7e44f8bbf79968fabf7eb4ccf0ca5d6a1e2e1e421ea739af3785c9ccd1bb43df6d6f230c0afd78da7b079d5f61c68ae0398acd95aa9e633e413c0bf2fc1bd09eec374e4b516a7fc2dc190f65a6fc7434f0e0f0505ff0471530f564e00c1a59a6911499e5327acce9e3894de7f18acb3086cc3374bf3f2b1b1ff475d0632d8b0bddf9eee549764c4aa6f65e2c9a263990bdf39785dbc9a83cdbc00e5c21032765d12ee7c604106860d0164f6250f3bce5e510a1678d2dd6bdd0303901b5373dcae27b403f0ba33a069fc5bbe769f6460fba145b2dd1b2ae498423994a7b8df30f5861799746a168bed0190f4f230103596542d41ec34a16ce88ce178ea433bfd380645520c68c19dab4efd640ea4c39cc70186b02e405c1342342668f745935235ee6e8e55cd6a442a56fffc5b4964d004d944a873384672deb8f258bf2c32e8ea3edaee591cb8de261cc0216686201b88b284d94a01561b00c5535beec16f3df1b49b7d4f37eb93cb8ab790e67a02b36e2263971412db2aec8fa17725f198d49ba02c5fc70334543a73c8d47e9fef1658c80a972b4e08d6b8860efa1a807a137b52b2441035a4d9d0f2f837f332e08fa4e9224003265989f9ad8b7eb0658578165eba46b05cfb5132c9d4d4c4d827b0c3eeb59bef250b5ac228b2f3fc538418d4505809c0dcbcde92d194d8a8f555e3267b5c06ec217fe67cb8cad48f0b07eb7555e1c826bf61fa53e3a5955890b82aec0cf273e36f6b33921574b8d953f551836856b57013810310af035e5690cb517519885f50fb8802054b8efd6e923c552e254ec90d96f8563cad727fd1b5bf0b283e07064365ce23a17ab0a2eb0b9c17ffc84e3442e0910212ec12126884a80120e398cd57b2d2ef0c281784ac9ab8099a60532446eba072db666597938eaf9c7d487986f9bd372867fb32f8a62ba9ddd9cdbcbfbdc34a26a8598c5959d1c3b9218a57c83324a707d937310909a8cd59a0ee778577bff4f7c29e7c0a876d188de4e986064ab30ead407a26db179d88e58062cd1a2343f9b5ca381b8ca65fec9fe81dc8a5c65b608a9a93c766f8eb7bb2f614e7bc57e2b77ce7d1beffd3cac9564c8f6c5aaaf42b4f0d5773c0e8cc6d66429000e32e270fc52fedd3fb483dc4e102d92b23d09b0819555a33ab0725d1b0d78ca2fcc9677775139630812d7ec7d2a94b773afdbf03d0d31e165cb31db2f7016d90037f050379729eeecf57be98532976886c849ef3d34639450957fbd6ddef8f61ee9ac1f70d35fc1462de017acce2ef08d66c8d6e7f2bcdbf14c3d66789cb4836d293a28b6d35382ca97ec63732905ea706b103ee4afbfba56b2ab91fc56dccf796f02eb8728290d817831c5c3b7c04859b9842eae177740591fc1041a43e11394d198f073921195e957b06a3d1ad8b09f8583c2aa23bc922260d107367e29a51d8eb7b35417d82dbcaa9e96b10ac2864fae2a17ca11a63407f555932efa4f6c62ca796456e08d23c4899107d3145082be0083971d1fde2d1c04edc4699416ae2fbf09d799afafa32eca06d18f83c23839f2e395df43dee6acf9c256a4d389b039dfa5fb957c488a36efd6b389f0403d18372da48a58ef747b8134d102bcb703bf87015a204724997abaa234d5bf767deb2ea22d40c48c4e982f51a5698f231a8166d54e3ab1cae3d90da82d18fb7c25e7a4861d63cd7f5db17a50aee370ade92f9e74215f1370e1e1dffc2ca30a8f69a5f59d30db4aa9a2574b24b25f69bcf38cc8748c5b647ed1ba9109bbcbefca798230a40a77f345411f4b124d48daf5a3ab7bb9252c30bb8228bf7d0c994e23a62850d92730e88be9bd56367331c0f23addcbae7a93f3f966dd7ec6dd727c92b0d00efb64395e83fbd43e621f60da412225f33f1ef3c1a096f78203b6c3ea70a00a9576118043ec2612bc81c201f1d23efdb71d5a635c5ecde3e8a557ba6cc94e5ae92259eb6af48499c3b6ac18b2f04f70faa829f788352e29ff5e83e12f4f6a40c93783f076eb5f49ed17bd414d8aa64982a6197f79289561701ccfd0fd4696c95d56135b6b9230af0ae9d89e2ed57d5cd7f4bdb48dbb6b532c64d6e07bd833b2798db156c3a7c177609d6a0a9b01ae5252150d043b0befcf3862d0808d5a4959559f5b7f183f6f1df7f882587f7237a3bd595bdeca750fd80caf86764ec5660fbcba9ed4eceb1234"}) r5 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) dup2(r5, r1) tkill(r2, 0x15) chdir(&(0x7f0000000200)='./file0\x00') [ 2510.208111] binder: send failed reply for transaction 3632 to 30676:30686 [ 2510.216870] binder: 30676:30686 ioctl c0306201 20000600 returned -14 13:48:28 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0x600}) 13:48:28 executing program 1: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-vsock\x00', 0x2, 0x0) clone(0x100002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) dup2(r2, r0) getsockopt$packet_int(r2, 0x107, 0x0, &(0x7f00000000c0), &(0x7f0000000100)=0x4) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1e2ba62e) recvfrom(r1, 0x0, 0x0, 0x0, 0x0, 0x0) recvfrom(r2, &(0x7f0000000180)=""/184, 0xfffffffffffffd84, 0x10100, 0x0, 0xfffffffffffffd51) 13:48:28 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) [ 2510.331268] binder: undelivered TRANSACTION_COMPLETE [ 2510.478187] binder_alloc: 30811: binder_alloc_buf, no vma [ 2510.484087] binder: 30811:30813 transaction failed 29189/-3, size 0-0 line 3035 [ 2510.501274] binder: send failed reply for transaction 3635 to 30811:30813 [ 2510.516737] binder: 30811:30813 ioctl c0306201 20000600 returned -14 [ 2510.599421] binder: undelivered TRANSACTION_COMPLETE 13:48:29 executing program 4: signalfd4(0xffffffffffffffff, &(0x7f0000000ff8), 0x8, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000340), 0x10000014c) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 13:48:29 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0x700}) 13:48:29 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0adc1f123c123f3188b070") r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) pread64(r1, 0x0, 0x0, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000000080)={0x0}) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r3}}, 0x0) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) dup2(r4, r1) tkill(r2, 0x15) 13:48:29 executing program 1: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-vsock\x00', 0x2, 0x0) clone(0x100002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) dup2(r2, r0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1e2ba62e) recvfrom(r1, 0x0, 0x25c, 0x0, 0x0, 0x0) recvfrom(r2, &(0x7f0000000180)=""/184, 0xfffffffffffffd84, 0x10100, 0x0, 0xfffffffffffffd51) 13:48:29 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:48:29 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='fdinfo/3\x00') getsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000000), &(0x7f0000000040)=0x4) r2 = add_key(&(0x7f0000000a40)='syzkaller\x00', &(0x7f0000000a80)={'syz', 0x3}, &(0x7f0000000ac0)="40f131729916d5cd4ab02ad56eb34c2902af69877f2d976af1590c72207f62c6210d5477762bb92f20d003bb74927b0af52d60546c62637b2cb9aea7f01ab8d9e85e9488dea24177a4bc704b635077b6b65587c106d869e480d2a1c0f48c75178a44cbc11c5c025f8f493b41c6af30032f1c61ba84c49978a06b797722fe7f0b98bc2fbc7edbd6a1f618fd9b25b77154e3d9a57d9b", 0x95, 0xfffffffffffffffa) keyctl$restrict_keyring(0x1d, r2, &(0x7f0000000b80)='big_key\x00', &(0x7f0000000bc0)='}}nodev/\x00') getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000140)={0x0, 0x0}, &(0x7f0000000180)=0xc) getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f00000001c0)={{{@in6=@mcast1, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@empty}, 0x0, @in=@multicast2}}, &(0x7f00000002c0)=0xe8) getresgid(&(0x7f0000000300), &(0x7f0000000340)=0x0, &(0x7f0000000380)) getgroups(0x6, &(0x7f00000003c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xee00, 0xffffffffffffffff, 0x0, 0xee01]) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f00000009c0)=@filter={'filter\x00', 0xe, 0x4, 0x588, [0x0, 0x20000400, 0x20000518, 0x200007c0], 0x0, &(0x7f0000000100), &(0x7f0000000400)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x1b, 0x4, 0xb44f4ae0303d38bc, 'veth1_to_bond\x00', 'bridge_slave_1\x00', 'veth1_to_team\x00', 'veth1_to_bond\x00', @empty, [0x0, 0xff, 0xff, 0x0, 0xff], @empty, [0xff, 0xff, 0xff, 0xff, 0x0, 0xff], 0xa0, 0xa0, 0xe8, [@connlabel={'connlabel\x00', 0x8, {{0x0, 0x1}}}]}}, @common=@ERROR={'ERROR\x00', 0x20, {"857fdd4947aaa5bc07c21768cdecbc04af8fe9f1318bc44e797a16d64217"}}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x2, [{{{0x15, 0x20, 0x0, 'veth1_to_hsr\x00', 'caif0\x00', 'rose0\x00', 'bcsf0\x00', @broadcast, [0xff, 0xff, 0xff, 0x0, 0x0, 0xff], @broadcast, [0x0, 0x0, 0xff, 0xff, 0xff], 0xe0, 0x110, 0x158, [@owner={'owner\x00', 0x18, {{r3, r4, r5, r6, 0x5, 0x4}}}, @cpu={'cpu\x00', 0x8, {{0x6}}}]}, [@common=@STANDARD={'\x00', 0x8, {0xfffffffffffffffb}}]}, @common=@RATEEST={'RATEEST\x00', 0x20, {{'syz0\x00', 0x100000000, 0x0, 0x7}}}}, {{{0x0, 0x0, 0x201, 'veth1_to_hsr\x00', 'syzkaller0\x00', 'nr0\x00', 'lo\x00', @dev={[], 0x21}, [0xff, 0xff, 0x0, 0xff, 0x0, 0xff], @local, [0x0, 0xff, 0xff, 0xff, 0xff], 0x70, 0xe8, 0x120}, [@common=@NFLOG={'NFLOG\x00', 0x50, {{0x80, 0x2, 0x0, 0x1, 0x0, "cf05bbdf28bf2c927912ea130fc5c77bc25b030aa4878aba260a9f36dfd130b044028fde561e3c45fc752da33790c07c886635f0a7b5691bbec1c187a7b685a1"}}}]}, @common=@mark={'mark\x00', 0x10, {{0xffffffd0, 0xffffffffffffffff}}}}]}, {0x0, '\x00', 0x3}, {0x0, '\x00', 0x3, 0xffffffffffffffff, 0x1, [{{{0x3, 0x4, 0x22eb, 'syzkaller1\x00', 'veth1_to_hsr\x00', 'bcsf0\x00', 'irlan0\x00', @remote, [0x0, 0x0, 0x0, 0xff, 0xff, 0xff], @empty, [0xff, 0x0, 0xff, 0xff, 0xff, 0xff], 0xb8, 0x118, 0x168, [@limit={'limit\x00', 0x20, {{0x7fffffff, 0x100000001, 0x5, 0xe7c, 0x401, 0x5}}}]}, [@common=@CONNSECMARK={'CONNSECMARK\x00', 0x8, {{0x2}}}, @common=@CLASSIFY={'CLASSIFY\x00', 0x8, {{0x8}}}]}, @common=@IDLETIMER={'IDLETIMER\x00', 0x28, {{0x3f, 'syz0\x00', 0xf4e7}}}}]}]}, 0x600) exit(0x0) ioctl$PPPIOCGNPMODE(r0, 0xc008744c, &(0x7f00000000c0)={0x2d, 0x3}) pread64(r1, 0x0, 0x0, 0x3) 13:48:29 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0xa00}) [ 2511.163912] binder_alloc: 30923: binder_alloc_buf, no vma [ 2511.177068] binder: 30923:30929 transaction failed 29189/-3, size 0-0 line 3035 [ 2511.197847] binder: send failed reply for transaction 3638 to 30923:30929 [ 2511.206482] binder: 30923:30929 ioctl c0306201 20000600 returned -14 13:48:29 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0xf1a}) 13:48:29 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) pread64(r1, 0x0, 0x0, 0x0) r2 = open(&(0x7f00000001c0)='./file0\x00', 0x8000, 0x9) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000300)=0x0) write$FUSE_LK(r2, &(0x7f0000000340)={0x28, 0x0, 0x4, {{0x2, 0x7, 0x0, r3}}}, 0x28) clock_gettime(0x0, &(0x7f0000000200)={0x0, 0x0}) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) write$evdev(r2, &(0x7f0000000280)=[{{0x77359400}, 0x11, 0x0, 0x7fffffff}, {{r4, r5/1000+10000}, 0x17, 0x68c300f}, {{0x77359400}, 0x17, 0x9, 0x5}, {{r6, r7/1000+30000}, 0x17, 0x3, 0x6}], 0x60) r8 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) r9 = openat$vimc0(0xffffffffffffff9c, &(0x7f0000000080)='/dev/video0\x00', 0x2, 0x0) ioctl$VIDIOC_G_MODULATOR(r9, 0xc0445636, &(0x7f0000000100)={0x7, "ed28cee76c0a9166c3397cd4510ad92c19d44d7839798db80e2acb8ac16935af", 0x0, 0xffffffff00000001, 0x101, 0x10, 0x1}) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}}, 0x0) r10 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) r11 = dup2(r10, r1) tkill(r8, 0x15) ioctl$SIOCAX25OPTRT(r11, 0x89e7, &(0x7f0000000180)={@null, @null, 0x2, 0x1718b758d2b3887c}) 13:48:29 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x48, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) [ 2511.285001] binder: undelivered TRANSACTION_COMPLETE 13:48:29 executing program 1: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-vsock\x00', 0x2, 0x0) clone(0x100002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) dup2(r1, r0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1e2ba62e) recvfrom(r1, 0x0, 0x0, 0x0, 0x0, 0x0) recvfrom(r2, &(0x7f0000000180)=""/184, 0xfffffffffffffd84, 0x10100, 0x0, 0xfffffffffffffd51) 13:48:29 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0x1a0f}) [ 2511.365869] binder_alloc: 31044: binder_alloc_buf, no vma [ 2511.394555] binder: 31044:31046 transaction failed 29189/-3, size 0-0 line 3035 [ 2511.424873] binder: send failed reply for transaction 3641 to 31044:31046 [ 2511.436325] binder: 31044:31046 ioctl c0306201 20000600 returned -14 [ 2511.525734] binder: undelivered TRANSACTION_COMPLETE 13:48:30 executing program 4: signalfd4(0xffffffffffffffff, &(0x7f0000000ff8), 0x8, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000340), 0x10000014c) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x6}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 13:48:30 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0x1f00}) 13:48:30 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x4c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:48:30 executing program 1: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-vsock\x00', 0x2, 0x0) clone(0x100002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$unix(r1, &(0x7f0000000340)={&(0x7f0000000240)=@abs={0x1, 0x0, 0x4e21}, 0x6e, &(0x7f0000000300)=[{&(0x7f00000003c0)="258c4bb373cf6e9d15fe74bb20fd0c207c058a2c8c97aaba9750efdb3f0f53e7921fb433724048ae1dd4b18e8bda6eae02cd1032ba5e8e98ed34f8a31e780c39efba92f1172a348d95f7a81ff3136f706fee54d261a23e2d9ad88a2929c497be64961ef66c08178cc64aa3015ff508f1daa9463023890416150d5649aa696c9a7f3bdb0747663ec0e7b27e802092d7ae7707dc9d0686029c5ae75ef2b9440b4dd6a20f861fee3ef04e7677d9974719bf1507a676642a6d49ac1300458a1b405f96d40ed9ad988753cf8b08bb7a6dd54f92cf5e7d36bfb65468c300c5faaf7217a42b72", 0xe3}, {&(0x7f0000000140)="adaaef88", 0x4}, {&(0x7f00000004c0)="fc135a27d25b284ed2d0aac6336ed9d6fcb098627cdf65988d05afdf7bf489be34e3b752ae75d52f90de2ba2bc64731398b510843ba31e055197b7cdc6e2df12c746f774ef923fb95e3a3aef0c33b5b61e3e4e0995288a0b2fa1df99068f6475d5e91f731e15e65d2b407ee84f8afe3dfb2e2037a1ea5aa212b09fb85f8baafd95d6ca0cc4588b4a6f0530d19afa19a0f47a28d9a1cba63d468463950f0861510cc1856391ff5ab9cb2cdd84a7276131f21e6057f9e65c1731997d526918f7286a9112", 0xc3}, {&(0x7f00000002c0)="d960b7abfaf130ee33a54bc83f45acf8f18efd88eb841a95f0a5c7735b442b3a3c9392a280f31f4c970b04", 0x2b}], 0x4, 0x0, 0x0, 0x4000000}, 0x4000000) r3 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r4 = syz_open_dev$cec(&(0x7f00000005c0)='/dev/cec#\x00', 0x0, 0x2) ioctl$TIOCGLCKTRMIOS(r4, 0x5456, &(0x7f0000000600)={0x400, 0xfffffffffffff4ed, 0x9, 0x40, 0x8, 0xfff, 0x7, 0x4, 0x8, 0x6b, 0x7ff, 0x1f}) r5 = dup2(r2, r0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1e2ba62e) recvfrom(r1, 0x0, 0x0, 0x0, 0x0, 0x0) recvfrom(r2, &(0x7f0000000180)=""/184, 0xfffffffffffffd84, 0x10100, 0x0, 0xfffffffffffffd51) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000100)={r5, 0x2, 0x1, 0x6, &(0x7f00000000c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x7}, 0x20) r6 = socket$isdn_base(0x22, 0x3, 0x0) r7 = getpgid(0x0) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f00000008c0)={{{@in=@initdev, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in=@dev}}, &(0x7f00000009c0)=0xe8) r9 = getegid() ioctl$VHOST_SET_LOG_FD(r6, 0x4004af07, &(0x7f0000000d00)=r4) ioctl$sock_FIOGETOWN(r2, 0x8903, &(0x7f0000000a00)=0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(r4, 0x29, 0x22, &(0x7f0000000a40)={{{@in=@multicast1, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6}, 0x0, @in=@local}}, &(0x7f0000000b40)=0xe8) getgroups(0xa, &(0x7f0000000b80)=[0xee01, 0x0, 0xee01, 0xffffffffffffffff, 0xffffffffffffffff, 0xee01, 0xee01, 0xffffffffffffffff, 0xee00, 0x0]) sendmsg$unix(r5, &(0x7f0000000cc0)={&(0x7f0000000640)=@abs={0x0, 0x0, 0x4e24}, 0x6e, &(0x7f0000000880)=[{&(0x7f00000006c0)="00174da20daae7b90fabbed288b5cbc8567c5d0aaafc4a1baa26c1ce77f14dcc47efa73bcaba507d68e9c0f7cacb931d2305832985f40fa27cf6ead48604ccdf72988db226da5d45b03ff5821785ee59c2d42dc71b74a0628e4eabcc48fe565f3356dc9342bbbf28f6a9a12797e17744714594324e28ad3ca2e88bdc1c7a93149ef9db643f591261f396203282a3d152893372a06c2ae2b24017ceaaf4373eb696e86dcc6f07ab65f1b49c0599e65bbda8bc39", 0xb3}, {&(0x7f0000000780)="e808156dbc494c76745e6d7e49fecc8e00c06ad27b033d7802891559fdacca7b2dc903dc6a200f3b8ba87ef9b59022cd5f5d251fc85f155f38ffd6366a49cc01d95d57956b01c929c347a4cab5a3e29cd79df422e34e3416cc0b937c0bd761418d9f0bbd2194011894f76b13e1d01d42b15b9fe6cae0d4c98804990ed1874e920048f2587cffb12905cd0c303838dfa3335dac121f75e0b5a6ab787828f227fbc47db9cf55dbdf42c66d41115e2c0416a2c19a3038056f5aaef51793e18790d8928a34ba012c7206e6a8160c3faed242a3d61644b4321963fff7a9ae013cb64c1a97c484967bec4ecfaed7315ad4d15e4842", 0xf2}], 0x2, &(0x7f0000000bc0)=ANY=[@ANYBLOB="30000000000000000100000001000000", @ANYRES32=r3, @ANYRES32=r6, @ANYRES32=r2, @ANYRES32=r1, @ANYRES32=r3, @ANYRES32=r1, @ANYRES32=r1, @ANYRES32=r2, @ANYBLOB="280000000000000001000096cb000000", @ANYRES32=r0, @ANYRES32=r4, @ANYRES32=r0, @ANYRES32=r1, @ANYRES32=r2, @ANYRES32=r0, @ANYBLOB="20000000000000000100000002000000", @ANYRES32=r7, @ANYRES32=r8, @ANYRES32=r9, @ANYBLOB="0000000020000000000000000100000001000000", @ANYRES32=r0, @ANYRES32=r1, @ANYRES32=r2, @ANYRES32=r4, @ANYBLOB="20000000000000000100000002000000", @ANYRES32=r10, @ANYRES32=r11, @ANYRES32=r12, @ANYBLOB="0000000028000000000000000100000001000000", @ANYRES32=r4, @ANYRES32=r1, @ANYRES32=r3, @ANYRES32=r3, @ANYRES32=r5, @ANYBLOB='\x00\x00\x00\x00'], 0xe0, 0x40080}, 0x4800) 13:48:30 executing program 2: socket$netlink(0x10, 0x3, 0x0) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='fdinfo/3\x00') exit(0x0) pread64(r0, 0x0, 0x0, 0x3) getsockopt$netrom_NETROM_N2(r0, 0x103, 0x3, &(0x7f0000000000)=0x1, &(0x7f0000000040)=0x4) write$binfmt_aout(r0, &(0x7f00000000c0)={{0x108, 0x8001, 0x996, 0x309, 0x29a, 0xffffffff7fffffff, 0xb7, 0x9}, "e7322e0d5a685551cc8cd1c7af743f9b19e56ead91911be5b61a4781fdc8b7a0a0ac5b1a7bb8a4b7cfcdc347c0730ebe84a1be573fff3e9a23b72f1f8d5fdc605db5414f00c47f5ab11c07777bb126b7b1326eb54a666bd67ab9273f511e2fa076e3e700d3f1ec79aa484d631bf8961a9f15fef2cbbc92e230bffa7f43568e86216c615e30b267d00960e801de57ee27"}, 0xb0) 13:48:30 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0x2000}) [ 2512.163909] binder_alloc: 31158: binder_alloc_buf, no vma [ 2512.180354] binder: 31158:31165 transaction failed 29189/-3, size 0-0 line 3035 [ 2512.190272] binder: send failed reply for transaction 3644 to 31158:31165 [ 2512.197391] binder: 31158:31165 ioctl c0306201 20000600 returned -14 13:48:30 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x60, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) [ 2512.247486] binder: undelivered TRANSACTION_COMPLETE 13:48:30 executing program 1: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-vsock\x00', 0x2, 0x0) clone(0x100002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) dup2(r2, r0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1e2ba62e) recvfrom(r1, 0x0, 0x0, 0x0, 0x0, 0x0) recvfrom(r2, &(0x7f0000000180)=""/184, 0xfffffffffffffd84, 0x10100, 0x0, 0xfffffffffffffd51) [ 2512.348198] binder: 31275:31276 ioctl c0306201 20000600 returned -14 13:48:32 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) r1 = syz_open_dev$swradio(&(0x7f00000000c0)='/dev/swradio#\x00', 0xffffffffffffffff, 0x2) ioctl$VIDIOC_CREATE_BUFS(r1, 0xc100565c, &(0x7f0000000280)={0x0, 0x1, 0x1, {0xb, @pix={0x0, 0x1f}}}) read(r1, &(0x7f0000000000)=""/151, 0x97) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000140)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x13f, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_ACCEPT(r1, &(0x7f0000000480)={0x8, 0x120, 0xfa00, {0x0, {0x1, 0xb3, "d436cd87b28798e813a05b20141fc52bd6aa12c0981342827ab6877be2bb2b44bc347b812e6ca8086998c7445684288f8cd632d725b92edde75cb373084cd22c364b0adf97e103bf62f336c425e4d9a60f92d7d6bfb327636f830effcffb26ea143cf0afc9a53b70390642fe45a07aab23669ec23f53520131d0e78f4ae5c97b53efff9b0ecf57e96d923633dc5906442d8e9b0b8f85a13115a7c15f52b7e9cc85bb552109bd303deab3c46f6d007ff9e5dc12b2cd432370cfb0825140d94b651f68ec483f4095ecf116ffa3ce0610664fd4ee3898a7f5a9e41a6a38d3a7c2a31c1c014d76fb0af2b8e6f8346d0fb8f80d676c3841df0b3c1339842fd2c929c8", 0x14, 0x180, 0x7fff, 0x834, 0x1ff, 0x0, 0x7, 0x1}, r2}}, 0x128) r3 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) pread64(r0, 0x0, 0xfeaa, 0x5) r4 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000001100)={0x0}) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r5}}, 0x0) r6 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) dup2(r6, r3) tkill(r4, 0x15) 13:48:32 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0x3f00}) 13:48:32 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x68, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:48:32 executing program 1: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-vsock\x00', 0x2, 0x0) clone(0x100002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$UHID_SET_REPORT_REPLY(0xffffffffffffffff, &(0x7f00000003c0)={0xe, 0x1, 0x9, 0x4, 0x1000, "93b5f5f5f226c88f5b6722a4b6efd511bf9a8185548ababf529be10e762425207fdba1da2586aa33a7d7a0623afa947a06001d18ac2f74c82e7e3d58adda5ad8b76305daa88621ef3bccf371f3fd3197945ca5b57817cea6d7f6feaec461c75ecd1dc1e9c4798fa384a329866efd3ee3d925ae1957c3ce9dfcb795ab66cb791e74388229fb44e3e4bf0847fc23ce9d7c772aaec0904a0ca3f626a27530cb70394bdaaad234b13cd37980c0c004b5461d3d42294952f1f463f5fed33039e5d21567d63e9133ec75f8f0dd91bbeab7298923da914a9a2c96e6efc748e9a3e131fd8ceb335c07c9bb75a1d70e9c98f36d251db33e374968b7bc7d3d85ab10daf1dd3c39760ba0c40cb8e52963074d5bfaa3a0ad4dba7a89a2b4de2a16f9d511c3a67008dd8bbf52b47ce52357ea0e788a19fa189989fc05fb0f84392d4e3be5678633c0286bda12dd4c122ddf20e0c214fe6cb9bf0a6fb53eb7bf565070a69892e966d99961c543322ad14f83b60774d9f899b68eab8f5e3a0b863e21ebcf7b1257f8db642144d47ad87de7e5260773f4dd63e40d8d47ad07ad4e1ba24781f0e8cc582ac55a6e27e776fa25f14eac6ccb2e9c0f7f5b01c1d6a7fd28b753b51b8c926eff04811526c4e8b1fc9be80775be32fa9daf9f26e294b1345984548106edc598d8aebac23c0a2892fae43288bfea594cbe391bb80679b231c7cdf35c679faf0673adb32cfc34afc1a1463345469e94bf2159430bb9fe439e289bf33fae8311b7317824758136a38f85bc98fece860c1831df6e41c598dd956a286acfa3bcabcefca7ff14467c52ed1a3dc99146dffd25281d3845789407b871cc39dece16a7b461aeb23137459a1fe1fa075f7baa5184e85eedeb800285c6b25dfadb2c9459d43a90b3313991e2e326a15ce663f6195815f31151b89da856ba3f9300624bab4168beb514689d437a428d9645b2887d29fde03d713ccebe6cf8d4b5b074ca984b5df844d590655b4b26af2651f4fe66b81c195c44e3c4c19f47a702b38194336a7dc6abe40ac654b97c55a8231e8265ef47983f05cee0014f357014fdf8f83533f6906dccf5d9f232f288d2a9a284ddf130bc00a4215f29ae94d27f19175c066afdb38c3081b2ee2030e385ab6838a7ec487c12510b68266bd76f607a2fcb12f84c8ee738fc3b3ab5a407c05e3dc8d95e0c33f168cb03f98f73c64da383241b369c34befc51317a301c791994d972b655011c283cd4ec23c535dbd01823221b5961741d40a0fce7a91d9c6c7265458e716dc48db92d49161c1175dc424de929da8081cd232f05b0d635db20551461b76401722e6b52205c99cab2332fd79bee57c35fa681a4679f0ef0afdb29896c644ed90887a2109ceb9a6c127ea2644cf6411d3e5e31bfbb41a8856eaf75a75ef718780b0e58ecb7156f5bc3d7980cebda8fb5a20767ec45da2740831c80c8279544b352922fa39dd71bea463eed3635f3ddf6b1d22769091126497ddaf5d74a56a31a9dd96fc532e747a485648b992ed17f9a033e4f5b34fa204f09f71f648817d0316746edb1ae6c0283976327fdeccf4d0cc05fed9c7bc49bd5a60b934217e33c90e04078fa94cfa2cb10b8c818ea29e7cd2591a973787ba982ced99e9f2f3a4d39d0b5e3d97e9252d1886c102e10138b186dd8d3357f363059da0623214b0f52f7b8c746b836bd21a36fb9ee6bbb151912b4a466b1ec403e94d212afda281fd6b5b14b2683292d526cea8a07bde2419fdf8d3ac133f27f123bc9f8e2987da40c352e8f16ce6812fce8186e11c052a05fd72e1f77f62f3157fdf20889218a15d870f3144335abb2d3fbf534914b6172f23df7272395ffe8fdca109832ec9cee0ff752f5b6eb2aa859cd4b305b890bb5d46ac582e33619ec639d4da9830efe1e1818d9080d2f5c832f906307f01799bc0e619f343cc7a4e15f8a554006acdbdeff0a0c64814dc629596e55bf23ef4882e1ef1c10c12ae9b5ff8651bb2100c0d67263e0779d1199e35318e248096ab12786db2008b11e1334365a91e6a9d9086f20be0ad5a4d72f0fa9f6a67d89473c82ab86b6b418773366da9abd049261211016353bf07852d4b1751a64ea35d1f582814ad3f1eb226bd34beed95cf04d4c53ae646c46680b490e9187170b45ccc257248d0351be1b7e3e48d7086e837377b7a1d20599719752c8fc0a3021e0250fe1d8381674b8aad5b9a382d61fbdfdafb04cfbc59938bf8199550f49b3fc7ee2dd0b4e5584b4722dd32dc77cc0d8ba80232edf781e6e9b4b89482775e6b56fe98ed3bb1f40f5530983c3b3ade4d017acde6f61f3cfd7d99ebfcba5c842763b9fb9d4b0dc34ce8a5eec72d6484b976e46ec9c7fc98bd6f411315a84ebdc544fd2407176a22fd2d10cb9325c1002ad91818259ee220db9608b15b7cdbeb9e496a8557be11ef7721f9bcbe5500239bfa12b79128bc62eafad47d631ea52851c7d8a09de3cc7e563f0cd7e3343f40389640c42bb5100b6ca6ab5bea4d35be98b0061d76c1c3c407ce7427a676b8e3b2c91dc144fdd554a0af4d99fe2b791f7d93f8891c956776b4a5ed7915cce1ce0fb0945e69689833cf7e2d828268d0ddedda03e4f8fd93687cd2b3f93d41f082c4b7a23ef1339dd6c521c852abc46368e812b5be0fb5cfeef149dcda3863a30fe073f84c1fec7cf6376a005dc7fb9e73e2f318a9f1c66881664d7c29c8adc3efa2f1229afb027a69320f932b8b9be07a3d4a2241a566201adc2efe175cfa72e6eeb536deb584a7faf5f2f543b4a9664011a474e90e4f9225ed55d41ea9f0c0ec465c075a85f88459f443848f5393a0f262908230c692e9c88589863465c82a67386dc54fd6dbfb364f6fdd42096168cfd6d3b8c931edc59b1d4dd9eeb1836ba04c29470829676f1e117acf6ec710ee918826913879b05926ec13d5ab4399fbb2458fb509fc60546efbd1f104dacc0b951b1f18bc6316a7b6f5e63b52316ffeafd2b29f4edb3fb209e921739d01aec2a4df80dd1487d168b9c88d05bcd01c4b4b901f9e2fcb200f670876765c9adb75c102416215cf9143b870e4c5aa85f55d8a53cdfe2d69be100c1d5e57018acd48f3a7911f035fd06ab5b054dcc5f7f367fdf5e55c652face806f480d78299c448de3ded4e141a6788b740269b318eff87a3419c725bdf1d7c9fa38731d0d90674f8400057949593cbc1329a325bbcb8186a6946ff4bf8b33ba727d6acabdcb475ffbc3581cc5730fef863503b7067da7183a8fefbee68140e913115ff356b9d7ef9f9b6be9eb63b46e6400b377dc3c7347a9b9ade325136133411c09138c9f8c25d8a1e3052edb8deaaae08b9e4491a0c442b6bd334718312045d914215af771e876fe8c016009f03b9d86d491a13ca82757dfd4222025d260969062703e8592bc8ef8898aac52296c41cf5ef9c298c997571969fdb7e67d50336ae67480366c34b5457b2e71b0d168cdec15794437b400dbb49c01036edb73fd778a7888a6b5c4010ab935c1aff9bd940c15b1ff63cd4394236296e00875db0215084532d1d736aa66a36642247aed2dd1fa10a8e9ce627e972ab42a71ffcfdc0d5c5bdf7ad2255b49b98a4a218de07d625ee09965f9b64a4e31447510f3bf4eb58a3f019de2a83281dd7fa2e0a49ebf71534a9263c79b555f10134973a954b29c49a8b0174b9971b2ddba4d54b0ea8cda7f50700e4500acb5f6e172ee8ff2e1a7b4ac355b1e9d317e4351512371e3f52378ff3a90b176ab0a6e0e97d7fbd152497dc002b026c1aac0f25cbd25b74022d3eb17aadd40b6158a482851b199192a61e0aca583521b4949a52f2e2161ecaf961f0a8b80206a5fdf3969e16cd170fbe426e693316102f8e886e47e1afa77fcced358794d5a6fc5faecb6e8c2a56a44fc72de5fb6bfdd67ab44bf90f444fdea4e70b0a588aa7c738a487a0223243bc3134213bc7c7909dc90875fb2301c5ad52ad9bcdb15f9b284b00f0b8518a2fc288bdb877ddef2dd941f3073eaee9b67c2b769a32ef91817c2f9a79b7179a99ed6338f60dbfab34c9c5ad85a6c8630bd7e56c20574319df22ee0a69c46800f2367f7a53d1cb76d41c405d2bb5581dd1528e45ebb2adc73582c213c2ad2910d85f55516ceb9117f501216f45a724c455fd205c059fc76f8d07a57a418701f59f95c2be777b636031958f98f7704de9c43fab6ff253d454795d2077ced486042a7c6c3b87901fd689668ece09a73d2a86ef6cf76c8223c58b9e1cd0aa70a517a90085e3e11dd0c0ae8674f849909122fe639a3f53477284d17f7d0a9fca60d457767d0c3f0e712bc60c2eeb8ba2ad48cf227d88d874a717c54be79928bce8da31ad260a2626291d9fabc3de6d1ba7ed637093d3cdaeb4a218701f6b5107b60ca9d7dcafd9b750530c37d6560e9bfeb67d770d143374aa95d32e3c60e02cb6c560dcadab2a17f4757f83ce76bf1bed3608c85c6d73ea2166db88ff54948cb48412ccbb22360590c85a6d90aa0de0a7630cdf6489fa93280add5af232a3ece1ba0f8fc1cae7070481069825712f16c2109e5d4db7c5785fc37afce4eda016593d07debaf6334805be379131558ce11b94337cb3fc3f209b27414a1d7fb78726ea3fbb87390797849fd0379d429c8cdc2919d64f376e8ef1ec31f72b078d54ba32b59471a4f9bb7c94497609d00d71e07faf40d86db4e70077c1c3ffc589a27fb4488d74dbf20b8ac73743c445e11a5c8049fe9a6b81cb0bd009ef5a9f4cf9360e81b337c1c9b90ab28883346b64505c05db4eced7ba3231f82a44dc6e0620de4262aebb2e400b3c3b33ac36a25c033e8c62b37a4978db679f9dba94bf3f00961d08817604e541d95f302d7c068333666b003e43456525a712347a080a51157b315060085a97aa4e5cd492f887d97c4fed81f4fbf2122a20d3b3f4928f458717b4471dc7918980ff33dfbb4a009308343a9f8614a6b8d10f4b30f9a4f3f2b601f3f388ce20e7c048903862b95316dc4b7ce760178cd8cef7019785a1eec9ae726bceec94c6b2c1ff2371b1802287cb4e7e72510473f8de0ff5e179edd8b483760afc1b8c500dc4cd99ee5082096cb6dcf6a3b584d15e15d1165554247ec68621f590dfe28b79528baa568ee7943fde1c24622be29b194c4dec32058dc425c534a37c485afde62b5e080449306810a369ad64e0378392e712f1771b355f5f34ed702998bda06f91f9074b6188f1dad6ee098dac6533b399e3e1cf5f88cd1e49400042dcee1cfcb588b34a1ad006a65fdbe8a86d843bcf3240117b00f3e8b48031a0ba2fa0160a169f9057726b419b32bd208ca38b4b8bbae7dabcdf0fde8d578c46f75ab85aac49a969b8d1a3b2e49a190ec35812c8b40fdb15fb3aa55d3ff8965b0cb92afe93dd5ffd99bd06d0f59bbf10c90c945a4f12956a10569f3038d108564d2d5737bc0e8c478722cf7ac9c027b987a007bb80a8fc1ee3fbc0399083a10cb22afe8c68d2b5a14df296b10b92bf3bdbd017410a6b3ebda1819664f8ea00c1c8e3d0ec5695e097524bd58b461644d3f454b60fe4f6a32fcc041eba1a8067b22ad9bc298f2dbe4a454b611669bbc5377ec3f43f6b7b6202f69600d5fb00e57fbcc57e2efcbe4c6c6503bafd2d7a4f1b4f01b4985f3ebda2f82688d63774923e97538bc4370b6d73bda1b34ffbe31ca464346918f171a62d4aec31aa42314fc5a1f2b8609d550a17f828e59311f3c28c753a902d70436bedd3b0ec04d86fdb797ecbb2aa72f25cafa8e3c27ec98fe"}, 0x100c) dup2(r2, r0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1e2ba62e) recvfrom(r2, &(0x7f0000000180)=""/184, 0xfffffffffffffd84, 0x10100, 0x0, 0xfffffffffffffd51) ioctl$UI_END_FF_UPLOAD(r2, 0x406855c9, &(0x7f00000000c0)={0x9, 0xa40, {0x52, 0x4, 0x7, {0xfff, 0xed2f}, {0xffffffff, 0x8}, @ramp={0x5, 0x64, {0x8, 0x9, 0x9, 0x14000000000000}}}, {0x57, 0x4, 0x2, {0x7, 0x4}, {0xf29, 0x5}, @cond=[{0x4a5906c4, 0x100000000, 0xac, 0x149, 0x4, 0x7}, {0x79d, 0x3, 0x200, 0xc2e, 0xfffffffffffffffe, 0xe4bb}]}}) 13:48:32 executing program 2: socket$netlink(0x10, 0x3, 0x0) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='fdinfo/3\x00') ioctl$KVM_GET_MSRS(r0, 0xc008ae88, &(0x7f00000001c0)={0x4, 0x0, [{}, {}, {}, {}]}) ioctl$DRM_IOCTL_SET_MASTER(r0, 0x641e) ioctl$VIDIOC_G_MODULATOR(r0, 0xc0445636, &(0x7f0000000240)={0x52, "acae3f1358199283956e4161d03eba78b847230784dd01b06d6d9337cc2c4e4a", 0x1bad4304177e88e, 0x0, 0x10001, 0x0, 0x5}) setsockopt$IP_VS_SO_SET_STARTDAEMON(r0, 0x0, 0x48b, &(0x7f0000000040)={0x0, 'veth1_to_bridge\x00', 0x2}, 0x18) exit(0x0) ioctl$FS_IOC_GETFSLABEL(r0, 0x81009431, &(0x7f00000000c0)) pread64(r0, 0x0, 0x0, 0x3) setsockopt$CAIFSO_REQ_PARAM(r0, 0x116, 0x80, &(0x7f0000000000)="3355232a98c4", 0x6) 13:48:32 executing program 4: signalfd4(0xffffffffffffffff, &(0x7f0000000ff8), 0x8, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000340), 0x10000014c) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) [ 2514.364902] binder_alloc_new_buf_locked: 1 callbacks suppressed [ 2514.364911] binder_alloc: 31384: binder_alloc_buf, no vma [ 2514.392690] binder_transaction: 1 callbacks suppressed [ 2514.392708] binder: 31384:31389 transaction failed 29189/-3, size 0-0 line 3035 13:48:32 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0x4800}) [ 2514.418217] binder_send_failed_reply: 1 callbacks suppressed [ 2514.418228] binder: send failed reply for transaction 3650 to 31384:31389 [ 2514.458066] binder: 31384:31389 ioctl c0306201 20000600 returned -14 13:48:32 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) pread64(r1, 0x0, 0x0, 0x0) r2 = gettid() r3 = syz_open_dev$mice(&(0x7f0000000080)='/dev/input/mice\x00', 0x0, 0x100) ioctl$VIDIOC_QUERYSTD(0xffffffffffffffff, 0x8008563f, &(0x7f0000000100)=0x0) ioctl$VIDIOC_S_STD(r3, 0x40085618, &(0x7f0000000140)=r4) timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000001100)={0x0}) gettid() timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r5}}, 0x0) r6 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) dup2(r6, r1) tkill(r2, 0x15) 13:48:32 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x6c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:48:32 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0x4c00}) [ 2514.538704] binder_release_work: 12 callbacks suppressed [ 2514.538712] binder: undelivered TRANSACTION_ERROR: 29190 [ 2514.568434] binder_release_work: 1 callbacks suppressed [ 2514.568440] binder: undelivered TRANSACTION_COMPLETE 13:48:32 executing program 1: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-vsock\x00', 0x2, 0x0) clone(0x100002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = syz_open_dev$dspn(&(0x7f00000000c0)='/dev/dsp#\x00', 0x1, 0x80a40) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_PREFER_SUBDEVICE(r3, 0x40045542, &(0x7f0000000100)=0x6b6b) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r3, 0x6, 0x1d, &(0x7f0000000140)={0x6, 0x68bf, 0x3, 0x1, 0x4}, 0x14) dup2(r2, r0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1e2ba62e) recvfrom(r1, 0x0, 0x0, 0x0, 0x0, 0x0) recvfrom(r2, &(0x7f0000000180)=""/184, 0xfffffffffffffd84, 0x10100, 0x0, 0xfffffffffffffd51) [ 2514.616585] binder: undelivered TRANSACTION_ERROR: 29189 13:48:32 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0x6000}) [ 2514.666479] binder_alloc: 31507: binder_alloc_buf, no vma [ 2514.691453] binder: 31507:31510 transaction failed 29189/-3, size 0-0 line 3035 [ 2514.708042] binder: send failed reply for transaction 3653 to 31507:31510 [ 2514.715092] binder: 31507:31510 ioctl c0306201 20000600 returned -14 13:48:32 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x74, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:48:32 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0x6800}) 13:48:32 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") pread64(0xffffffffffffffff, 0x0, 0x0, 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000001100)={0x0}) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r2}}, 0x0) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vcs\x00', 0xfffffffffffffffe, 0x0) ioctl$VIDIOC_SUBDEV_S_CROP(r3, 0xc038563c, &(0x7f00000000c0)={0x0, 0x0, {0xf8c6, 0x4, 0x448f, 0x72bb}}) dup2(r3, 0xffffffffffffffff) tkill(r1, 0x15) [ 2514.800284] binder: undelivered TRANSACTION_ERROR: 29190 [ 2514.806367] binder: undelivered TRANSACTION_COMPLETE [ 2514.823326] binder: undelivered TRANSACTION_ERROR: 29189 [ 2514.869367] binder_alloc: 31564: binder_alloc_buf, no vma [ 2514.882025] binder: 31564:31582 transaction failed 29189/-3, size 0-0 line 3035 [ 2514.905622] binder: send failed reply for transaction 3656 to 31564:31582 13:48:32 executing program 1: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-vsock\x00', 0x2, 0x0) clone(0x100002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = dup2(r2, r0) setsockopt$inet_mreq(r3, 0x0, 0x24, &(0x7f0000000280)={@loopback, @loopback}, 0x8) getsockopt$inet_sctp_SCTP_CONTEXT(r3, 0x84, 0x11, &(0x7f0000000300)={0x0, 0x8}, &(0x7f0000000340)=0x8) r5 = syz_open_dev$sndpcmc(&(0x7f00000003c0)='/dev/snd/pcmC#D#c\x00', 0x6, 0x400000) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r3, 0x84, 0x7b, &(0x7f0000000380)={r4, 0x7ff}, 0x8) keyctl$session_to_parent(0x12) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1e2ba62e) ioctl$DRM_IOCTL_GET_MAP(r3, 0xc0286404, &(0x7f0000000140)={&(0x7f0000fed000/0x13000)=nil, 0x16, 0x3, 0x4, &(0x7f0000ffa000/0x3000)=nil, 0x2851}) ioctl$FS_IOC_MEASURE_VERITY(r1, 0xc0046686, &(0x7f0000000240)=ANY=[@ANYBLOB="03019a000c001649d3087a1f4300"]) symlinkat(&(0x7f00000000c0)='./file0\x00', r3, &(0x7f0000000100)='./file0\x00') recvfrom(r1, 0x0, 0x0, 0x3, 0x0, 0x0) recvfrom(r2, &(0x7f0000000180)=""/184, 0xfffffffffffffd84, 0x10100, 0x0, 0xfffffffffffffd51) ioctl$sock_bt_hci(r5, 0xc00448f3, &(0x7f0000000400)="7f7d018cedaefcf521a698ee2db113c29c85ae85c51294d82c22cc3a59008b37ae9b76b47b3594325ff91775be688282195c41eb5c48715fcc4f10045bf4fba368a18f43c14cd5828ea861") [ 2514.930026] binder: 31564:31582 ioctl c0306201 20000600 returned -14 [ 2514.994094] binder: undelivered TRANSACTION_ERROR: 29190 [ 2515.007031] binder: undelivered TRANSACTION_COMPLETE [ 2515.026318] binder: undelivered TRANSACTION_ERROR: 29189 13:48:33 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) fcntl$getownex(r0, 0x10, &(0x7f0000000200)={0x0, 0x0}) r2 = syz_open_procfs(r1, &(0x7f0000000080)='fdinfo/3\x00') exit(0x0) pread64(r2, 0x0, 0x0, 0x3) readv(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/250, 0xfa}, {&(0x7f0000000000)=""/82, 0x52}], 0x2) 13:48:33 executing program 4: signalfd4(0xffffffffffffffff, &(0x7f0000000ff8), 0x8, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000340), 0x10000014c) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x8}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 13:48:33 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0x6c00}) 13:48:33 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x7a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:48:33 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) pread64(r1, 0x0, 0x0, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000001100)={0x0}) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r3}}, 0x0) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) r5 = semget$private(0x0, 0x3, 0x20) semctl$GETALL(r5, 0x0, 0xd, &(0x7f0000001140)=""/4096) dup2(r4, r1) syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x67e8, 0x400003) tkill(r2, 0x15) 13:48:33 executing program 1: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ubi_ctrl\x00', 0x101000, 0x0) setsockopt$inet6_tcp_TLS_RX(r0, 0x6, 0x2, &(0x7f0000000100), 0x4) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-vsock\x00', 0x2, 0x0) clone(0x100002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vga_arbiter\x00', 0x20100, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r1) write$binfmt_misc(r2, &(0x7f0000000140)=ANY=[], 0x1e2ba62e) recvfrom(r2, 0x0, 0x0, 0x0, 0x0, 0x0) recvfrom(r3, &(0x7f0000000180)=""/184, 0xfffffffffffffd84, 0x10100, 0x0, 0xfffffffffffffd51) [ 2515.342048] binder_alloc: 31738: binder_alloc_buf, no vma [ 2515.350086] binder: 31738:31745 transaction failed 29189/-3, size 0-0 line 3035 [ 2515.373986] binder: send failed reply for transaction 3659 to 31738:31745 13:48:33 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0x7400}) [ 2515.388099] binder: 31738:31745 ioctl c0306201 20000600 returned -14 13:48:33 executing program 5: r0 = syz_open_dev$vbi(&(0x7f0000000180)='/dev/vbi#\x00', 0x1, 0x2) setsockopt$netrom_NETROM_T4(r0, 0x103, 0x6, &(0x7f00000001c0)=0x8000, 0x4) r1 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r2 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) pread64(r2, 0x0, 0x0, 0x0) r3 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000001100)={0x0}) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r4}}, 0x0) r5 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vcs\x00', 0x200, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_STATUS(r5, 0xc05c5340, &(0x7f0000000100)={0x20, 0x0, 0x8, {0x0, 0x989680}, 0x6, 0x5}) dup2(r5, r2) tkill(r3, 0x26) tkill(r3, 0x15) 13:48:33 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x300, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) [ 2515.465003] binder: undelivered TRANSACTION_ERROR: 29190 [ 2515.471522] binder: undelivered TRANSACTION_COMPLETE [ 2515.483931] binder: undelivered TRANSACTION_ERROR: 29189 13:48:33 executing program 1: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-vsock\x00', 0x2, 0x0) clone(0x100002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) dup2(r2, r0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1e2ba62e) recvfrom(r1, 0x0, 0x0, 0x0, 0x0, 0x0) recvfrom(r2, &(0x7f0000000180)=""/184, 0xfffffffffffffd84, 0x10100, 0x0, 0xfffffffffffffd51) 13:48:33 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0x7a00}) [ 2515.560680] binder_alloc: 31859: binder_alloc_buf, no vma [ 2515.566300] binder: 31859:31860 transaction failed 29189/-3, size 0-0 line 3035 [ 2515.603814] binder: send failed reply for transaction 3662 to 31859:31860 [ 2515.631775] binder: 31859:31860 ioctl c0306201 20000600 returned -14 13:48:33 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) pread64(r1, 0x0, 0x0, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)=0x0) clock_gettime(0x0, &(0x7f0000001100)={0x0}) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(r3, 0x1, &(0x7f0000000100)={{0x0, 0x1c9c380}, {r5, r6+30000000}}, &(0x7f0000000140)) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r4}}, 0x0) r7 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) r8 = dup2(r7, r1) tkill(r2, 0x15) ioctl$KVM_SET_TSS_ADDR(r8, 0xae47, 0xd000) [ 2515.690878] binder: undelivered TRANSACTION_ERROR: 29190 [ 2515.697727] binder: undelivered TRANSACTION_COMPLETE [ 2515.731468] binder: undelivered TRANSACTION_ERROR: 29189 13:48:34 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='fdinfo/3\x00') exit(0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000080)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(twofish)\x00'}, 0x58) r3 = socket$inet_udplite(0x2, 0x2, 0x88) write$FUSE_NOTIFY_STORE(r1, &(0x7f0000000140)={0x2a, 0x4, 0x0, {0x1, 0x7fffffff, 0x2, 0x0, [0x0, 0x0]}}, 0x2a) ioctl(r3, 0x1000008912, &(0x7f00000000c0)="0adc1f123c123f3188b070") ioctl$KVM_CHECK_EXTENSION_VM(r1, 0xae03, 0xa9) bind$alg(r2, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'morus640-generic\x00'}, 0x58) write$apparmor_current(r1, &(0x7f0000000100)=@profile={'changeprofile ', 'fdinfo/3\x00'}, 0x17) fsync(r0) pread64(r1, 0x0, 0x0, 0x3) 13:48:34 executing program 4: signalfd4(0xffffffffffffffff, &(0x7f0000000ff8), 0x8, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000340), 0x10000014c) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x9}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 13:48:34 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x500, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:48:34 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0x3aa8a}) 13:48:34 executing program 1: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/vhost-vsock\x00', 0x2, 0x0) clone(0x100002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) dup2(r2, r0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1e2ba62e) recvfrom(r1, 0x0, 0x0, 0x0, 0x0, 0x0) recvfrom(r2, &(0x7f0000000180)=""/184, 0xfffffffffffffd84, 0x10100, 0x0, 0xfffffffffffffd51) 13:48:34 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) pread64(r1, 0x0, 0x0, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) lookup_dcookie(0x5, &(0x7f0000000140)=""/148, 0x94) clock_gettime(0x0, &(0x7f0000001100)={0x0}) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r3}}, 0x0) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) dup2(r4, r1) migrate_pages(r2, 0x14000000, &(0x7f0000000200)=0x100, &(0x7f0000000100)=0x4) fcntl$F_GET_FILE_RW_HINT(r1, 0x40d, &(0x7f0000000080)) tkill(r2, 0x15) 13:48:34 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0x3aa8b}) [ 2516.393056] binder_alloc: 31995: binder_alloc_buf, no vma [ 2516.411473] binder: 31995:32006 transaction failed 29189/-3, size 0-0 line 3035 [ 2516.430526] binder: send failed reply for transaction 3665 to 31995:32006 13:48:34 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0x1000000}) [ 2516.463688] binder: 31995:32006 ioctl c0306201 20000600 returned -14 13:48:34 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) pread64(r1, 0x0, 0x0, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000001100)={0x0}) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r3}}, 0x0) r4 = dup2(r1, r0) ioctl$KDSETKEYCODE(r4, 0x4b4d, &(0x7f0000000240)={0x9, 0x8000}) r5 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) dup2(r5, r1) r6 = syz_genetlink_get_family_id$tipc(&(0x7f0000000100)='TIPC\x00') sendmsg$TIPC_CMD_SET_NETID(r5, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, r6, 0x300, 0x70bd25, 0x25dfdbff, {{}, 0x0, 0x800b, 0x0, {0x8, 0x2, 0x5}}, ["", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x4000}, 0x810) tkill(r2, 0x15) syz_open_dev$sndseq(&(0x7f0000000200)='/dev/snd/seq\x00', 0x0, 0x40) 13:48:34 executing program 1: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vhost-vsock\x00', 0x2, 0x0) clone(0x100002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getresuid(&(0x7f0000000100), &(0x7f00000005c0), &(0x7f0000000600)=0x0) r4 = geteuid() lstat(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, 0x0}) stat(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000480)={{{@in6=@loopback, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@loopback}, 0x0, @in6=@mcast1}}, &(0x7f0000000580)=0xe8) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000800)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) getresgid(&(0x7f0000000680)=0x0, &(0x7f00000006c0), &(0x7f0000000700)) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000740)={0x0, 0x0, 0x0}, &(0x7f0000000780)=0xc) getgroups(0x5, &(0x7f00000007c0)=[0xee01, 0xee00, 0xee00, 0xee01, 0xffffffffffffffff]) lsetxattr$system_posix_acl(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='system.posix_acl_access\x00', &(0x7f0000000980)=ANY=[@ANYBLOB="02000000010002000000000002000300", @ANYRES32=r3, @ANYBLOB="efa4a4f5876a57dd861954574ea432128bfe22ce7f26367e69fe201adfcd626e59377c3fc314fa780d4db12c940e9b8129a74fd2fa19fa70cb2fa379bbe06fa86fb3a3611150892ea043514e365beeca724dddc3cec3eb5ddd534cbb29f5c0e2809edd0d82f53042dcbd1dfb04b1f1d2d18d85bd871997510459bd02a1f88d8784bfb35b1a9380a465a04153e93930d039945167b6cacfb21cd02b06ef43acd6024e9029f0542fda51836c80911c81081944e728b76ad4b46b0174b65e0c0a8694ffce82dadd58246c8dde8db0caebe21e5660285ffb0a9bd0e3832e8bdcc4a07e2411973004ba2bdcd9fd87d773ec6f88b502ff6930535308c81f05cffce7640908b0b2e46a36759f507bfdaf386f8f0349b78919", @ANYRES32=r4, @ANYBLOB="02000500", @ANYRES32=r5, @ANYBLOB="02000200", @ANYRES32=r6, @ANYBLOB="02000100", @ANYRES32=r7, @ANYBLOB="040001000000000008000400", @ANYRES32=r8, @ANYBLOB="08000500", @ANYRES32=r9, @ANYBLOB='\b\x00\x00\x00', @ANYRES32=r10, @ANYBLOB="08000600", @ANYRES32=r11, @ANYBLOB="10000100000000002000040000000000"], 0x6c, 0x2) r12 = dup2(r2, r0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1e2ba62e) r13 = syz_open_dev$midi(&(0x7f00000008c0)='/dev/midi#\x00', 0x5, 0x8100) ioctl$SG_GET_SG_TABLESIZE(r13, 0x227f, &(0x7f0000000900)) recvfrom(r1, 0x0, 0x0, 0x0, 0x0, 0x0) bind$vsock_dgram(r12, &(0x7f0000000880)={0x28, 0x0, 0x2711, @hyper}, 0x10) rt_sigreturn() recvfrom(r2, &(0x7f0000000180)=""/184, 0xfffffffffffffd84, 0x10100, 0x0, 0xfffffffffffffd51) 13:48:34 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x600, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) [ 2516.554887] binder: undelivered TRANSACTION_COMPLETE 13:48:34 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0x2000000}) [ 2516.650291] binder_alloc: 32118: binder_alloc_buf, no vma [ 2516.662348] binder: 32118:32123 transaction failed 29189/-3, size 0-0 line 3035 [ 2516.670926] binder: send failed reply for transaction 3668 to 32118:32123 [ 2516.687449] binder: 32118:32123 ioctl c0306201 20000600 returned -14 [ 2516.798061] binder: undelivered TRANSACTION_COMPLETE 13:48:34 executing program 2: socket$netlink(0x10, 0x3, 0x17) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='fdinfo/3\x00') exit(0x0) ioctl$SNDRV_TIMER_IOCTL_INFO(r0, 0x80e85411, &(0x7f00000000c0)=""/205) pread64(r0, 0x0, 0x0, 0x3) 13:48:35 executing program 4: signalfd4(0xffffffffffffffff, &(0x7f0000000ff8), 0x8, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000340), 0x10000014c) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0xa}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 13:48:35 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x700, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:48:35 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) pread64(r1, 0x0, 0x0, 0x2) r2 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x6200, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000000140)=0x14) ioctl$TUNSETIFINDEX(r3, 0x400454da, &(0x7f0000000180)=r4) clock_gettime(0x0, &(0x7f0000001100)={0x0}) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r5}}, 0x0) r6 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) dup2(r6, r1) ioctl$SG_GET_NUM_WAITING(r6, 0x227d, &(0x7f00000001c0)) tkill(r2, 0x15) 13:48:35 executing program 1: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-vsock\x00', 0x2, 0x0) clone(0x100002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) dup2(r2, r0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xffffffffffffffaa) recvfrom(r1, 0x0, 0x0, 0x0, 0x0, 0x0) recvfrom(r2, &(0x7f0000000180)=""/184, 0xfffffffffffffd84, 0x10100, 0x0, 0xfffffffffffffd51) 13:48:35 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0x3000000}) 13:48:35 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0x4000000}) [ 2517.365157] binder_alloc: 32237: binder_alloc_buf, no vma [ 2517.378088] binder: 32237:32239 transaction failed 29189/-3, size 0-0 line 3035 [ 2517.385830] binder: send failed reply for transaction 3671 to 32237:32239 [ 2517.398127] binder: 32237:32239 ioctl c0306201 20000600 returned -14 13:48:35 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) pread64(r1, 0x0, 0x0, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)=0x0) clock_gettime(0x0, &(0x7f0000001100)={0x0}) clock_gettime(0x0, &(0x7f0000000080)) keyctl$join(0x1, &(0x7f0000000100)={'syz', 0x0}) timer_settime(r3, 0x1, &(0x7f0000000000)={{}, {r4}}, 0x0) r5 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) dup2(r5, r1) tkill(r2, 0x15) 13:48:35 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0xa00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) [ 2517.519955] binder: undelivered TRANSACTION_COMPLETE 13:48:35 executing program 1: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-vsock\x00', 0x2, 0x0) clone(0x100002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$inet_mreq(r0, 0x0, 0x27, &(0x7f0000000100)={@multicast1, @broadcast}, &(0x7f0000000140)=0x8) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = dup2(r2, r0) r4 = openat$null(0xffffffffffffff9c, &(0x7f0000000240)='/dev/null\x00', 0x8080, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1e2ba62e) getsockopt$inet_sctp6_SCTP_RECVNXTINFO(r4, 0x84, 0x21, &(0x7f0000000280), &(0x7f00000002c0)=0x4) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r3, 0x84, 0x6e, &(0x7f00000000c0)=[@in6={0xa, 0x4e21, 0x3ff, @dev={0xfe, 0x80, [], 0x1e}, 0xfffffffffffffffe}], 0x1c) getsockopt$inet_sctp6_SCTP_MAX_BURST(r3, 0x84, 0x14, &(0x7f0000000300)=@assoc_value={0x0}, &(0x7f0000000340)=0x8) getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r4, 0x84, 0x75, &(0x7f00000003c0)={r5, 0xfff}, &(0x7f0000000400)=0x8) recvfrom(r1, 0x0, 0x0, 0x0, 0x0, 0x0) recvfrom(r2, &(0x7f0000000180)=""/184, 0xfffffffffffffd84, 0x10100, 0x0, 0xfffffffffffffd51) 13:48:35 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0x5000000}) [ 2517.613438] binder_alloc: 32356: binder_alloc_buf, no vma [ 2517.623336] binder: 32356:32361 transaction failed 29189/-3, size 0-0 line 3035 [ 2517.633442] binder: send failed reply for transaction 3674 to 32356:32361 [ 2517.644714] binder: 32356:32361 ioctl c0306201 20000600 returned -14 13:48:35 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) [ 2517.723986] binder: undelivered TRANSACTION_COMPLETE [ 2517.835892] binder_alloc: 32364: binder_alloc_buf, no vma [ 2517.857197] binder: 32364:32368 transaction failed 29189/-3, size 0-0 line 3035 13:48:35 executing program 2: socket$netlink(0x10, 0x3, 0x0) r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x9, 0x406240) ioctl$KVM_ENABLE_CAP(r0, 0x4068aea3, &(0x7f00000000c0)={0x79, 0x0, [0x2, 0x1, 0x9, 0x9d]}) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='fdinfo/3\x00') exit(0x20000000400) pread64(r1, 0x0, 0x0, 0x3) [ 2517.886038] binder: send failed reply for transaction 3677 to 32364:32368 [ 2517.902570] binder: 32364:32368 ioctl c0306201 20000600 returned -14 [ 2517.976869] binder: undelivered TRANSACTION_COMPLETE 13:48:36 executing program 4: signalfd4(0xffffffffffffffff, &(0x7f0000000ff8), 0x8, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000340), 0x10000014c) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0xb}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 13:48:36 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0x6000000}) 13:48:36 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x4000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) [ 2518.353063] binder: 32375:32376 ioctl c0306201 20000600 returned -14 13:48:36 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x4800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) [ 2518.500691] binder: 32383:32386 got reply transaction with no transaction stack [ 2518.526344] binder: 32383:32386 ioctl c0306201 20000600 returned -14 13:48:36 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0x7000000}) 13:48:36 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x4c00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) [ 2518.854562] binder: release 32383:32384 transaction 3683 in, still active [ 2518.914264] binder: 32389:32390 ioctl c0306201 20000600 returned -14 13:48:38 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) pread64(r1, 0x0, 0x0, 0x0) r2 = gettid() ptrace$peek(0x3, r2, &(0x7f0000000080)) timer_create(0x3, &(0x7f0000000100)={0x0, 0x3f, 0x8000000004, @thr={&(0x7f0000000140)="8d53d646fd6b4702e39fe383465da7716466f6cf3bb08f0eda0f1e4250fd78b918898d7e03827f5dc5cfc7437dc66486af77562323f076291fe74bbd43af6e8eca2ae265473c2ad616948ba1218c9adac5f23152a970ff02b60a99a3562359121a5b45ae5c8594498419c0e78f667f414ff185ec4b0832e66c4a72834167c970c9ab8ad3954dc710965e40a02f201e835d49cdd0dbda7abf4833bbf1a3c6920fe73adee8227a91cce0ecb46df8c77a70ebb65fa87070ce480ffba83c22daf9dad4", &(0x7f0000000240)="3be73f644e463b9b78c9757d0031f6d70a95e1e5e3dbd1ead5eb39221087755b4f719c0e4f4f05abfb41a829986b69f1b08fa476902db495326405290f2563ba95107b67ea1898a53721fe3e1553e24c51af2ea8a40f46e68f504d8971f49a5228347d388f0a2dbec71d191434ef096b2026e717d998eedeec368aa76928136fa5a438f4ea32cd22ad0367328a1545e235148559eb6b29ffacbff06880cbbab66b4bc2b1e1c645644b1b1fb9e2fffa92d2292c08688cdd410217786f30bdd8525483c5b6ab7aa5b793f14fc59b9d6513bc4826c7c9fce97ad4"}}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000001100)={0x0}) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r3}}, 0x0) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) r5 = dup2(r4, r1) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r5, 0x84, 0x18, &(0x7f0000000340)={0x0, 0x5}, &(0x7f0000000380)=0x8) setsockopt$inet_sctp6_SCTP_AUTH_KEY(r5, 0x84, 0x17, &(0x7f00000003c0)={r6, 0x0, 0x39, "4e4827e06c6a473cb1a50f537afec5f76ad6c4cf546011aaba5ca69cf8a075ffe4afda0e790f5577f50737c34141d3702f6229296f355d6465"}, 0x41) tkill(r2, 0x15) 13:48:38 executing program 2: socket$netlink(0x10, 0x3, 0x0) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='fdinfo/3\x00') exit(0x0) getsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(r0, 0x84, 0x18, &(0x7f0000000140)={0x0, 0x40}, &(0x7f0000000180)=0x8) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r0, 0x84, 0x18, &(0x7f0000000300)={r1, 0x100000001}, &(0x7f00000002c0)=0x8) getsockopt$inet_sctp6_SCTP_DELAYED_SACK(r0, 0x84, 0x10, &(0x7f00000001c0)=@assoc_value={r2, 0x2d34}, &(0x7f0000000040)=0x8) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000280)={0x3, &(0x7f0000000000)=[{0x101, 0xfff, 0x7ff, 0x8}, {0x4, 0x80, 0x29, 0xfa3}, {0x81, 0x9, 0xffffffffffffff7e, 0x4}]}) getsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r0, 0x84, 0x13, &(0x7f00000000c0)={r3, 0x8}, &(0x7f0000000100)=0x8) pread64(r0, 0x0, 0x0, 0x3) [ 2521.165660] IPVS: ftp: loaded support on port[0] = 21 [ 2522.001664] chnl_net:caif_netlink_parms(): no params data found [ 2522.344617] bridge0: port 1(bridge_slave_0) entered blocking state [ 2522.352655] bridge0: port 1(bridge_slave_0) entered disabled state [ 2522.360562] device bridge_slave_0 entered promiscuous mode [ 2522.368857] bridge0: port 2(bridge_slave_1) entered blocking state [ 2522.375397] bridge0: port 2(bridge_slave_1) entered disabled state [ 2522.383284] device bridge_slave_1 entered promiscuous mode [ 2522.670829] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 2522.680803] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 2522.695314] device bridge_slave_1 left promiscuous mode [ 2522.701172] bridge0: port 2(bridge_slave_1) entered disabled state [ 2522.749145] device bridge_slave_0 left promiscuous mode [ 2522.754878] bridge0: port 1(bridge_slave_0) entered disabled state [ 2529.962354] device hsr_slave_1 left promiscuous mode [ 2530.044526] device hsr_slave_0 left promiscuous mode [ 2530.103535] team0 (unregistering): Port device team_slave_1 removed [ 2530.125241] team0 (unregistering): Port device team_slave_0 removed [ 2530.145854] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 2530.214833] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 2530.373839] bond0 (unregistering): Released all slaves [ 2530.543647] team0: Port device team_slave_0 added [ 2530.554050] team0: Port device team_slave_1 added [ 2530.610835] device hsr_slave_0 entered promiscuous mode [ 2530.648476] device hsr_slave_1 entered promiscuous mode [ 2530.792786] 8021q: adding VLAN 0 to HW filter on device bond0 [ 2530.812591] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 2530.826306] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 2530.836649] 8021q: adding VLAN 0 to HW filter on device team0 [ 2530.866941] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 2530.895213] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 2530.914919] bridge0: port 1(bridge_slave_0) entered blocking state [ 2530.921377] bridge0: port 1(bridge_slave_0) entered forwarding state [ 2530.985780] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 2530.993950] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 2531.012124] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 2531.027088] bridge0: port 2(bridge_slave_1) entered blocking state [ 2531.033520] bridge0: port 2(bridge_slave_1) entered forwarding state [ 2531.047085] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 2531.055256] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 2531.082836] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 2531.102687] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 2531.151442] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 2531.163054] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 2531.183353] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 2531.210820] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 2531.230665] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 2531.259936] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 2531.297761] 8021q: adding VLAN 0 to HW filter on device batadv0 13:48:50 executing program 1: r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vga_arbiter\x00', 0x1, 0x0) ioctl$VIDIOC_G_TUNER(r0, 0xc054561d, &(0x7f0000000240)={0x3, "70cc04a77f42eed0e82597d64333e6fa0a441b37e7a65335f294545b8ebefaa1", 0x2, 0x118, 0x0, 0x3, 0x1a, 0x3, 0x1, 0x4}) read(r0, &(0x7f00000002c0)=""/85, 0x55) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$DRM_IOCTL_MODESET_CTL(r0, 0x40086408, &(0x7f0000000140)={0xf97d, 0x5}) clone(0x100002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r4 = dup2(r3, r1) write$binfmt_misc(r2, &(0x7f0000000140)=ANY=[], 0x1e2ba62e) recvfrom(r0, 0x0, 0x1d89e48bf88478da, 0x0, 0x0, 0x0) recvfrom(r3, &(0x7f0000000180)=""/184, 0xfffffffffffffd84, 0x10100, 0x0, 0xfffffffffffffd51) ioctl$SNDRV_SEQ_IOCTL_PVERSION(r4, 0x80045300, &(0x7f00000000c0)) 13:48:50 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x6000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:48:50 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0x8000000}) 13:48:50 executing program 4: signalfd4(0xffffffffffffffff, &(0x7f0000000ff8), 0x8, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000340), 0x10000014c) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0xd}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 13:48:50 executing program 2: socket$netlink(0x10, 0x3, 0x0) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000000c0)='\xef9\x16\x88f\x90\x9d\xcc\x91\b\x00\x00\x00') exit(0x0) pread64(r0, 0x0, 0x0, 0x3) 13:48:50 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") openat$apparmor_task_exec(0xffffffffffffff9c, &(0x7f0000000080)='/proc/self/attr/exec\x00', 0x2, 0x0) r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) pread64(r1, 0x0, 0x0, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000001100)={0x0}) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r3}}, 0x0) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) fcntl$notify(r1, 0x402, 0x80000000) r5 = dup2(r4, r1) ioctl$VIDIOC_G_DV_TIMINGS(r5, 0xc0845658, &(0x7f0000000100)={0x0, @reserved}) tkill(r2, 0x15) [ 2532.303798] binder_alloc_new_buf_locked: 2 callbacks suppressed [ 2532.303806] binder_alloc: 32415: binder_alloc_buf, no vma [ 2532.340576] binder_transaction: 3 callbacks suppressed [ 2532.340594] binder: 32415:32416 transaction failed 29189/-3, size 0-0 line 3035 13:48:50 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0xa000000}) 13:48:50 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) recvmmsg(r0, &(0x7f00000021c0)=[{{&(0x7f0000000140)=@pppoe={0x18, 0x0, {0x0, @dev}}, 0x80, &(0x7f00000005c0)=[{&(0x7f00000001c0)=""/161, 0xa1}, {&(0x7f0000000280)=""/230, 0xe6}, {&(0x7f0000000380)=""/95, 0x5f}, {&(0x7f0000000480)=""/199, 0xc7}, {&(0x7f0000000400)=""/50, 0x32}, {&(0x7f0000000580)}], 0x6, &(0x7f0000000640)=""/79, 0x4f}, 0x5}, {{&(0x7f00000006c0)=@xdp, 0x80, &(0x7f0000000800)=[{&(0x7f0000000740)=""/157, 0x9d}], 0x1}, 0x3}, {{0x0, 0x0, &(0x7f0000000900)=[{&(0x7f0000000840)=""/155, 0x9b}], 0x1, &(0x7f0000000940)=""/235, 0xeb}, 0x101}, {{&(0x7f0000000a40)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @initdev}}}, 0x80, &(0x7f0000000e00)=[{&(0x7f0000000ac0)=""/203, 0xcb}, {&(0x7f0000000bc0)=""/35, 0x23}, {&(0x7f0000001140)=""/4096, 0x1000}, {&(0x7f0000000c00)=""/247, 0xf7}, {&(0x7f0000000d00)=""/213, 0xd5}], 0x5, &(0x7f0000000e80)=""/255, 0xff}, 0x8}, {{&(0x7f0000000f80)=@nl, 0x80, &(0x7f0000002140)=[{&(0x7f0000001000)=""/22, 0x16}, {&(0x7f0000001040)=""/44, 0x2c}, {&(0x7f0000001080)=""/32, 0x20}], 0x3, &(0x7f0000002180)=""/31, 0x1f}, 0xbcb7}], 0x5, 0x40000000, &(0x7f0000002300)) ioctl$SIOCRSGL2CALL(r2, 0x89e5, &(0x7f0000002340)=@bcast) r3 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000080)='/dev/rfkill\x00', 0x40800, 0x0) bind(r0, &(0x7f0000002380)=@pppoe={0x18, 0x0, {0x0, @dev={[], 0xb}, 'lo\x00'}}, 0x80) ioctl$VIDIOC_ENUMSTD(r3, 0xc0485619, &(0x7f0000000100)={0x80, 0x200, "55ce779af666fb5a9cc000089661c3d538426f7efd145287", {0x2, 0x10000}, 0x7f}) pread64(r1, 0x0, 0x0, 0x0) r4 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000001100)={0x0}) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r5}}, 0x0) r6 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) dup2(r6, r1) tkill(r4, 0x15) [ 2532.394550] binder_send_failed_reply: 3 callbacks suppressed [ 2532.394562] binder: send failed reply for transaction 3689 to 32415:32416 [ 2532.427007] binder: 32415:32416 ioctl c0306201 20000600 returned -14 13:48:50 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0x10000000}) 13:48:50 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x60ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) [ 2532.558344] binder_release_work: 16 callbacks suppressed [ 2532.558353] binder: undelivered TRANSACTION_ERROR: 29190 [ 2532.590351] binder_release_work: 3 callbacks suppressed [ 2532.590357] binder: undelivered TRANSACTION_COMPLETE 13:48:50 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) r2 = fcntl$dupfd(r0, 0x406, r1) ioctl$VIDIOC_SUBDEV_QUERY_DV_TIMINGS(r2, 0x80845663, &(0x7f0000000100)={0x0, @reserved}) pread64(r1, 0x0, 0x0, 0x0) r3 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000001100)={0x0}) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r4}}, 0x0) r5 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) dup2(r5, r1) tkill(r3, 0x15) 13:48:50 executing program 1: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-vsock\x00', 0x2, 0x0) clone(0x100002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = dup2(r2, r0) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r3, 0x84, 0x6, &(0x7f00000000c0)={0x0, @in6={{0xa, 0x4e23, 0x4, @initdev={0xfe, 0x88, [], 0x0, 0x0}, 0xfffffffffffffb6a}}}, &(0x7f0000000240)=0x84) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f0000000280)={r4, @in6={{0xa, 0x4e20, 0x4, @rand_addr="f7ea5f277bcc43144eefd5de80f8c73c", 0x1000}}, 0x4, 0x8, 0x3f, 0x4, 0x10}, &(0x7f0000000340)=0x98) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1e2ba62e) recvfrom(r1, 0x0, 0x0, 0x0, 0x0, 0x0) recvfrom(r2, &(0x7f0000000180)=""/184, 0xb8, 0x80010100, 0x0, 0x0) [ 2532.644804] binder: undelivered TRANSACTION_ERROR: 29189 [ 2532.654613] binder_alloc: 32444: binder_alloc_buf, no vma 13:48:50 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0x1a0f0000}) [ 2532.696150] binder: 32444:32446 transaction failed 29189/-3, size 0-0 line 3035 [ 2532.733919] binder: send failed reply for transaction 3692 to 32444:32446 [ 2532.767126] binder: 32444:32446 ioctl c0306201 20000600 returned -14 13:48:50 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0x1f000000}) 13:48:50 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x6800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) [ 2532.847929] binder: undelivered TRANSACTION_ERROR: 29190 [ 2532.855090] binder: undelivered TRANSACTION_COMPLETE [ 2532.870650] binder: undelivered TRANSACTION_ERROR: 29189 [ 2532.897410] binder_alloc: 32460: binder_alloc_buf, no vma [ 2532.914968] binder: 32460:32461 transaction failed 29189/-3, size 0-0 line 3035 [ 2532.930092] binder: send failed reply for transaction 3695 to 32460:32461 [ 2532.941646] binder: 32460:32461 ioctl c0306201 20000600 returned -14 [ 2532.971678] binder: undelivered TRANSACTION_ERROR: 29190 [ 2532.977780] binder: undelivered TRANSACTION_COMPLETE [ 2532.988937] binder: undelivered TRANSACTION_ERROR: 29189 13:48:51 executing program 4: signalfd4(0xffffffffffffffff, &(0x7f0000000ff8), 0x8, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000340), 0x10000014c) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0xe}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 13:48:51 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) getsockopt$bt_hci(r0, 0x0, 0x3, &(0x7f0000000280)=""/68, &(0x7f0000000080)=0x44) pread64(r1, 0x0, 0x0, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) sendto(r0, &(0x7f0000000100)="4868adacf17c26bb773eb67ec0abdca14a69c9c22be333e9a7eebecfb47bd809274bdb9f23fc69608ac60fbd91920d0850faf6869f7cc098176c19e5ecce340a2f356138c2d43f0aa8865449c9f7d70e45e64feeec1477c71803c306dee7a1f732a82e684c7798b8edd64105a8a0e4cb1cbb3af278857b36f031cf6c8808615bd70dffb3ef78647003d57b65b04b5c7b41c3eae6079e0ef3c9e79b304bed38e0ccc59b4dfd1a3f605cff201dad7d08cb3dd51520c4551f6774a671047882ba7d3a2320dd3482f695757016053f940af21fa74573e7041e0c5e84", 0xda, 0x40004, &(0x7f0000000200)=@rc={0x1f, {0x7f, 0x8000, 0x3ff, 0x3, 0x6, 0x9}, 0x6}, 0x80) clock_gettime(0x0, &(0x7f0000001100)={0x0}) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r3}}, 0x0) r4 = syz_open_dev$dspn(&(0x7f0000000300)='/dev/dsp#\x00', 0x73f, 0x0) clock_gettime(0x0, &(0x7f0000000340)={0x0, 0x0}) timerfd_settime(r4, 0x1, &(0x7f0000000380)={{0x0, 0x1c9c380}, {r5, r6+10000000}}, &(0x7f00000003c0)) r7 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) dup2(r7, r1) tkill(r2, 0x15) 13:48:51 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0x20000000}) 13:48:51 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x6c00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:48:51 executing program 2: socket$netlink(0x10, 0x3, 0x0) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='fdinfo/3\x00') bpf$BPF_MAP_GET_NEXT_ID(0xc, &(0x7f0000000000)=0xc198, 0x1) exit(0x0) pread64(r0, 0x0, 0x0, 0x3) stat(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = getuid() syz_mount_image$jfs(&(0x7f0000000040)='jfs\x00', &(0x7f00000000c0)='./file0\x00', 0x14e, 0x2, &(0x7f0000000200)=[{&(0x7f0000000100)="201a206cf2df620975ce13a810f270aeef24d6474b7e099cf48e7da148a178d8b830366acaeadcb34425ed3c510755a171e2", 0x32, 0x5}, {&(0x7f0000000140)="2ac056639746f6382119021b6f0d9d3f18b5a66883d3aaf6c4aefbd6f450b21dd650f7fbb7857176d5c5d70b227d3c7b0610b1a8b016bb9ba6af79f2b8ebfc43a25f933ae0e07cf56bd4f30290383f408083a89c865af5cd2b1a56b496a5ed4d4a3629f0291a9e6e99444e41f4980a603155e9091e26bc0bc67cf4f90c8e0b30b8fbf5ec69f5b667b4fe92ae5fa439cb3eb3adf491e661b76f6e3654a5db6251016da808c8f86e", 0xa7, 0x1ff}], 0x800004, &(0x7f0000000300)={[{@discard='discard'}, {@discard_size={'discard', 0x3d, 0x6}}, {@gid={'gid', 0x3d, r1}}], [{@uid_eq={'uid', 0x3d, r2}}, {@subj_user={'subj_user', 0x3d, 'ppp0%cpusetwlan1-(selinuxmd5sumvboxnet1.*wlan1vmnet1]&security\xc9[vboxnet1security[vboxnet0posix_acl_accesstrusted!$em1cgroupvboxnet1]'}}, {@dont_appraise='dont_appraise'}]}) 13:48:51 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0x3f000000}) [ 2533.242775] binder_alloc: 32467: binder_alloc_buf, no vma [ 2533.255450] binder: 32467:32475 transaction failed 29189/-3, size 0-0 line 3035 [ 2533.271392] binder: send failed reply for transaction 3698 to 32467:32475 [ 2533.280174] binder: 32467:32475 ioctl c0306201 20000600 returned -14 [ 2533.301913] JFS: discard option not supported on device [ 2533.311354] JFS: discard option not supported on device [ 2533.323004] jfs: Unrecognized mount option "subj_user=ppp0%cpusetwlan1-(selinuxmd5sumvboxnet1.*wlan1vmnet1]&securityÉ[vboxnet1security[vboxnet0posix_acl_accesstrusted!$em1cgroupvboxnet1" or missing value 13:48:51 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x7400, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:48:51 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000001100)={0x0}) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r3}}, 0x0) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) ioctl$FS_IOC_GETFSLABEL(r0, 0x81009431, &(0x7f0000000100)) dup2(r4, r1) tkill(r2, 0x15) mq_open(&(0x7f0000000200)='/dev/vcs\x00', 0xc2, 0x20, &(0x7f0000000240)={0x3, 0x21a, 0xdc, 0x1, 0x3, 0x0, 0x7, 0x6}) ioctl$VIDIOC_UNSUBSCRIBE_EVENT(r4, 0x4020565b, &(0x7f0000000080)={0x8000000, 0x4, 0x1}) [ 2533.350901] binder: undelivered TRANSACTION_ERROR: 29190 [ 2533.358286] binder: undelivered TRANSACTION_COMPLETE [ 2533.378344] binder: undelivered TRANSACTION_ERROR: 29189 [ 2533.431466] binder_alloc: 32487: binder_alloc_buf, no vma [ 2533.441798] binder: 32487:32488 transaction failed 29189/-3, size 0-0 line 3035 [ 2533.463417] binder: send failed reply for transaction 3701 to 32487:32488 [ 2533.481752] binder: 32487:32488 ioctl c0306201 20000600 returned -14 13:48:51 executing program 1: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-vsock\x00', 0x2, 0x0) clone(0x100002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = dup2(r2, r0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1e2ba62e) ioctl$sock_SIOCDELDLCI(r3, 0x8981, &(0x7f00000000c0)={'syzkaller0\x00', 0x3}) recvfrom(r1, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SCSI_IOCTL_STOP_UNIT(r3, 0x6) r4 = socket$inet_smc(0x2b, 0x1, 0x0) recvfrom(r4, &(0x7f0000000180)=""/184, 0xb8, 0x10100, 0x0, 0x0) 13:48:51 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0x48000000}) 13:48:51 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) pread64(r1, 0x0, 0x0, 0x0) r2 = dup(r1) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x3, 0x20, 0x1, r2}) r3 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000001100)={0x0}) setsockopt$RXRPC_UPGRADEABLE_SERVICE(r2, 0x110, 0x5, &(0x7f0000000100)=[0x1], 0x2) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r4}}, 0x0) r5 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) dup2(r5, r1) tkill(r3, 0x15) 13:48:51 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x7a00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) [ 2533.557496] binder: undelivered TRANSACTION_ERROR: 29190 [ 2533.563649] binder: undelivered TRANSACTION_COMPLETE [ 2533.579461] binder: undelivered TRANSACTION_ERROR: 29189 [ 2533.625034] binder_alloc: 32497: binder_alloc_buf, no vma [ 2533.638718] binder: 32497:32501 transaction failed 29189/-3, size 0-0 line 3035 [ 2533.647217] binder: send failed reply for transaction 3704 to 32497:32501 [ 2533.655085] binder: 32497:32501 ioctl c0306201 20000600 returned -14 [ 2533.704753] binder: undelivered TRANSACTION_COMPLETE 13:48:52 executing program 4: signalfd4(0xffffffffffffffff, &(0x7f0000000ff8), 0x8, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000340), 0x10000014c) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0xf}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 13:48:52 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0x4c000000}) 13:48:52 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x9400, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:48:52 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) pread64(r1, 0x0, 0x0, 0xfffffffffffffffe) r2 = socket$vsock_stream(0x28, 0x1, 0x0) setsockopt$SO_VM_SOCKETS_CONNECT_TIMEOUT(r2, 0x28, 0x6, &(0x7f0000000100)={0x77359400}, 0x10) r3 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000001100)={0x0}) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r4}}, 0x0) r5 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/vcs\x00', 0xffffffffffffffff, 0x0) ioctl$TIOCSBRK(r5, 0x5427) r6 = dup2(r5, r1) tkill(r3, 0x15) ioctl$SCSI_IOCTL_GET_BUS_NUMBER(r6, 0x5386, &(0x7f0000000080)) 13:48:52 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='fdinfo/3\x00') exit(0x0) pread64(r1, 0x0, 0x0, 0x3) getsockopt$sock_int(r0, 0x1, 0x2c, &(0x7f0000000000), &(0x7f0000000040)=0x4) 13:48:52 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0x60000000}) 13:48:52 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) r1 = syz_open_dev$sndpcmc(&(0x7f0000000080)='/dev/snd/pcmC#D#c\x00', 0x7, 0x0) ioctl$sock_rose_SIOCRSCLRRT(r1, 0x89e4) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r2 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) pread64(r2, 0x0, 0x0, 0x0) r3 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000001100)={0x0}) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r4}}, 0x0) r5 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) dup2(r5, r2) tkill(r3, 0x15) [ 2534.211060] binder_alloc: 32518: binder_alloc_buf, no vma [ 2534.242747] binder: 32518:32521 transaction failed 29189/-3, size 0-0 line 3035 13:48:52 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0x68000000}) [ 2534.280975] binder: send failed reply for transaction 3707 to 32518:32521 [ 2534.303741] binder: 32518:32521 ioctl c0306201 20000600 returned -14 [ 2534.400432] binder: undelivered TRANSACTION_COMPLETE 13:48:52 executing program 1: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-vsock\x00', 0x2, 0x0) clone(0x100002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) connect$bt_l2cap(r1, &(0x7f00000000c0)={0x1f, 0x8, {0x9, 0x5, 0x9, 0x5, 0x9, 0xffff}, 0x7, 0x40}, 0xe) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r0) ioctl$sock_SIOCDELDLCI(r3, 0x8981, &(0x7f0000000100)={'team_slave_0\x00', 0x1ff}) write$binfmt_misc(r2, &(0x7f0000000140)=ANY=[], 0x1e2ba62e) recvfrom(r2, 0x0, 0x0, 0x0, 0x0, 0x0) recvfrom(r3, &(0x7f0000000180)=""/184, 0xfffffffffffffd84, 0x10100, 0x0, 0xfffffffffffffd51) 13:48:52 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0x6c000000}) 13:48:52 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x307100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:48:52 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) pread64(r1, 0x0, 0x0, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_gettime(0x7, &(0x7f0000000080)={0x0}) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r3}}, 0x0) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) dup2(r4, r1) tkill(r2, 0x15) [ 2534.583290] binder_alloc: 32544: binder_alloc_buf, no vma [ 2534.599299] binder: 32544:32547 transaction failed 29189/-3, size 0-0 line 3035 [ 2534.608023] binder: send failed reply for transaction 3710 to 32544:32547 [ 2534.627024] binder: 32544:32547 ioctl c0306201 20000600 returned -14 [ 2534.709759] binder: undelivered TRANSACTION_COMPLETE 13:48:53 executing program 4: signalfd4(0xffffffffffffffff, &(0x7f0000000ff8), 0x8, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000340), 0x10000014c) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x10}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 13:48:53 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0x74000000}) 13:48:53 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) pread64(r1, 0x0, 0x0, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_gettime(0x3, &(0x7f0000001100)={0x0}) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r3}}, 0x0) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) dup2(r4, r1) tkill(r2, 0x15) 13:48:53 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x400000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:48:53 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='fdinfo/3\x00') exit(0x0) pread64(r1, 0x0, 0x0, 0x3) write$UHID_CREATE(r1, &(0x7f00000001c0)={0x0, 'syz1\x00', 'syz1\x00', 'syz0\x00', &(0x7f00000000c0)=""/223, 0xdf, 0x1ff, 0x13, 0x8, 0x2fa6, 0x3ff}, 0x120) ioctl$KVM_GET_DEBUGREGS(r0, 0x8080aea1, &(0x7f0000000000)) 13:48:53 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0x7a000000}) [ 2535.203009] binder_alloc: 32563: binder_alloc_buf, no vma [ 2535.224380] binder: 32563:32565 transaction failed 29189/-3, size 0-0 line 3035 13:48:53 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0x8aaa0300}) [ 2535.248112] binder: send failed reply for transaction 3713 to 32563:32565 [ 2535.255360] binder: 32563:32565 ioctl c0306201 20000600 returned -14 13:48:53 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x50a000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) [ 2535.304276] binder: undelivered TRANSACTION_COMPLETE [ 2535.364736] binder_alloc: 32580: binder_alloc_buf, no vma [ 2535.376337] binder: 32580:32581 transaction failed 29189/-3, size 0-0 line 3035 [ 2535.392917] binder: send failed reply for transaction 3716 to 32580:32581 [ 2535.405948] binder: 32580:32581 ioctl c0306201 20000600 returned -14 [ 2535.456475] binder: undelivered TRANSACTION_COMPLETE 13:48:53 executing program 1: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000280)='/dev/vhost-vsock\x00', 0x2, 0x0) clone(0x100002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000140)='/dev/autofs\x00', 0x121000, 0x0) ioctl$TCSETSW(r1, 0x5403, &(0x7f0000000240)={0x7, 0xfffffffffffffffe, 0x30, 0x0, 0x5, 0x7, 0x8, 0x9, 0xfffffffffffff1c1, 0x3ff, 0x6, 0x1}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r4 = dup2(r3, r0) ioctl$UI_DEV_SETUP(r4, 0x405c5503, &(0x7f00000000c0)={{0x2, 0x8, 0x75aed75b, 0x6}, 'syz0\x00', 0x4a}) renameat2(r4, &(0x7f0000000000)='./file0\x00', r1, &(0x7f00000002c0)='./file0\x00', 0x1) write$binfmt_misc(r2, &(0x7f0000000140)=ANY=[], 0x1e2ba62e) recvfrom(r2, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$UI_GET_VERSION(r4, 0x8004552d, &(0x7f0000000300)) recvfrom(r3, &(0x7f0000000180)=""/184, 0xfffffffffffffd84, 0x10100, 0x0, 0xfffffffffffffd51) 13:48:53 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0x8baa0300}) 13:48:53 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x70a000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:48:53 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0xe4ffffff}) [ 2535.590499] binder: 32587:32588 ioctl c0306201 20000600 returned -14 13:48:54 executing program 4: signalfd4(0xffffffffffffffff, &(0x7f0000000ff8), 0x8, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000340), 0x10000014c) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x11}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 13:48:54 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x713000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) [ 2536.172962] binder: 32600:32601 ioctl c0306201 20000600 returned -14 13:48:56 executing program 5: getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080)={0x0}, &(0x7f0000000100)=0xc) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000140)=0x0) setpgid(r0, r1) r2 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r3 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000180)='/dev/vsock\x00', 0x200000, 0x0) ioctl$DRM_IOCTL_ADD_CTX(0xffffffffffffffff, 0xc0086420, &(0x7f00000001c0)={0x0}) ioctl$DRM_IOCTL_UNLOCK(r3, 0x4008642b, &(0x7f0000000240)={r4, 0x6}) r5 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) pread64(r5, 0x0, 0x0, 0x0) r6 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000001100)={0x0}) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r7}}, 0x0) r8 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) dup2(r8, r5) tkill(r6, 0x15) 13:48:56 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0xfdfdffff}) 13:48:56 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='fdinfo/3\x00') exit(0x41e) eventfd2(0x200, 0x1) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000000)=""/18, 0x12}], 0x1, 0x0) ioctl$sock_bt_cmtp_CMTPCONNADD(r1, 0x400443c8, &(0x7f0000000100)={r1, 0x3}) connect$vsock_stream(r0, &(0x7f0000000180)={0x28, 0x0, 0x0, @host}, 0x10) pread64(r1, 0x0, 0x0, 0x3) 13:48:56 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x740000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:48:56 executing program 1: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-vsock\x00', 0x2, 0x0) clone(0x100002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = syz_open_dev$usb(&(0x7f0000000340)='/dev/bus/usb/00#/00#\x00', 0x6, 0x10400) ioctl$DRM_IOCTL_ADD_CTX(0xffffffffffffff9c, 0xc0086420, &(0x7f00000003c0)={0x0}) ioctl$DRM_IOCTL_GET_SAREA_CTX(r3, 0xc010641d, &(0x7f0000000500)={r4, &(0x7f0000000400)=""/194}) r5 = dup2(r2, r0) ioctl$TIOCGSID(r5, 0x5429, &(0x7f0000000140)=0x0) r7 = getuid() stat(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) setsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000300)={r6, r7, r8}, 0xc) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1e2ba62e) ioctl$DRM_IOCTL_AGP_ALLOC(r5, 0xc0206434, &(0x7f00000000c0)={0x9, 0x0, 0x10001, 0x4}) ioctl$DRM_IOCTL_AGP_ALLOC(r5, 0xc0206434, &(0x7f0000000100)={0xffffffffffffffff, r9, 0x1, 0x6}) recvfrom(r1, 0x0, 0x0, 0x0, 0x0, 0x0) recvfrom(r2, &(0x7f0000000180)=""/184, 0xfffffffffffffd84, 0x10100, 0x0, 0xfffffffffffffd51) 13:48:56 executing program 4: signalfd4(0xffffffffffffffff, &(0x7f0000000ff8), 0x8, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000340), 0x10000014c) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x14d}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 13:48:56 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0xfffffdfd}) [ 2538.242374] binder_alloc_new_buf_locked: 2 callbacks suppressed [ 2538.242383] binder_alloc: 32617: binder_alloc_buf, no vma [ 2538.263798] binder_transaction: 2 callbacks suppressed [ 2538.263884] binder: 32617:32620 transaction failed 29189/-3, size 0-0 line 3035 [ 2538.284409] binder_send_failed_reply: 2 callbacks suppressed 13:48:56 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0xffffff7f}) [ 2538.284422] binder: send failed reply for transaction 3725 to 32617:32620 [ 2538.298286] binder: 32617:32620 ioctl c0306201 20000600 returned -14 13:48:56 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) pread64(r1, 0x0, 0xfe33, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000001100)={0x0}) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r3}}, 0x0) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) dup2(r4, r4) tkill(r2, 0x15) ioctl$VIDIOC_G_INPUT(r0, 0x80045626, &(0x7f0000000080)) 13:48:56 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x940000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) [ 2538.391545] binder_release_work: 14 callbacks suppressed [ 2538.391553] binder: undelivered TRANSACTION_ERROR: 29190 [ 2538.414395] binder_release_work: 2 callbacks suppressed [ 2538.414400] binder: undelivered TRANSACTION_COMPLETE 13:48:56 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0xffffffe4}) [ 2538.439587] binder: undelivered TRANSACTION_ERROR: 29189 [ 2538.477500] binder_alloc: 32638: binder_alloc_buf, no vma [ 2538.506245] binder: 32638:32639 transaction failed 29189/-3, size 0-0 line 3035 13:48:56 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0x1000000000}) [ 2538.534767] binder: send failed reply for transaction 3728 to 32638:32639 [ 2538.563697] binder: 32638:32639 ioctl c0306201 20000600 returned -14 13:48:56 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0xa05000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:48:56 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0x1000000000000}) [ 2538.657471] binder: undelivered TRANSACTION_ERROR: 29190 [ 2538.664668] binder: undelivered TRANSACTION_COMPLETE [ 2538.683792] binder: undelivered TRANSACTION_ERROR: 29189 [ 2538.730931] binder_alloc: 32648: binder_alloc_buf, no vma [ 2538.736793] binder: 32648:32649 transaction failed 29189/-3, size 0-0 line 3035 [ 2538.752079] binder: send failed reply for transaction 3731 to 32648:32649 [ 2538.762979] binder: 32648:32649 ioctl c0306201 20000600 returned -14 [ 2538.816823] binder: undelivered TRANSACTION_ERROR: 29190 [ 2538.829825] binder: undelivered TRANSACTION_COMPLETE [ 2538.854843] binder: undelivered TRANSACTION_ERROR: 29189 13:48:57 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='fdinfo/3\x00') r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040)='IPVS\x00') sendmsg$IPVS_CMD_GET_INFO(r0, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000200)={&(0x7f00000000c0)={0x114, r2, 0x400, 0x70bd2b, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_DEST={0x40, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x9}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x5}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0x2}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@local}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x6}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x8}]}, @IPVS_CMD_ATTR_DEST={0x50, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x279d}, @IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e23}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xffffffff}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x2}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x5}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@empty}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}, @IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e21}]}, @IPVS_CMD_ATTR_DAEMON={0xc, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @loopback}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x1000}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x1}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x3}, @IPVS_CMD_ATTR_DEST={0x40, 0x2, [@IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0xfffffffffffffffa}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x4}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@mcast2}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0xffffffffffffffd7}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x5}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x81}]}, 0x114}, 0x1, 0x0, 0x0, 0x10}, 0x4000080) exit(0x0) pread64(r1, 0x0, 0x0, 0x3) 13:48:57 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0xa07000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:48:57 executing program 1: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vhost-vsock\x00', 0x2, 0x0) clone(0x100002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = getpid() getpgid(r3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) dup2(r2, r0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1e2ba62e) recvfrom(r1, 0x0, 0x0, 0x0, 0x0, 0x0) recvfrom(r2, &(0x7f0000000180)=""/184, 0xfffffffffffffd84, 0x10100, 0x0, 0xfffffffffffffd51) [ 2539.121843] binder_alloc: 32660: binder_alloc_buf, no vma [ 2539.136131] binder: 32660:32661 transaction failed 29189/-3, size 0-0 line 3035 [ 2539.146455] binder: send failed reply for transaction 3734 to 32660:32661 [ 2539.154508] binder: 32660:32661 ioctl c0306201 20000600 returned -14 13:48:57 executing program 4: signalfd4(0xffffffffffffffff, &(0x7f0000000ff8), 0x8, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000340), 0x10000014c) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x29a}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 13:48:57 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0x100000000000000}) 13:48:57 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x1000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) [ 2539.197974] binder: undelivered TRANSACTION_ERROR: 29190 [ 2539.204212] binder: undelivered TRANSACTION_COMPLETE [ 2539.216248] binder: undelivered TRANSACTION_ERROR: 29189 [ 2539.270779] binder_alloc: 32670: binder_alloc_buf, no vma [ 2539.293353] binder: 32670:32676 transaction failed 29189/-3, size 0-0 line 3035 13:48:57 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) pread64(r1, 0x0, 0x0, 0x0) setsockopt$inet6_group_source_req(r0, 0x29, 0x2f, &(0x7f0000000100)={0xfffffffffffffff9, {{0xa, 0x4e24, 0x7, @dev={0xfe, 0x80, [], 0x11}, 0x512}}, {{0xa, 0x4e20, 0xffffffffffffff6b, @empty, 0x9}}}, 0x108) r2 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000001100)={0x0}) timer_settime(0x0, 0xfffffffffffffffd, &(0x7f0000000000)={{0x0, 0x8}, {r3}}, 0x0) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) dup2(r4, r1) tkill(r2, 0x15) 13:48:57 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0x200000000000000}) [ 2539.320967] binder: send failed reply for transaction 3737 to 32670:32676 [ 2539.364113] binder: 32670:32676 ioctl c0306201 20000600 returned -14 13:48:57 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0x300000000000000}) 13:48:57 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x2000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:48:57 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) pread64(r1, 0x0, 0x0, 0x0) r2 = gettid() pipe2(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) setsockopt$inet_sctp_SCTP_AUTO_ASCONF(r3, 0x84, 0x1e, &(0x7f0000000100)=0x35145deb, 0x4) timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000001100)={0x0}) r6 = add_key(&(0x7f0000000140)='syzkaller\x00', &(0x7f0000000180)={'syz', 0x2}, &(0x7f00000001c0)="88a4c652d2ea4b1b9d98025c7e296b3c553e6b9fc00334ed8409c7e5ee2541ebd280b24466f5606d8b68c47bb3e4f88527cd55526d6d2ab780c8a09e0f2e9994415dbd0ee3acfe20d0c0d7aa5a042d034a796bccb41b4644cd60d7370b6174ad83c07cf91367399a568f4ebb22bd3f1e3f3f58157009894aa980557d95856bc94113d978cb7da6186c2fc03477c5b02b2b6f5650f774e42a821809a64d3b031ed2d5030b4cee3a91252d3103e37d787aeda30f983751954b4f0618088e2fe7ce8ebab973294bf99538358c0b", 0xcc, 0xfffffffffffffff9) keyctl$update(0x2, r6, &(0x7f00000002c0)="0ba3a04ce6993423bf9bfc3711cd6249f0013223c92a20150afc1f0189e2c4c48ebd94029a732e45d48198156a18a6eb1489840cf42a023f5c61218c53b5bbc85a820419badcf8fcb2d00352fd2da83fbb1ce5a104c74ccfcc0aaf77b76809264702faf2ff8acae0a7daa980a7da5be2fee52a19430eecaac87d485f5072f476df7a718fb74e05d2be5b5fe57ba142663e47", 0x92) getsockopt$sock_linger(r4, 0x1, 0xd, &(0x7f0000000380), &(0x7f00000003c0)=0x8) epoll_ctl$EPOLL_CTL_DEL(r3, 0x2, r1) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r5}}, 0x0) r7 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) setns(r7, 0x8000000) dup2(r7, r1) tkill(r2, 0x15) [ 2539.458374] binder: undelivered TRANSACTION_ERROR: 29190 [ 2539.464457] binder: undelivered TRANSACTION_COMPLETE [ 2539.480917] binder: undelivered TRANSACTION_ERROR: 29189 [ 2539.547565] binder_alloc: 32690: binder_alloc_buf, no vma [ 2539.584744] binder: 32690:32691 transaction failed 29189/-3, size 0-0 line 3035 13:48:57 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0x400000000000000}) [ 2539.607991] binder: send failed reply for transaction 3740 to 32690:32691 [ 2539.629648] binder: 32690:32691 ioctl c0306201 20000600 returned -14 [ 2539.734942] binder: undelivered TRANSACTION_COMPLETE 13:48:58 executing program 2: socket$netlink(0x10, 0x3, 0x0) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='fdinfo/3\x00') exit(0xffffffff) connect$ax25(r0, &(0x7f0000000000)={{0x3, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, 0x6}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @null, @default, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @bcast]}, 0x48) pread64(r0, 0x0, 0x0, 0x3) 13:48:58 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) pread64(r1, 0x0, 0x0, 0x0) r2 = gettid() ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r1, 0xc0505350, &(0x7f0000000140)={{0x101, 0x5}, {0x2, 0x100000000}, 0x6, 0x4, 0x3f}) gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000001100)={0x0}) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r3}}, 0x0) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vcs\x00', 0x3f7, 0x0) r5 = dup2(r4, r1) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r4, 0x10e, 0x1, &(0x7f0000000100)=0xa, 0x4) tkill(r2, 0x15) recvfrom$rose(r5, &(0x7f00000001c0)=""/3, 0x3, 0x10000, &(0x7f0000000200)=@short={0xb, @dev={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, 0x1, @null}, 0x1c) 13:48:58 executing program 1: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-vsock\x00', 0x2, 0x0) clone(0x100002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = dup2(r2, r0) sendmmsg(r1, &(0x7f0000000280)=[{{&(0x7f00000000c0)=@pppol2tpv3={0x18, 0x1, {0x0, r2, {0x2, 0x4e21, @loopback}, 0x2, 0x4, 0x1, 0x2}}, 0x80, &(0x7f0000000240)=[{&(0x7f0000000140)="eef042076ac2de3bde1fa96ebe2d358ee6a204dbaeabfd7445501e8dfe9fdbf437f94888eee74acc", 0x28}], 0x1, &(0x7f00000003c0)=[{0x48, 0x1bf, 0x3b47, "df991e7a237131c0c621b60cc2ac88c000a3b1d78cfa458d6710aec2576d7d2ca3150c6485841ab59f30b2ac657e3f9d615614e7d5130587"}, {0x70, 0x0, 0xfff, "33b24cf79acecbfeab2fcc887d7602d4d1e3a453fdbc4984d2f02574e16256d9ae4279e05aebb79bb363a3f48f0203af191fec939a821ff5d2d0011fae9451b057899da5dbff84b1977c9b68caff3c00cca4bb1f4b94a625068b77d9d5"}, {0x50, 0x102, 0x1, "3dbcddf55922ba5f59b98cefa9a60b2996b998030f3f2da3e3c278e244b7fdf1ec459805614fddbd93355c5e37ecd178eb63e637a36a5257e6289c"}, {0x100, 0x0, 0x401, "d965d68e4cb8035af551d2fb7b4dfa35736e6faa9d9a9b79876ee7ae4ae996ff976c41b32715eb3a1fa76bd32bc191c5fbca096145d866e992ce288f56b2ec7dfba8e8efa6bf7c54a1fd6423e452ab6e15e73b521baee44a385699ca04ba85080d8e7d338c1fca75bf3a8cebde4c7bf71c5e611506fad2821293c3a1399b4ff69a9c6b77c1eba6cdc9434ccb8c9b9c446034bf16f3ab4746a5bd77ca5b8eb0a23cb21f20b9808ff26d30f00fa6c10bbbadc836eebf0259422db2fba522e40921d89301c887a79648e0c63bb8e922480dab1980b3fe0f106c76eaca677771d56d530fd6de808a1424f188b4"}], 0x208}, 0x8}], 0x1, 0x40) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1e2ba62e) ioctl$VIDIOC_S_DV_TIMINGS(r3, 0xc0845657, &(0x7f00000002c0)={0x0, @bt={0x0, 0x10001, 0x0, 0x3, 0x6, 0x8, 0x3, 0x9, 0x40, 0x2, 0x80000001000000, 0x9, 0x8, 0x1, 0x15, 0x10}}) recvfrom(r1, 0x0, 0x0, 0x0, 0x0, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) recvfrom(r2, &(0x7f0000000180)=""/184, 0xfffffffffffffd84, 0x10100, 0x0, 0xfffffffffffffd51) 13:48:58 executing program 4: signalfd4(0xffffffffffffffff, &(0x7f0000000ff8), 0x8, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000340), 0x10000014c) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x300}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 13:48:58 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x3000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:48:58 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0x500000000000000}) 13:48:58 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0x600000000000000}) [ 2540.345545] binder_alloc: 32715: binder_alloc_buf, no vma [ 2540.388122] binder: 32715:32718 transaction failed 29189/-3, size 0-0 line 3035 [ 2540.418049] binder: send failed reply for transaction 3743 to 32715:32718 [ 2540.426339] binder: 32715:32718 ioctl c0306201 20000600 returned -14 13:48:58 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0x700000000000000}) 13:48:58 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x4000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) [ 2540.534764] binder: undelivered TRANSACTION_COMPLETE [ 2540.618252] binder_alloc: 32728: binder_alloc_buf, no vma [ 2540.638769] binder: 32728:32730 transaction failed 29189/-3, size 0-0 line 3035 [ 2540.653924] binder: send failed reply for transaction 3746 to 32728:32730 13:48:58 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0x800000000000000}) [ 2540.688478] binder: 32728:32730 ioctl c0306201 20000600 returned -14 13:48:58 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x5000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) [ 2540.809347] binder: undelivered TRANSACTION_COMPLETE 13:48:58 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0xa00000000000000}) 13:48:58 executing program 2: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000140)='net/packet\x00') ioctl$TIOCLINUX5(r0, 0x541c, &(0x7f0000000100)={0x5, 0x24a, 0xfffffffffffffabf, 0x9, 0x6d2}) exit(0x0) pread64(r0, 0x0, 0x0, 0x3) r1 = shmat(0xffffffffffffffff, &(0x7f0000000000/0x2000)=nil, 0x4000) shmdt(r1) ioctl$VHOST_GET_FEATURES(r0, 0x8008af00, &(0x7f00000000c0)) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(r0, 0xc0145401, &(0x7f0000000080)={0x0, 0x0, 0x2, 0x1, 0x4}) sendto$x25(r0, &(0x7f0000000000)="7a07169f252f9ccc42cd1df64ec92a8ddeb8fa8a75df9ac2f3ca83", 0x1b, 0x0, &(0x7f0000000040)={0x9, @null=' \x00'}, 0x12) 13:48:58 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) r1 = syz_open_dev$mice(&(0x7f0000000040)='/dev/input/mice\x00', 0x0, 0x22000) ioctl$DRM_IOCTL_GEM_OPEN(0xffffffffffffffff, 0xc010640b, &(0x7f0000000340)={0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_GEM_CLOSE(r1, 0x40086409, &(0x7f0000000380)={r2}) ioctl(r0, 0x1000008912, &(0x7f0000000240)="0adc1f123c125e1f88b07053db14e04bbed865c248bb880000000000001a97ee26f7b3926326106e2688cc799f4f9d9cba05186f119e7ba1323826f7afd4a99c000000000000000044adf1ea4ff75cff1721a42731a09e3e1d18b7b1d0d3f922a08adef26c7596148d7a12c525433a068c6113d2d1feebe1bad7ca090035c3e0918269b24d6deada566bccefd40b052b144a1f9048520ccc614267b0b56e03d49a694715a038bc11703b74bf9cff7e33acf6ab10af7c4a2d2fa16e1e6d8b65d749479d915b3af4e125") r3 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) pread64(r3, 0x0, 0x0, 0x0) r4 = gettid() ioctl$DRM_IOCTL_ADD_MAP(r3, 0xc0286415, &(0x7f0000000200)={&(0x7f0000ffd000/0x2000)=nil, 0x7, 0x5, 0x1, &(0x7f0000ffe000/0x2000)=nil, 0x6912}) timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) r5 = syz_open_dev$vcsa(&(0x7f0000000180)='/dev/vcsa#\x00', 0x5, 0x400002) ioctl$SG_SET_FORCE_PACK_ID(r5, 0x227b, &(0x7f00000001c0)) r6 = dup(r0) ioctl$KDSIGACCEPT(r6, 0x4b4e, 0x27) clock_gettime(0x0, &(0x7f0000001100)={0x0}) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r7}}, 0x0) syz_open_dev$ndb(&(0x7f0000000140)='/dev/nbd#\x00', 0x0, 0x204000) r8 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dlm_plock\x00', 0x101c00, 0x0) ioctl$KVM_GET_VCPU_MMAP_SIZE(r8, 0xae04) r9 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) accept4$ax25(r9, 0x0, &(0x7f0000000100), 0x80800) dup2(r9, r3) tkill(r4, 0x15) [ 2540.906519] binder_alloc: 32738: binder_alloc_buf, no vma [ 2540.958489] binder: 32738:32739 transaction failed 29189/-3, size 0-0 line 3035 [ 2541.022283] binder: send failed reply for transaction 3749 to 32738:32739 [ 2541.083510] binder: 32738:32739 ioctl c0306201 20000600 returned -14 [ 2541.174750] binder: undelivered TRANSACTION_COMPLETE 13:48:59 executing program 1: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-vsock\x00', 0x2, 0x0) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/btrfs-control\x00', 0xa6200, 0x0) getdents(r1, &(0x7f0000000240)=""/166, 0xa6) setsockopt$inet6_tcp_buf(r1, 0x6, 0x1f, &(0x7f0000000100)='?', 0x1) clone(0x100002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r4 = dup2(r3, r0) write$binfmt_misc(r2, &(0x7f0000000140)=ANY=[], 0x1e2ba62e) recvfrom(r2, 0x0, 0x0, 0x0, 0x0, 0x0) recvfrom(r3, &(0x7f0000000180)=""/184, 0xfffffffffffffd84, 0x10100, 0x0, 0xfffffffffffffd51) ioctl$UI_SET_KEYBIT(r4, 0x40045565, 0x1c4) 13:48:59 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0x1000000000000000}) 13:48:59 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x6000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:48:59 executing program 4: signalfd4(0xffffffffffffffff, &(0x7f0000000ff8), 0x8, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000340), 0x10000014c) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x500}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 13:48:59 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) pread64(r1, 0x0, 0x0, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000001100)={0x0}) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r3}}, 0x0) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) dup2(r4, r1) tkill(r2, 0x2f) 13:48:59 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0x1a0f000000000000}) [ 2541.435133] binder_alloc: 32764: binder_alloc_buf, no vma [ 2541.451306] binder: 32764:300 transaction failed 29189/-3, size 0-0 line 3035 [ 2541.464030] binder: send failed reply for transaction 3752 to 32764:300 13:48:59 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) pread64(r1, 0x0, 0x0, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000001100)={0x0}) prctl$PR_SET_PTRACER(0x59616d61, r2) ioctl$DRM_IOCTL_MODE_GETCRTC(r1, 0xc06864a1, &(0x7f0000000100)={&(0x7f0000000080)=[0x0, 0x0, 0x1c57, 0x100000001, 0x20], 0x5, 0x4c9138bc, 0x1, 0x8, 0xfffffffffffffff7, 0x4, {0x7, 0x8, 0x2, 0x0, 0x7fff, 0xffffffff00000001, 0x800, 0x1f, 0x10000, 0x2, 0x1, 0x101, 0xfffffffffffffffa, 0x179f, "d761626f7e42e1b7246108cbd68ba9e7920de7a05151ab3f277f33adcca97ffb"}}) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r3}}, 0x0) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) dup2(r4, r1) tkill(r2, 0x15) [ 2541.494430] binder: 32764:300 ioctl c0306201 20000600 returned -14 13:48:59 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0x1f00000000000000}) 13:48:59 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x7000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) [ 2541.595534] binder: undelivered TRANSACTION_COMPLETE 13:48:59 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0x2000000000000000}) [ 2541.687623] binder: 318:319 ioctl c0306201 20000600 returned -14 13:48:59 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) pwritev(r0, &(0x7f0000001100)=[{&(0x7f0000000000)="c8fac60e8be5c488be5a61fa1712ac613d851fa4f9db061d2a8edf1946899a816cfed4daa7feb59fd935eec6a6e369a0c9a780236fb0de35836c5d99f34533cff1ec9367fafa6cc463e8666cfdcb751fdf897cc0d8ae5a9e4cd17055f423f04ae6325050fa11e61dd388ee14", 0x6c}, {&(0x7f00000000c0)="8587b447b0981c004738fe5a874b424d13c069c50abd278bd5bcc096fa05a49d1249bd27693df7c424120cff65656e7b93e9bde3157c0dce7f6ba4a60098154d8c10a2a2d85540d5590a012c75694b89b7944e2cf7f5f126ccc8e5c4f159cb74aafa79774d0081f1ed619b79498fd17582efe153201e9168bffecc83f0b7f66534b5e679de3b971cc91d2ea2b7c97fc2cb70b3272adee55b5051d55a4b5cdaa2525187b1482d77c2dc772faf00316fdbdae1ca0eab0dd81be8bd7978fb179cec3bc90b7dce667e960d8e107948f1d8eb1087d556c9fe39d7e3de8af230d350144e200307d98f9a59232fd6be6b868629eba4d38f1529f8e9939b48a1144498c56228c43bf5ef2b38814ef658c0a3476a647266ffbed670cf10c2c1ae6f0e64656ca1f45c6b20496c86402c5bbf05670c15f1ad04a7bc9743bbdce252364b877538eefa2b082da7723490810ac17a9f2becb1403f6e1b225dcba7d42cba532246132d74e8efebc0759a2c1a636378e9b02c9a1192072aa49b379047369046536e6d0ed866c8d1a574d2ef2ea2dd2b6c46b6ea0808def0b07e83eb683c4cb172bb42a3c7457bf6bce44186fdb157415936943c06f160a8910c87066a2b973a5521b88a53d586864db2c0ef5431c441139104c74f40810a726c1f372d4ef181f147f27aa4d077c205dbad97dae0df325ebddd49e71292bf5322177d91d0d67e33e86670c47789f1301613227a61e79ede193260fd9ee2f3a4ca12b63cbcffa40ce7340cf3896e6eb5a6537c205ba2b441345659355b56668d0ecf6ea698588a7b86eb9e6e6ddd5617358f8c4c38475a3cd25b6a3f4b261a13c446bc7f956d538e24b2a0f8f1d78b1b6996ca015c77fda135067df27ea6177696325ac314690716fcfaeac17acfffeec9ad438fac9cfec2e6572af2ede2d59f24df77952f3af279f957588ce15e1fc509898418dda6973a295091d0bf3b6c1d88ac264bef0a22b503300db453f2e1997f6e2280b4ba69b0d7119ade73f317ef0db08c7345e8bba64847ea402d7b19273b8a4edae5177143bdb7a5a2cfae5d1e562c83f1253dbad4b10f64fa2f400a812f99472d920245590dc9317e6f84610c18d48c9a7679848a19e33dddcb05608ab258222f85aed78f1d6e0962bc88a7469884dd6e502ff3c990545a610eeaf0bfb13ea52c121fdeb3672bbe2d8397d63faad1d72d617ce0209ffb20a5353a515295123c153f39b4bdf29618a0b6c8485b2b2c5778716adb620ed7fbd95e9ef083fcd65eb5821ad0142ceda7ef69366742aaa59095c6f82473fad55156fa1a8a48d3b5618157aad91d65ab9797fbfc807d91b15db1d231c9dd4e57c479c0aafbe2b7b4c789ae68f4d3e29d419fbb7e977dd00fb55911fa0dd71de6e900a744998bc1fddf2e507055015c324ff31e1d2c98aa26f28b26968a2c86607feb1dc56a425fdd2a34496696f069ee15565ad8d11708360472c4cc576712981c0605f6d214cd0829be5eb78c168ee0327e5fd577ccaaea85712106a01e819813dada7e8d83f42f5ebd4e828eb1a6d93b6cf4cd3e13d72ecf76039153c71ad8ef35b674c8ed52cd4b3915ff5bfa5200f8bf8828df1b644b4ff914e3459bf2ff8aa20e257deeaea74cb21b25ac10b9670c562fc42cfe536a7df60e0c9657ffca5b15ccbf4d9cd237f1c9dd2135f7cf64149d7d152e4e8e9034f6eeab39fed006a3886f8717ea135bb3b928d0d3fee4cb494220d72091141178dbf2b67ff1cecc5fbb6fba6c602a149f62f60fbcf42f47d8d6e37de4bd6b38920e6942e94e58b5bf30513ee335212f3fd031bdd1b47c17313f278ae3f3ef8528193e6c1c992076a269493c7151862bb7b82d2e7c2f78ac7690fa1ce5e0c45a7b6ea61a5ed55d792060fa79fcb356f8c46b8992495dd6273ae288379ce4af772184fa08573fc00bd46bacfe4f6eac1e5b617848ea60904b565fba1881e1c1df67c2b2998a74dd90ddc3c5e8b39173877bd4a7eb72630afb61462ab66c15738b169ce20eef3c6413c81a412083dd3cf9979016edc0fd82bdf8dfada3fef86eaa645246bd41d4f2f00a49d7ce67c361caa5732fa2692b95e9a75a51b8e243166bd424240432e1d6dfa5a7e1105b1d6872c7faf5c3caabde75bcc9f2d6fd1705bbaa665a1a83b7c9809ed3f16dc5b872ccbaeab942604ff9f04dbb2cd2bb75e77ee01201fb9b200b4191f1ea236c9aa8b60fd681333ffe3762155de7e0b942613b85c8b33a06991561ac1dd593a8a7dda389ccdefb1bba07ad6c3f7e2611a7da4984ea0114bfcfbe561357a8f37afcc1daab6aea90f9c02dd6612f437e1658a4b091202ed0b0fcf8ad525c568d2c4ee9ea9dc6793faf1955100f3d993db55d7cf9f99dda480af4fb1dd53bc5b83a6144d149641e70bf96169f80bce87f335a0c0c6f9a2169b4dbd572f3af54759051c5bae47a52a1b794d4ebb09272b6e9cc0fb0c4b956753e5b2a1f8bb580cea791eb621eef49d015ec49e236d56b0e0eae87e569d6078c1aca753a8b89884073cf4ef78487879012531cde1e1be820bc5349a7c3a895f24130569d78bd4244bdced09a3809e2d4fa80ec5584b1c90bb481ac2091018d00240dcb971e85185441e456009e7bd8702f35e1ee388f9aba5013e070b2f20ec84a7370c7ddbe7e615c32d61919b6a8d3c83ce6ef963be28be66981e9f3ead6072a1a36cf3faa6bb5d09c845b69be4fabff29a96f3e4c783b6ef1a8655944e0d7140d92767009b696f00c564064822f23a5e11c36005e73629ce9d96555436d75af80a1ea0b2dbb38ede079676ee8e30bca45272cd2aec8d55651312d7c9614dc169425b2af757b25485d548b846ba5c9d949578c65b66cece31a1c01ff00fe380c79ff12fd77f5efeb4ba81f7680c4c8899c876e19382c8738e179b34aca44c86404442628f5ea50e41d1eee1af34bfe1ed619fdf8c9752588d33aa5be5c0e15b6d05f91fc66c124281df4741a87c458ac03838860105b166b479f0166f8965b27f8b680c12afc6072c3df9a5a6b356f184363bd820a9139d743b1b72b1bb144f3d37d77e1805e4e268e1f90c0751e1605627c4c2d278b25f831d809241cf95544148a558c14df20e34b9531323840fb921cbaffb6ee30c83ecb55da2b6696eff36437308ea951ee5e5ec384d040d46735dd5603194eabd29092910a889cb89308c3f37988283cf524403ccff3f5d6c4f66ba534f048b23083c4574d285fb4b0bdd4672dc82b6ea64e28eb65661d70bdce22197fcfe6f72949f75818b997e979a35f0f7b1e6eaebcd8fe9b5d2d9c6bfc5c39f0f4b99aacd41df3cee2a870688a5949f5a5b378981cb673365895082d2301ffb296666874d0d3b0035e4b2213df22223d0f11e950cfe6ba3e2388ed89a8af43d7d49caa4ab9b4bc6aa343f05d769f6ee1dc7bc54f4e08a8ddeac10defabc4df290129aa8b13d0d2aeb1924d764324d1fa9ad1467bcc0a4f327685fc8c288b2602c3e427cf3034c3bb472340008a6f02e498be34508cfa15e56e90d43a5f2bda53ce6b70343857df47b76fa647ff816cac96ae85047b6f15eefac8d748b8bcb23232c60164aae6cca69513d3cdebd188e1153ea7dfa33dd905bccf58835a91da0b688b3c8d0b90278d41a9d493203d700d24ac8b1ee50ac25fc6009ca3b3bfcb8be12ae643050e0a2b17f44279819181ec9f6a35c0f432717e534e4e3941d4b0d55b5b20657b36d37535589341399d0012b00e5c585f1b7bcf79de0fea9d7baa9057473d7089b1606d88eecdb6eeadf36affca86fb2ed6d3aa85968eee7c4cb96bd9a6f0ead721424d9c47d022a67b24712567eaceb430c447c93957a62246a75a5bab2d5ce713a950986f1c58b42041a7c4ede18841f4145d16b359af18ced3c066a34f6d27d0accc108942182d33a852344ecabf5bc67770082c8ebd4d61fdb8dabd3aabfcad481e1217c12d8dcc4707bf47a62247f57bfed8cd53cf5f088b8897036e6f1d6f92b43122664776bec90b9911dd2aeb6954ac5e827d3bc9fd94742673585daf789bcde763b930ac76b245140966db68454bd91f0dcb066fed36b6dde81d6643b989bea7b203fef7163bdd9d86c9c6b4a32239dc53c950105cb680e1960686a25774948810c7888efd8b26aec5f5fa49884cbe9b2559c913279de72399765b1822a4b653f6fe1948c5425e1f523f0da14a589ae2a474f424a62ebbd88edbbba264332292ec4d36c84484b66b44fcfc42a252cdd886f9c507f7f816436e379a3cfe5fb7a00711cf4f87afb03b2cf29d75cfae968e1e79eddd0d5caa7bdedadd8f2d75280356a3d1e11f5c988a203906b54bdfbfa40fa3e9b9b3cf0aece716d7560ab1c32219cedd3e62ec2446cc53fb6a32540145055cc5725012977609451581cbb10c1c05c97cbc35aa2a22ac77d4cdc5669595bfab71ed5ea9e50b156e10c135ece1ecf2dab7d7f8cf4bf484c7c0a31dbf458eff355d90d222a369d913d557db3164e2b0e6e98e8069db2d6cb5eb9065b63a9425b37b475a896c509409fb0953b464b2dd9fdb5b95143c51595a6a8d89a0f705a23040edf99a9db93fb8ba4474c08df275e5ae9124b8dfc935e73bd71d33ac00a1d7eab272d5dbfea9b585ada20fdbbba63de772fb62f7e0ca6966710fa9e44d2ff58d1b08f289572c16c9bfb71c4ade5e412069027f821166ad8f0d53753f615bfcc5178979b744b77c211a5f9b782fc067580afa5a94f8ce6f58cc6a67c8767bc9e7ac122253c795397bcc16ff648b871e8af81ba346e640c8a0dcf83bba39aac217debaee84e75c57748115e379ad57ed383e3465682cb238b5063d33c4af40c23ac06380674f63f3e53035d1f068f547ac1b59ddbbb44604ff3eac878fe660ecb0e622f4904f86ca65642b329e9d4e5660f1fa9f9d76b6707240542dd3727ee30fc8914bf1246fbf9d24164848aa08a0275729d7382483066c5e67ae9ce0bcc6f50b48a59a75cfbc89934bb2bcbdc82a65e83d9884a1f4a3fe0efa60ab01156f500f10e386915625828816c5fcdb4c483e525d6611db9639b8141752ffee525265c697bd5710ed214ff34076072baf91c40a9b40e4fb40b3bfc36c2d74fe28866f5003119e033069ab562b2207cf884a186e5bc25d7fb933af4a7aad8d830574fc9854c51e25c11e57ce52213f10dc7ba4363a5378a420630dbf60d488885041a6ec0e3f524f42898ebfb80056de7d1e009cad87c633a35e5e18843617f6c5bbb9fd2df154c4fa5c85caf0b8a394afdda9e6914d173dc75b972acac1c85e49bf43be9bdfaab3e4c732a72d3619c64d36bb0798dd3f76ec3062bae35cd747e06530fa79cd401237585d4790cb904dc7a555767523d3062bbb4cee498646e2714371bf71aae818abefac52c25f1388a0f1cbe5234d35dfebc1b20c290eca9f0b8d3638edfb205093517e2cd5a54574d400e48a7f76868df829f96d27ed77a9029a4437df773f8db0c66162d248e91a3c0ff96ab2faf1696d96dabbff106f37c515662161e4198a9683f26767c48becc525ddfe17d7d785d3502bab4392839a0da2932daff2972f21417d6d5bd80349efa94ca147a23720bf9a55f9278077d2a764ca12bf004e5c6d1e2a7517e9c29e1550b3d5a074d7958d9b397e06aaf14e57c6bc63d4153474943bdcac0e436e1f4b82fe7824030c5ceb99ce6fdbf1e55a8887f61e88ff2da269d160988cd3c4cc8e8c818ad83582871637960acf1fb1f139778c786a057359d1901f7820e8249539d1356c5f0f20", 0x1000}, {&(0x7f0000001180)="30017f73a4929616375479b8d32833e45f0f261fd061193331afd4000000000000000000b3eb75bc6fe8c4a722446c224bbd322cd2ac2f6d94edd7e3c105ea9acfd72bcf5ef94fb2e5a668896bf1811b2fc4ff1d000000e8089abf9a98b3e56a8ba045bbcec9fbfdf7b64dba55d7a2fa3d8096cbbf61f26e0cb876534ee67a59866f31d063788924a3a64e33d001c7e9e4cea3ca8a87", 0x96}], 0x3, 0x3) openat$urandom(0xffffffffffffff9c, &(0x7f0000001140)='/dev/urandom\x00', 0x10001, 0x0) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='fdinfo/3\x00') exit(0x0) pread64(r1, 0x0, 0x0, 0x3) 13:48:59 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffff9c, 0x89e2, &(0x7f0000000180)={r0}) bind$inet6(r2, &(0x7f00000001c0)={0xa, 0x4e22, 0x1, @remote, 0xffffffff}, 0x1c) pread64(r1, 0x0, 0x0, 0x0) r3 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000001100)={0x0}) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r4}}, 0x0) r5 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f00000002c0)='/proc/capi/capi20ncci\x00', 0x1010c2, 0x0) ioctl$SNDRV_RAWMIDI_IOCTL_PARAMS(r5, 0xc0305710, &(0x7f0000000140)={0x1, 0x80, 0x400, 0x40}) r6 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) dup2(r6, r1) tkill(r3, 0x15) r7 = syz_open_dev$mice(&(0x7f0000000200)='/dev/input/mice\x00', 0x0, 0x8400) ioctl$SIOCSIFHWADDR(r5, 0x8924, &(0x7f0000000280)={'gre0\x00', @dev={[], 0xd}}) ioctl$TIOCLINUX6(r7, 0x541c, &(0x7f0000000240)={0x6, 0xfffffffffffffffa}) openat$vimc1(0xffffffffffffff9c, &(0x7f0000000080)='/dev/video1\x00', 0x2, 0x0) 13:49:00 executing program 1: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-vsock\x00', 0x2, 0x0) clone(0x100002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000140)='/dev/dlm-control\x00', 0x0, 0x0) ioctl$RTC_PLL_SET(r1, 0x40207012, &(0x7f0000000240)={0x6, 0x3, 0xd3, 0x4, 0x3, 0xe, 0x1f}) ioctl$VIDIOC_SUBDEV_S_CROP(r1, 0xc038563c, &(0x7f0000000280)={0x1, 0x0, {0x3, 0x4, 0x5, 0x8}}) socketpair$unix(0x1, 0x7, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = fcntl$getown(r0, 0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r4, 0x0, 0xffffffffffffffff, 0x0) r5 = dup2(r3, r0) ioctl$BLKRAGET(r1, 0x1263, &(0x7f0000000300)) write$binfmt_misc(r2, &(0x7f0000000140)=ANY=[], 0x1e2ba62e) recvfrom(r2, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$PPPIOCGFLAGS(r5, 0x8004745a, &(0x7f00000002c0)) recvfrom(r3, &(0x7f0000000180)=""/184, 0xfffffffffffffd84, 0x10100, 0x0, 0xfffffffffffffd51) setsockopt$IP_VS_SO_SET_STOPDAEMON(r5, 0x0, 0x48c, &(0x7f0000000100)={0x1, 'veth1_to_hsr\x00', 0x3}, 0x18) 13:49:00 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0xa000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:49:00 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0x3f00000000000000}) [ 2542.307322] binder: 337:340 ioctl c0306201 20000600 returned -14 13:49:00 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) pread64(r1, 0x0, 0x0, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000001100)={0x0}) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r3}}, 0x0) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) dup2(r4, r1) r5 = request_key(&(0x7f0000000080)='.dead\x00', &(0x7f0000000100)={'syz', 0x2}, &(0x7f0000000140)='\x00', 0xfffffffffffffffe) keyctl$KEYCTL_PKEY_VERIFY(0x1c, &(0x7f0000000180)={r5, 0x4, 0x40}, 0x0, &(0x7f00000001c0)="8d84c9627200776ed52c19f25a9c0110bc3bba98c0e05f3c451e071e3e98570223c812be1067772b55747c325a740b81510ebcbf23bda69a051cd1c33f1c0b8774d83431de34ae7e78d9158e6849271996c63fe65a33de1d350ec8df48e63d58505a94f866c7", &(0x7f0000000240)="64dfec50747101b28984da007cc15dd979228ab424128d844677582ef9c6d4b4ffa93e5a5f027a697f1a3fa7183c008464703fbab569dcf9b0a30468b1304da5597e40beb4ff727742ff8979f6285c850c120c07780c2f349f996dd7abc1f757eb609f58ef0386e23ca13338fd440ebd947e9e4d36ebd6320699fe8a4d6e600741af97f338221c23e9055c1b54338a21f865c9d7f7f160730cf8b570e00ee43bb694") tkill(r2, 0x15) 13:49:00 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0x4800000000000000}) 13:49:00 executing program 4: signalfd4(0xffffffffffffffff, &(0x7f0000000ff8), 0x8, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000340), 0x10000014c) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x600}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 13:49:00 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x20000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:49:00 executing program 1: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-vsock\x00', 0x2, 0x0) clone(0x100002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) dup2(r2, r0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1e2ba62e) recvfrom(r2, &(0x7f0000000180)=""/184, 0xfffffffffffffd84, 0x10100, 0x0, 0xfffffffffffffd51) 13:49:00 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0x4c00000000000000}) [ 2542.462309] binder: 351:352 ioctl c0306201 20000600 returned -14 13:49:00 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) pread64(r1, 0x0, 0x0, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000001100)={0x0}) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r3}}, 0x0) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) r5 = dup2(r4, r1) getsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(r4, 0x84, 0x18, &(0x7f0000000200)={0x0, 0x3}, &(0x7f0000000240)=0x8) getsockopt$inet_sctp_SCTP_DELAYED_SACK(r5, 0x84, 0x10, &(0x7f0000000280)=@assoc_value={r6, 0x3ff}, &(0x7f00000002c0)=0x8) tkill(r2, 0x15) connect(r0, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r5, {0x2, 0x4e20, @multicast2}, 0x3, 0x1, 0x2}}, 0x80) perf_event_open(&(0x7f0000000100)={0x5, 0x70, 0x7, 0x11, 0xffffffff, 0x3d, 0x0, 0x0, 0x28, 0x5, 0x9, 0xf042, 0x1, 0x7f, 0x5, 0x9, 0x6, 0x8, 0x7, 0xfc, 0xffffffff, 0x3, 0x9, 0x7ff, 0x800, 0x80, 0x200, 0xe35c, 0x8, 0xffffffffffff0001, 0x26, 0x3, 0x3e, 0x1, 0x0, 0x200, 0x5, 0x20, 0x0, 0x9, 0x4, @perf_bp={&(0x7f0000000080), 0x8}, 0x4, 0x6, 0x3, 0xa, 0x1780, 0x7ff, 0x6}, 0xffffffffffffffff, 0x8, r4, 0x8) 13:49:00 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000140)='TIPCv2\x00') sendmsg$TIPC_NL_PUBL_GET(r0, &(0x7f0000000240)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x90008}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x70, r1, 0x0, 0x70bd2b, 0x25dfdbfe, {}, [@TIPC_NLA_SOCK={0x14, 0x2, [@TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x6347}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}]}, @TIPC_NLA_MON={0x3c, 0x9, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0xfff}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x44}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x5}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0xbf0e}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x5}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x9}, @TIPC_NLA_MON_REF={0x8}]}, @TIPC_NLA_MEDIA={0xc, 0x5, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}]}]}, 0x70}, 0x1, 0x0, 0x0, 0x800}, 0x1) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='fdinfo/3\x00') getsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r2, 0x84, 0x8, &(0x7f0000000000), &(0x7f0000000040)=0x4) exit(0x0) syz_open_dev$audion(&(0x7f00000000c0)='/dev/audio#\x00', 0xe3a, 0x50040) pread64(r2, 0x0, 0x0, 0x3) 13:49:00 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x48000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:49:00 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0x6000000000000000}) 13:49:00 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) pread64(r1, 0x0, 0x0, 0x0) r2 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x634080, 0x0) getsockopt$inet_mreqn(r2, 0x0, 0x24, &(0x7f0000000100)={@multicast2, @loopback}, &(0x7f0000000140)=0xc) r3 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000001100)={0x0}) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r4}}, 0x0) r5 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) dup2(r5, r1) tkill(r3, 0x15) [ 2542.935878] binder: 376:379 ioctl c0306201 20000600 returned -14 13:49:01 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0x6800000000000000}) 13:49:01 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x4c000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:49:01 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) r1 = syz_open_dev$mouse(&(0x7f0000000080)='/dev/input/mouse#\x00', 0x2, 0x0) getpeername$llc(r1, &(0x7f0000000280)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, &(0x7f00000002c0)=0x10) accept$nfc_llcp(r1, &(0x7f00000001c0), &(0x7f0000000240)=0x60) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r2 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) pread64(r2, 0x0, 0x0, 0x0) r3 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000001100)={0x0}) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r4}}, 0x0) r5 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) r6 = dup2(r5, r2) tkill(r3, 0x15) ioctl$sock_inet6_udp_SIOCOUTQ(r5, 0x5411, &(0x7f0000000300)) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080), 0x78, 0x0, &(0x7f0000000100)="92507b10e3d5312116131c494066f45bf4e585fbda3efd376ebc6f22cfeb74a54267d10725c48e11ed06fbb307a27dcfe9c94a056caa440cd142e4fc989bdc47aefb2c61410999b7c38bf9efc1cedc6bb474963ed599250b6018d17416d9f372edba63a5ce5775916a6880b7d9ace7608cb11e3fa1ddf478"}) [ 2543.122245] binder: 387:391 ioctl c0306201 20000600 returned -14 13:49:01 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x60000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:49:01 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0x6c00000000000000}) 13:49:01 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) pread64(r1, 0x0, 0x0, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000001100)={0x0}) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r3}}, 0x0) r4 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000080)='/dev/snapshot\x00', 0x410000, 0x0) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r4, 0x6, 0x1d, &(0x7f0000000100)={0x3, 0x8000, 0x1ff, 0x3, 0xd32}, 0x14) r5 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) dup2(r5, r1) tkill(r2, 0x13) 13:49:01 executing program 4: signalfd4(0xffffffffffffffff, &(0x7f0000000ff8), 0x8, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000340), 0x10000014c) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x700}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 13:49:01 executing program 1: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-vsock\x00', 0x2, 0x0) clone(0x100002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$tipc(0x1e, 0x2, 0x0) dup2(r2, r0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1e2ba62e) recvfrom(r1, 0x0, 0x0, 0x0, 0x0, 0x0) recvfrom(r2, &(0x7f0000000180)=""/184, 0xfffffffffffffd84, 0x10100, 0x0, 0xfffffffffffffd51) [ 2543.520303] binder_alloc_new_buf_locked: 5 callbacks suppressed [ 2543.520312] binder_alloc: 399: binder_alloc_buf, no vma [ 2543.544500] binder_transaction: 5 callbacks suppressed [ 2543.544517] binder: 399:405 transaction failed 29189/-3, size 0-0 line 3035 [ 2543.592464] binder_send_failed_reply: 5 callbacks suppressed [ 2543.592477] binder: send failed reply for transaction 3770 to 399:405 [ 2543.613635] binder: 399:405 ioctl c0306201 20000600 returned -14 [ 2543.665594] binder_release_work: 20 callbacks suppressed [ 2543.665602] binder: undelivered TRANSACTION_ERROR: 29190 [ 2543.679100] binder_release_work: 5 callbacks suppressed [ 2543.679104] binder: undelivered TRANSACTION_COMPLETE [ 2543.717377] binder: undelivered TRANSACTION_ERROR: 29189 13:49:01 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0x7400000000000000}) 13:49:01 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = dup(r0) r2 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x10000, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x88) r4 = openat$null(0xffffffffffffff9c, &(0x7f0000000140)='/dev/null\x00', 0x0, 0x0) r5 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x0, 0x2) ioctl$UDMABUF_CREATE_LIST(r1, 0x40087543, &(0x7f00000001c0)={0x1, 0x4, [{r2, 0x0, 0xfffffffffffff000, 0xfffffffff0000000}, {r3, 0x0, 0x2000, 0x10000}, {r4, 0x0, 0xfffff000, 0xfffffffff0000000}, {r5}]}) r6 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) pread64(r6, 0x0, 0x0, 0x0) r7 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000001100)={0x0}) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r8}}, 0x0) r9 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) dup2(r9, r6) tkill(r7, 0x15) 13:49:01 executing program 2: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='fdinfo/3\x00') exit(0x0) pread64(r0, 0x0, 0x0, 0x3) 13:49:01 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x68000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) [ 2543.880522] binder_alloc: 417: binder_alloc_buf, no vma [ 2543.906679] binder: 417:419 transaction failed 29189/-3, size 0-0 line 3035 13:49:01 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0x7a00000000000000}) [ 2543.945045] binder: send failed reply for transaction 3773 to 417:419 [ 2543.967572] binder: 417:419 ioctl c0306201 20000600 returned -14 13:49:02 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) pread64(r0, 0x0, 0x0, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000001100)={0x0}) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r3}}, 0x0) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) dup2(r4, r1) tkill(r2, 0x15) 13:49:02 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x6c000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) [ 2544.050656] binder: undelivered TRANSACTION_ERROR: 29190 [ 2544.056918] binder: undelivered TRANSACTION_COMPLETE [ 2544.084531] binder: undelivered TRANSACTION_ERROR: 29189 13:49:02 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0x8aaa030000000000}) [ 2544.140858] binder_alloc: 432: binder_alloc_buf, no vma [ 2544.158574] binder: 432:433 transaction failed 29189/-3, size 0-0 line 3035 13:49:02 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) pread64(r1, 0x0, 0x0, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) r3 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) ioctl$SIOCGETNODEID(r3, 0x89e1, &(0x7f0000000100)={0x3}) ioctl$KDGKBENT(r3, 0x4b46, &(0x7f0000000b40)={0x6, 0xffffffffffffffff, 0x80000000}) clock_gettime(0x0, &(0x7f0000001100)={0x0}) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x8}, {r4}}, 0x0) r5 = getuid() r6 = request_key(&(0x7f0000000140)='trusted\x00', &(0x7f0000000180)={'syz', 0x1}, &(0x7f00000001c0)='eth0\x00', 0xfffffffffffffffa) lstat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) lstat(&(0x7f0000000a00)='./file0\x00', &(0x7f0000000a40)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$netlink(r3, &(0x7f0000000b00)={&(0x7f0000000200)=@proc={0x10, 0x0, 0x25dfdbfb, 0x40000}, 0xc, &(0x7f00000003c0)=[{&(0x7f0000000240)={0x18, 0x18, 0x10, 0x70bd26, 0x25dfdbfd, "", [@typed={0x8, 0x66, @ipv4=@local}]}, 0x18}, {&(0x7f0000000280)={0x104, 0x26, 0x1c, 0x70bd2a, 0x25dfdbff, "", [@generic="fde3ec", @nested={0xc4, 0x5a, [@generic="8f0423c512be7df0cc92cfaf1b329b639e239c2c1541fe5237e0fb9c6806d7b45cacfdbe6a5147e69f3ec76d69c2e577fa3c3bdce44d72a8430ab94b33f2584087fc99ad0a80245b6a530d5f190e25290a5b62dc25884f4bffc140b584d2d7ae1540eb915a83fefe0da6597e1ce24539286b4977ee971c6ae8eb671eff5ffc3826a3a90ad7c474df8646e7be89f8bf3143579dd376f7808ec842ce2d250209a704a6d3c60bcb4dfd8c13aa375523a24f3ea31fbb80317c04664cfa29bd57f6"]}, @generic="b121a4a4213300ec735301539775bae1e2dbbf20f08420e7e2912267c008ee1f8d2227a7967cf331c2bb"]}, 0x104}, {&(0x7f0000004b80)=ANY=[@ANYBLOB="101000002b00010025bd7000fbdbdf253fb0f412d12999ad397149554ac21e49963298d64c0b7ef836f1656c196bab29677cc2d846a9b611e94525ed0a6bc8efce1c6e41ba7a7f4f71161bf1f6ce421e7771798e1bed4118df0376c426144b15f7b16d873939351e079e605c2685042467285fe7469a4ed1456f3524fd41319a49d615cac043c6a7b2de8f8857d7aa7a1286b7c83bf666a2383f061e0af440701cc545f9fa71c60af0822cf58a54b44a70727c3a2070ec5c88201aab23cf00cb700c6dbbc1196e741b1662d0e1b6feb837e1e09411948daabf519b538a1415890c1281d664b50d56df0cad1f36926c9da6c31dca2bacd1bca489bb80a9126989dfd594fb47e955847e49cea01bd22c32bfeddcf3d6c5549f85ba6af772b01102f3aa3599b3b69162d6e99bcc80be3e310154c6615dbf8e87d8b83da62a8084d3cc6a638cad13f9cfa7ef7e811a68c0addc3925713e9e6756a223dc9150920b5c4136007eb2e0000096cfd00993d62f7eb05a4f9023664e761c5ad54158c3ed0afb1c850ce404049f182c0e74eb6aaaf47fc1d152059d27141a5a219941a30a9dd3520db361e901e7c694aa5a2c690e4f9546cfa15bd6964f5a3c81ee353fd987211f88bd25b2ca705b872dc004a1ebe211a935d9053907069185fe4e37ffb55eb56f08843d1c6b511f9ed8e13a499d0d483d55d974372c05d66dd5efee63b786a74dc8c49df1b89d0aa116ce2be0678c2b2e14371b0369860083af1b9b45908428c8ea06a4f86af8c1b8bb576bc5b164996865177b8f76b1525a0a83af12e0a6f20942e5ee7fe7351d54ac6f69e69d041771c264711b26f84c39c363ee43de673b2b7c3e4513a5f6925434f7630c774a0d3549d2a84b8e3971df251acbb11fc6b149319b9ca15f856882c6efac03ec5587bef4cbb69b15eee43e1918dfb45a7910ed028bcc85ed992b354c186884c2820e4de128a1a301e0ea3d58d16e787f060003cd09db90f49eedba98a8733a6440af8106ce57738410df90ab2b01363b35b92773f61ccbe0b9e5200e5626e27ac8e46c38437ba4bea49125bde2d67bbab9d28e374f4a3b421c8802636044a2ae28f82388e9348a4e40bd244c399d2bacd89998ead6518978849d625390d199fec765095cfc9a31a2294a5c0b466b804fbd771a3fc9cd89e556beff79401533af87690fd46d92c03c8bbfd8d55582d26f7cdaab6d0a4ec79fa4411adadf351b769e54171e530399b32ab0fd4ba6a7750e6af543cffd8839ae64230caca6d80ae3201b77aa8f5a2a28373ea529f16f30d6b8c0eb4ba2dfaf6abddd63bf3481a06137b2365e412934db8fbc07c69cab74e003b90fcb9309a2a398b0ba46eba79ef730614f93f070290711f9c3fbf06c6145605d348dead35c139d3cee059795ac2abbf68a79799343dffa1406ba4ffa317f4d1bf1209a2c7c8b85383c80ea4ce4ca4fffa2309326e18a9c580af0999f1d2ad04781e1ad9bfffba9c8ebe551da890ebd81cf71ef0f58900a0a9cb18a9087f7b3376d8d9a180683c2c8223e458f088d98faccf3b401f98ebcc393ef67a4cdb957d432d4715f4a5d462dd5a70036e95f9babefe3880db74e9f27f0367524c69f9e663f1dc34b6d9274e26c54b66c58daa7d35b5a4a8cffea00be2d905bb8b9b0d52a5d5c990f4260458cea1492d80c35ee2a8350bdbd05a7b6f7a1c6ae785f079c622f74a454cf2a6de4f1fe2aa922bfee3902e173df97dc1477d6d5129dc665a87993eb2f91cfaf6f93bfb2a8f458b6cc1e51004385e94af7db5606e44bf0263ba8f91646fe81dd0a30601f23d4bdb38d9bfc1ac23d2e5d75c3900def62cbebca52cdab0b231b807757f1b364d3035eda514d4f39211f10db3a7317e78816bec7e5f4c58dbbf012752b18f3d76d0a50db1f70b1083ed7aa15e8860514c14ac26027321c3def441616bf26f3330a52f5b27b5d1b08fcad8b1b6a7a0f452be2c1f83395c53412863ceb027a81080e238e04a7c33cb8f5ed97dcd1edb2bf36bb1551c2132528d37255a800386ea58f68401ae4fecbef594bcd201e614096644789109a978d9e845ca9e9d1d180fcc9eefe5cb38182783d08f9db6b2f97a59fb88db43108ff6aac8dfcff21237dad1d80e780202422455aba07ed15bdb121d8cb1077b76af4dff3f0a6285a9a8b8785ad27d871073a3f7ada119a12f7fdca97b5c06c9d668f2464e1c60e300a7cb58d5afb4c1ae6bd1c352b2c793a52e21fc51864bb0ede38229534bc4dc93f0bad94b3d1b5515e3015f519664e91c301c96e59d19beb267ce668ee08ec586bcd400ade85ca5de352687051f98b99c20257c5431f79e06f21b0bf935034223c335c0bb708f857530750cceacf39a043c7a585d48da2904688b405118f06d6c672355e55be78b05fff0f3342c7c454101eb5c72621612f193cef9f127248c0154cb9702b39b691fbf5c6617680c4e234ff7d209b55d2fcd1d90746a5c2688d659bd144cde5cf7cdc47bfe604fe796060108b528c6a978dbb2db17f3667cd5512de7cbd3187baff93d82a4f892e0eb93bfa0728b1e49aa69ec9204903e78d498a07e5ab8e0fa548f58b1021a7ed56a3f96f7fda6fbc41f53ee5051d197bf30274df05164febe49bc039edfbd6777ce5830d0f21bd0ce02c97a4cf24569dbaee7aae67a46cdaaea61b879b093cabbb7af368e802480de24021736057d31ce456ec8fae62e95e9ff13760d4149397ae0e738a82962cd619d391c71e3754008d0185378d3341c49f17bc5f7b8b721ce0e1f636233d9d2c698e98e60423f58c8a257b433af3b76a3778ee403022a96467fb3b7368c26dd9c4d2fb75050b8d5842bc16cac4b2322192beff4c5b0f55c8516d3528d88a39bb7dac4dcaf97e1dc014ca227435b426ffc0408ef39c560e9ea8e73a10aa6b177c55da1ef518c1b4d1b71e53d287a6ac0e8e83786f491d12f2e5e9fd0c8a5de8970881b32422b6c05f7a0bd4026fe987fcb840176162b33a9963742399024b7009f2d2b07eea0ed4a288f39ded01ee14aeb20886322f57a903c5935f81e8a71f47eb48b8128566a1f16b28175af80d6629d3f1702bef15e52d173171d34dca98148b192c8a43f3daacfb691d52c2a52b6193669cd1d2cbcb07d24253e3a6e704dcb0c693a2c769935f744baf364102c2678a4ce00056551d81254c27d3087e13304ba79a9f00c472de87a42e987e1fca653018d94b41efdbc7f98584bb50993fd4b2d947b3516d9f006afa215a5b9f17df6a872d48b26bddab5dfe3b46e11424e8d83b5bd5882fda7d7d92aec9575ebd34f381d5a5cd0d50d0e4578f4278b3eb1dd1f323fc7f0a5f5d7fb6eedf7b804a85cf505743b813e5c9720a26b43abfdb1b6055fc541e8a736ec8e0981a08ee75529f5733d22b0986aadacd733ce25bc3eda515b2d2af5550d2a77c333e364d4f9b452d77b6c48fe1d3c8342c54f8946597963467c9a71f11d676480991d9308c1076ea9cb67caf4c521986196a56917e762c7480b20c8d2b0a6cf5296886f64cf1bb8813c2b382cb4e2fab04154fd967b49838890fa5a7abc040582a7101d812dcd635f1dcb32283076eb3935b21ecfb2fb12eabf6e338c1dff78396ef68c87ebd12ee915edfec6e38c33ec4897f3d954d03a7245ab24103c3af80f3c8d006906823cbf2c60d011e1aad9f3c1331529a319cb5eeae69a009c6d5f0e4e78535cab6e18326458e3e09abb98f0bb731e8b5735d598a12c06461afc3f127e6c804e14f51147bfb145f18670a1fef37c3ef2885fd0b6eb02806277bc39c8244f400af96754bc2c16133cdc01bc48e2624204b5c25a3160ebf464205f67ef48bce0469670680bc6382e83673392983a2f44d532613c15aa5a94e60ca3d275abbf3492f6c781a892e6415145d3ac39f2d2e1955ced962a75aaefc3bded3954df68077f1c2aca59fb3e29618d7b0563e57893249e629a1cd0568cc4e0e4a618d40578a0a4df1575a0c894ad592b2c24f9ec2ab1c6263f9f36e0ea57f11002dd223fdcbedcc8f056a8be4ff220419059d74ed1d2e6370a1df2312b49bbd1b71121b9ad58132afbb7f53df81795508c5cbace10bba86067bc3faf86785bdfd262e675648c81ffa8ba23d7e9d10beadff3709fbededba8badea042aeedc96f9b9e8469681241c07d3b13bbe79d70bd252defbf8e01e8189984742cbc0904d760aa40aa66ea51aac7ce6ce22a40fb4101d322e4aaa20c9bc02d4dbeef657ff54d2448b9169a0f37d469486ae30f93b98b0643c17b637d4822aed3883b5e7bcd96e02d67a7eb49afb50196ce98fd00312ffe9458ae50f88f7136e47d2f46c8e1fb9e717881643bfd0c6584ab5b41e679464cce4d1d50136c17209669ab4544188dc2bd5940e9cd7ea76bca7f1d9f3aebd054222fc657f850518150f3390bf635d43779f4c00fa0599627e924596bc0971afcd3308950532605ab1638ca06171d99eb534755fc8cd7498d9a2e766a048fcc1b0aea5ec96ccc71ee5547f8160c03fa1c708108b5511867e74f7054809893636cd199930b2c0d1f5821adbc73fadfbb73a6330c2960005b0ded681d56c4adc82c1d6f35be20373378fa7338454d2a53804fa332cf971dd38fee83a065d621e4309077abaef9dffebf7bc8dd6abbcd71af5583dc74dac1f45ec4f6c51750381689426f6c6dada3e115fd9b22b94c782078ab84af34d1508b377f12f0968a6b8a25cdb65dc3c57802a6c0299157f5c8fee20bf2d014279514aa16e7baf128f0527095aefe9dc763a92d16aa32cb8c6440afbc29aee272b2aa5cbf8a64b6770b99b9b00d295e623a76667e75e94a4076bffef24be12e3f68aba673bad61331433283d77e091c22cc76807e7486678a075cee4ad7992b825d232aaca53a1867ac5dd16b4263feec5b365a286aca00624fb485168ef1a63617c5149619c551d4772c7631b6eeb489d7bc8aad63d069269700bea181ebc7bdc8e16750d45434301d1dd42ffe721e7851ec73c29d7169d571c078aa0889fd6f671b027b53664e17e0fb515ee385b48d7456787b70ffc9eec0d25733b959ce0875724df817ec2e0a5e4b536d5626abd0a18dd8e65e78708bc78fc2dee4505cfb99d15b11b329350170cf32b387664d5c4a43f832523626becfd07fd84d8a484d7c753febaf97330cac62d5085a8a9761e3f98ec9eec13da8729a0b223171655b6eaffb11d9c7dfb396c37e3c1f9bf49a468932101f002a2bbf05ffed1857d68aca3830ff9c13c1535a6b8f0e113f817be3ee742de5a1304e3be3c7c62b52045872732f7e81c69aa77d4c87c59fef44dc4bc2eb5d501fec6f6e627fbd97b37b8bd35546b923dde4f8e2a20b98f04b58843fb736af48fa50482a398e6538b3d326d0492bf4272e09fd38ee92124d13b5fa8ecf3cb037d7511dd35491946b1cf5c4e87233d088d7c477b6fcffb6697779f54bee6cb1305d29486dee8b069025cdb9b4316c6c86c44e926008104a8a835a3cfa495d23ef1de502731024c68ffc311f509908eef769965ec55922df34ab27ec2e9262db1e68e3ab3d150e69a79f6bf7ed2b6891ca754b9922a867c1700536dd6e156024b321bd98a288cf710c23c399bef09019cb00291a7e2f9b9eebb62f3a23f74edb3267a03593fa17a8bcf3b2441630adfe82ac283bd7e593d4ff89b44ecee8f19557cc1711576c3ec3b6c7f236962363512fa1f239edb6a3d637f263d3cb3f8b57fc55d0fce3222bddb5a76a63ebe951620c960b94d0c927902e6d2a6196ce378059a1cdf51113e349cdcf9355468589a000000"], 0x1010}, {&(0x7f0000000480)={0x4ac, 0x12, 0x2, 0x70bd2d, 0x25dfdbfd, "", [@typed={0x4, 0x70}, @generic="147fcb4a08a3d35c5fdd47f184c4489b575c91489eec15857312c8cdc3902a39d5e7c8a8ab73c7331f690726", @generic="00d75b601b71a3af11318f5774c11dcf0c0beb937134de8333e67d53c46d759800dddb732e25ff1cee8fafe07e9292403abaf63d2fe626", @nested={0x294, 0xadc, [@generic="5e317d54654e522eeca0acb5d377fbdd4d5985e6fbb586546aa0255965d9f0025a1ef52459d3ea07023636fef00dea257d4ef1e22b397b1942b88499d19af9de06dc1c032cd7012a18c98e36d68df0d96399394f058cf8580aaf0b56661e91a3aba072e0beeab8a22c82c436595faf10d83fe9ecd0ab564fa2d42884b65acb77ff4a7373d5be56e58c23c2b27e7edc29ef4faff3c8a72718084bcfc77db4b092a9f68da2532096227a9a9ad51a", @typed={0x14, 0x3a, @ipv6=@dev={0xfe, 0x80, [], 0xe}}, @typed={0x8, 0x5e, @str='*&\x00'}, @generic="c09fb1a0bed263122eab65e9cabcc431878d0a6e6962a5be65084421ddd3c845100323e123ef1574610a161a6d2aa019f4c42c1a646c4f21b4967333da497da7d3243385eeebdfd1ac012469446a48223450765e6c3dd65cf781d3fb140cb0864c75297bf0e95c78f36729c6f8d9c01d507bdf2322a0ae5b55577837432c159e71c4f0ba321e0bf747a3669d4fd4a630f163787b7412428c7819b1c7497cdd1e2269dedf6936bcecd8240c20a7720ba9ab06ccf5e093be9bd7242b304d5605edd8a4288ca58fa52a8319f8094060ee276583214e5db327623b38552b0e7ebe9dc0f8ad547415a9f600eb164e2b2952778e5ee92db0c432", @typed={0x8, 0x28, @ipv4=@dev={0xac, 0x14, 0x14, 0x11}}, @typed={0x4, 0x46}, @typed={0x8, 0x83, @uid=r5}, @generic="43d81b0ceea064f37ee6eaeb89cf62dda880731e40b62ed81acb208c36d50fff32e626cba89c664db4de10c6f722c96305937f782eb2e0e023122be98d913cf24b8630b37aa69ef0c0076c67abd610b3bdbdeeb9ed1b0e0677b4562fccee9bb2a502b6a9b4989263f1a0b09067e7f182f324f0c02336cf5bb746ce18a1cd771c7d7a73cfbc6ed5b0082a6c15166726cad6fda25a11899e4525c448847979655894b52a084c5083ddee03bcf11bdb66331a5d7c914390667a20bd"]}, @generic="b41946f3dfe3f59eef3da85562243018ab6e09a511c4563717f9fdcedd00bd55357b8dc3c96efca56387bb686d665986e03d866d7b82534dc8e9f0c33bdd6a4cb2442ae600377f397da2a1a4ef5984368c23834a381c293b53", @nested={0x78, 0x46, [@typed={0x14, 0x1d, @ipv6=@empty}, @typed={0x8, 0x7c, @fd=r3}, @typed={0x8, 0x8b, @u32=0x9}, @typed={0x4, 0x29}, @typed={0x14, 0x8f, @ipv6=@loopback}, @generic="02caa3ceba9b1c0f5049193691f23240658724259e7c46b99e84178e342b6b5804ac2da43a55772a6e9d507687db6df4222632a65c"]}, @nested={0xac, 0x8, [@generic="efc004e86a2527d4bab00ded6e3561eff4a1debdef1026d3add681fbcc66eac157de983901e29c40925fa5a62d727b0e601234428d66d597472db1316bc942c1a4049ad3e05114d052b2eff9bb52ab515f6091f90ce82c0bc1a06685c3b43bf04f73e58a3b1d74147f633c2c46fef81a63995143ce99e082246e618647528ecb69f15ba45362fa2e9ed9ddeb793f8d7ce2e8e022e901be4fdd30dae26edb1561b6fc0be469950e"]}, @nested={0x14, 0x6e, [@typed={0x8, 0x75, @pid=r2}, @typed={0x8, 0x1, @ipv4=@rand_addr=0x8}]}, @generic="90ab1b4236", @typed={0x8, 0x401, @u32=0x8}]}, 0x4ac}, {&(0x7f0000002180)={0x1200, 0x3f, 0x801, 0x70bd25, 0x25dfdbff, "", [@generic="59c0da7abd66b7a206c7c5e095516f24d602a8c7d2c6421e023545789dacb1dacf5ab8bd0dd274639b482b178a7f4959f58da06e44d00c43f56887e7694c1f4c5ab66c6507dcf7460cd6883f621d8314e84f5f261f1cf8c8531ab6110c01b6e3ef37ba085f4632ca363ba170c5be825c7a08e9273532b8bd5f4b8c9947f219fa89de88f16848d991ddc648e44f4f39a8ca3f44bc58b32e2f37c50525f2da75311cd93878a4bd1750d43b57a49fa0db00c3c21f38cb", @generic="ea897fa8e2387d97a9ac23c9ad7bbf82826e2211ad882de6c31c48f187cf29b2a3c1806b5bc3668478f53db829ae4ec4b0ca74b8a9976e62651b3465049ddc8b33182a52991122f0127e80e571b07d9e3feb44a3c273d1cfd169102393f4f7aad4462c4c05bbf0eb6b90a02dde60fb6d895b3af2a542e60752f9c9550e845a50d0906a514930db48ccd6a7d26e086b41159c5848eb51b744742e711c72f44b2da8fbcb2a1e200c933abbfc35a81ae95eb2147294aa4603997f2fc91aad0574a446449cb4a4084ce832114f17d9679e820021f090341ad2", @generic="303ae061032c3c2e26a876495b22d4d500e423de76e26a2814790a7c1593a530599bb4d1031649ef9ef0f6e36f74e046e68d9952df9366b5f37104878ce092d74bfda699f5ff0fff510bf1cf722ea412f978cc6a3e05c70478", @typed={0x8, 0x7f, @u32=0x40100000000}, @generic="cf0cfe52afaf7ca0348b776983c031698282a8b072721863c990b1a53b138ef278617aecac479379d32503533b71e5f0d8b031154fd2326e1de279d4d650cbbc75b29abb6fbe24127487ca2f4593e4e3820e56f3737ff328b92283eebafc5f1f0610054ea92f832a9652f46ddc607c8e44e296e383cefcea39ec94f88d10405c21d3f337edd7ed22690fec725b2633ee614175d38094e7e6aa93ea880859dd54672c217bbf3817d8a81002c56e89c5f95e447133fc20011ba6cafd213a217ac16005cb6039b8e2e69b3951eb5f64ae783fe97cc96e1cc0520f3edff24f3a631d8115be1ac9b345802ad2c558e4a15a2b773c6de9cf522cfa9976cbcd2a6a57ed7049d5cb823e806891d922d1561a5beb7392cf1d8b7a46bc781e14f61265f8af002c2fcc7920eed8e54cfed3b6e89bbbd93b7ec2de3317bd2b76e683bf97344b7450a66ece79808032cdaded8d80e8391fdacece21735c009ea8a0f481dfa407d3948dd6d8e43070c7f80dc8917c6f30efd87916723d237ad46b9821bae11b6c79af733711612ff757c247ceeb3253276373ccbd8dfb5b47723aa056c3a5570f362d181da5ee9c5327c03042d1f4ab9498db5b9298322d6205500bcdf08ca9d18d99ff6e69a43aeb7959de6fb5e4677e5ae035957ae7be578be27dee9f046dfa6172fbcce047835fd41060cf8284553688906fee55aa1549ac6700eb015aebb64e4c126ecef230a2dd049fdf4634e76d81167a2f67360f837edbc9c1c14dfdcb5f54d9b5ab24cc2550ded4086816ec858f92037aca20b9e3d7f54b50dea8b70ee97d4d783baa9e56c3f27b5e0037d66147075a40321fb98567ac7f28a89df3b7461d2d7d7d9d14908b151223b4b34827897c44ff49f148f900799d49db1f6fe89269c4255d05b6f69fd7bfd4929fd1f31dabc5c30943d04cdad1971e1fb6eec8d9fd2e3c7bb10dd0ce3c69e6eaa888d91d8d218b9d99175575abaeea3f3013b2a59e2a05c21b5cc4b5fabde72e6c1bedb4237c823d658e74d70e526b80f64089514e18226c670927677754d914d3f3ce3cd6457b60c82d2ef3be9968295fd8bd63a90c2e276c83bd59af2c6e75c75349fabf800e8ed00dd76dda25d901c1f547724c76b4e84a1daabdd0c6282670c63db4dc1e47d26c77dc642fd02443cc346e9a4dadcd2e0fa0e4b69c4e2ff239d32f4a57671ccb67a437cd8ebfa5c9582447ab1dd3dc7eb2874b5f8a7dd5420488674a153bb8f8c45a8cafa00c2489ad624953b849be1f38c92e45ff4d543177db4823102ca35975c3e16d865b7f6bc6eb4644c41a943c8ac3021a87be259e07f00ea2a8cc50afd8b2ab786f31ebc58faf5c6daa63fa70cd09df4e83733f67af60038a1fb49c42e595302f4e1b77c849d9959d285a8de46c5ce6361edc3e9ed31da4fc1e0ba51dc7ae7c6207ce187e6ce229fc54f4eb6afc1b54ee23016a5cd4f47198be3ca46054cf890e657d1dfb1e99e0e2fa2ee9b2c9bb87314c4adbbe693f5028a8e2f09ba6a1a88d3bbe662d936b27afb0a8ff8e56cb4bedc5ff53a89802bcfe0a3c027843594c4bb7884f89ddf0217c5cc6350efc0a823c6c6e06dab1c5a55d264c3a138d360526284c3f2240cfe8bc23cbe7ddc5eaaa6a84a8753b7533f1db573313ded91ca023904f2cfce985c5c67189674df7cb86d3e9e55bb64228334e9f044cb3f60f2baf99af66c292be362bcf264aedc4683ec18a93e69e0db639d8b2aaadebb8c60a58eccc4f5fd797f36c4f4412a2f8dc3507ee22ad179a3df74063ec63d1b5b937b7ce3cfcf58d9bf7a22b5a87572b977db9cbedb9c0074600b71de09184815290009c0e419b7086990fc3c4febfbd188484cb4cab89170b4e045f7d6b4f413d929684b8cbd1fff2919e40ca4e57a5ce0820e115d3392062a7fef42c09c7bc85be0a862d28b2805565650b38636efc01b2fc7825fd17dd26eae1fc6b54051cd3775c61456fc7d0f938f2d3da34843138f4d6ed5172afe87d84c5da6b9e5354a24fd93ba8eb416fe3cd3f892562227ebdd23d72c04265d019d01d2d8d54cff22f9814938eaeb4da8ad450217c83ff3a426fb62d6ff26b4bfa094c67881e0e475018deceaf1c9401560af12270cae6b4e60b09a640fdc73b20ba0398f29e8765d94abb626e8e7402e182bb5af729ed94b8d3be76f3da03e59b3e9f6e7b0a5f09d610eceab7b3486f64b3aa1b17505e8e61a01474dc75f0fb7311b8c46006e455ed48d29f4315f563aca9765eec62d8ab2774b172c2569eeea3eeafa9e5e81606213010eff9943f1c4a5ffcf2e09605e31173e10cf18afda7f2ee24a1af99b73e860f177996211cb0be09e510e61e1ec1a405c3a73c03d9072021e0d4c476db26d9c52f94547f051a102d346ed9faf41f9f8f14d98e5184432be2d77b8b9ea57bcb0989c5c14a1f55f2952ce3639c50d9756b04829969607980e7fa9d5c901036406898026c91333a34b62c184e65e4f8f1bb9c8743ea92c7f2326225354fa302540a9c59d23de64c00e62b8c00409653ecad33a0be24d09d353021c0a7aa1ffdc0676d6eddb66dc21cc70ec5b868cec847989b7fd156c0ffa83d6655c803092498ba8de0c33c4d87eee060fdd602fec08af537f54d5ab0325aed0c62c2be1791e2df42ed6fb8e43ae545190a303d13ae83dafcfda8b99b851c027ddc83641858731110ef4d8cfa844101b1e89f6f56d0c20adb6425203927fec268627c355f5c543a897b720d02cb99be61ab231c1ba92ffaa645678da068c20e226077a1b679ddaa16410140d2daa991ed10dffa9aa72ec782afc3d9274640d492973869b92451d2cd4af2613959b273bbd5d1e1c1492a1756e9741c7ab1bff99198b6a1b98647cbf64573845a769532bc888758cd61d4917c5c9b370eff1c1d14b9e1cf33c6eb0040c24f72ff5a7185519d43a6e5626d7695dc61480267cb692e96e4c7b01fe026664a9c6557170a9a5fd71fafb7f030a260cdde8a776d42f279539c5e68d80b4558a583c25d92b41647038cb052cf64a15536c8729d807885b495149046eabe6fc5b3b0f0280039c71d942de1f379f88885ed653d886e95f9c611ee84c4441895a91e7a1a83e5d1752055c554e187d005ad4cd211fca6b94967479339223dda3fe9a0d9a7aaebc7be0102f77d84c8edbfb608cbffe8c4c8cd329daa973820b7464118d1df89e64f25e478b5562a5e291579094ecb69597a93477f4bad079a0f5aabaa697a378bdef4686a92aac059165ba48496f8c785586dad47262dd3986b5e573ea7bb8d00954900785631a9a831f083da2bafec80426c22ad2d54dc26cb0578016e9483361ef8817cfbc8bfa2da7caea9352e2d4a4a6cc09426c3b10cfbccfb320bc5d777546e7f799433b155853ee516c9535f92c2d6d7eeaeacad1337d21032ed3635ba47874b6dfde3588e825aef970971efd13da01ce59737068b3385684929b3c4774ef6f79c14ed444f394f8af7792b4cded2ddd8e213dce5c46713f21c04b64be2ecd3539884a7e7a518d63c9159752dc6ed449b84670fd5f8d9fdaf0394c68329c67ab6d20c0067fb2a92ab66380a0788a8b78860ae15b37e98b390ec1751970317dc3f6b9c67563694b69f133809e2f9990054df0b49249e042c9da6c569d27017467d8c41c0d40260ee0d1b17ce02cdd527e138e11055fa7afe3b763c64089ff3fd41f48eef9e073d21efec1ee8454230af90381eb54f076dd0c2222d8fa4c27c06f447ecf424869d782997691ac5f49568286049c7f99d55c6003589c9aed11813741b95930e1b89ccae717bef9d0023761d2f34ae0238b5e9a48cfc6189f96c9c773c944f27362d935347d4a0200769c84994fb7dc54f9491f50eb9d6bd01f51ae1649266ab4a65bd4abb8fa236c467a0686828cb91a615de8aed818275668d0ad9c8665a89ce805feb15411c3419238c8ca557d1458091d4b12581bcefd9fdc90c4eb48f9d8483460063fd14f7504c7f23d2a4bea531767d5678bae2f4aab89b024c5c8f11115eba3569a5ad2d9b3e49e427237ae18c48a207defaa1b552f3b9a0978f0c6e7f0ff4088942a6bd83333b7d8da19689ad62e8cb586755732336981922e3df0f65631254581af515fd2f2a4e1a75c08d90e4f5b6d053f71b5a3d95e07e92f2702a8ed9a12be47649f03d3bc1a27072b9d92001cd1c06fe25bcf9a5f319f8f450dcb46492daba2aabd4662c319eff465b230329c65f0cab187575e942dec7add24b8e7aa8be6219697fd7cc098f104079e21d75f037f1c45c7e4bb20d664b805914000575945e7154b207aaf071006ce6bc54e9a814c80694830f1a29a1929c207ed01bcc2b51cd9bc2b6d5ac202a9a5404987662051a49f6e324a018a77a8c64be08b20fafede8a8e1ef541f6a5b3287eb0f0dbec92f29d6f415f41cf1288b750c1ef40840e902295d0a7c194eac428a0632a0e020dad9a9d56072a619f5f8cd1e6401fc03624a4f0d248b78256b077e139200b919c2ec662c44adb68fdb4ac2ed7ef210ce9f55c5f0821fcec28ee8edea29c950dd8fed153cee7f3050910e79f7fa10eeec044b40556b89dd11ce48fcbead7686c06a5fec27da5a741d9224ccf99b2cc02f79d19fadde9d4a8ba5c14a28118eaf328710ea81934be89e221e5c03afcbe76b268fc580f468e242154eb90ffda59172f5e86bc04e7ee685c027a21450a7307cb5e90dfd4c59af241e58ebb510c52a86010ecf90dc98393f86d6e5bac1e232f2a7500d5d848d0841720b32799c92a09132634e36ecc81d86c5e400084afb22ffe66442f980a29974c26e0b06e1d01989fcd9db262717cbcede49c70e4d3303dd34d22af55583454ad89b29439cba7ab7e657f408a827d7d5b57d19dccec7695fc7ef88a57628d5da09bdd60b8f86d10b6f54a7b9a922b65ecefc67fddf325292834d7148776c0dd1e61abcdbdfc6685642786f77ee85acc0f1deae5fd101cfa0b67f5c1c512975e9de1fb5b1ee52fd1327942cdd43be1cdc7e16ebd802b2b994a8d10128bc55ed5811dcf77c047ce7ed694c4bbf25e782db36652a6d73907f4c9ca1bcd1ec801de6cb1c4ba53d16073c28cd5e82e78e3777d1f1a37a2fb9848c9f6b8ea65de5274a80ffb90230b11a23b604cf591092f454c1cc20337f1127fe03861556e1dc391df3aba154f1f30fea057ae75114aa432c10e2eddb22adfb6b57979b92fcd437f569324e5f85b0381e272bb64e956d2bbfd73c5931f6ab6a689f8f39e35cc89133073d6829ea8c9199889de49e999319fd667fcaf5ff98c6ba0e98b2b136c37163a159039a9ebf522d6b2d23d1bb1e8602cab43920dddccacba09286940266ab18c76ff140608a1b918d1caca1c908b85134a10d34a3ff209d69ec85aefd1281aac56c0015a152904981be0df0a7eca57e678ad3f28df369ec39aaa1b64903f950233323d7e4fa50e9ab88c8972c609daf0b9815e6d2fe46800dc87b3c20311add381c19b508dfec0c9c8aec22f245844a68dc0268ce171c40b27c84c3c2f3d509a27adc1dd810831de76e4664d5c861fa4495c0f2fc2170c4d4127833abc3ce6284fc97fea14c33fc7a2728782a3513bdcc4fec0f41b7a2df6e34893bdc9eae9ecb09b5f5c4963c9ccbeec625ac7a4f56180745b3240c8b78fdca9765403307dc6b7286abc51922c393eabfdac801924fad686751cda29d87ff9522785400695e9df3f7d5db5893b022959a2fbbda3b6095e14cbf08cae9e28116c122c99ee3c20f0aad9cba740b90f110a62ed1b3"]}, 0x1200}, {&(0x7f0000003380)={0x17f4, 0x30, 0x800, 0x70bd2a, 0x25dfdbfc, "", [@typed={0x8, 0x2a, @ipv4}, @typed={0x8, 0x1f, @pid=r2}, @nested={0x190, 0x2c, [@typed={0x8, 0x2e, @uid=r5}, @typed={0x4, 0x54}, @generic="20bea34033e4f2ae2d168f3bfe09035d9992329560c2e23aa0532876c7b725d8d36708cd855d528093bd85511dc05bda59e33e8d99cdd0f2706aeb3d3507eb953f23e144a701e6974202b95b36a734f790f3e51cab0f835f17be584e", @generic="847a5b2e7cbbaefff7fb82fbc7ed0105c0c4b2b6e4b8e67fbf409af625ed8145c132405b78f7f74c0d429dfe0b364b9a63718066b45bb5e39c4942d9ffad35812e1928a4c2dcf2421712a9abc6089f9a215041bac4c2a4e3b78840d245448f83c1ea3deb3d24f6e70e8b5b2012f27ff546292315a96e2379f47e1ddcf5ec03596d7b5a9ae8a3d17ce7d306f439966ef80cf554eb8e5a961d5e0620fa53e6fb4ea23e312eb484ada594f23f92a5cd4aff4208a9873a6d9482a2bac52c760efc50", @generic="0e6eb692dcbf73bd6ddd7ea7a431755d542bc0cbe29ce870c0ee2034dd9c8dd568024f8da2da95eb470915458a087cae6a45196f63e0dcd8c3ac575817f9cba36c19c76fdee6e4135657eff58dbcfea183a7a7f1c1bdc34b6f0a08a4a3e52ef93c"]}, @generic="951e8a4a50ece983bee28c200680247146a32549e3b12f42d713613c17cbf48ebdbf08bcc885c4c65744c103e87e8bdd8492c47a11fc94aa3c2121e6643218c30d41557c38a8209c2334e37fd81af8ff3147a46ca7df1b", @generic="c83fe538730c063c0389cb79af600ee95f8c00c9b95742cc8f0070d4818a530ca3e85b71eb0e55aaf82a87ae0cdc45fa07e753bef07a7090c3c3d1877f82e506ab104ea1fb10dffe717b0e30aedf0fbe99a508cd69f2a176b397b28945411b390f140ffea3a06978c349c9c8d3d53963298a1112ae945bae4963d497b76ea2abc61fef9d290b1e91f76c14c1b65ab6b18cfe39ccdba9aa7f390c891e0e15ce6024076f0805f971557b499c8ccb647ffdc96d86d6be914a0688768785f3d418fe056d64ad820a0889a6dfa51a58643a68064658c3da78eed4", @nested={0x274, 0x18, [@typed={0x104, 0x51, @binary="996a01d4d7ca1d1998824ddc4ba12529655d55743ef8cf12450c74e5a277dd2bb521da582ef340ed56a8507edd8978ae308f2712034fddbcfc6e55753bc678741baca44e5dac1e15cec6deebcb6fcb3e8f9d3038f32478b5d888fcebe4d6c40674c90e2ac1b9bcc574045e1c4d70fb33074c8a19348dab9fe6da747ca7d049f83d4d118dfaa26994c1ff6f98be9cb0c422787895573f96c053294deedb09a2e1b6b0aa544e5a5c32abaed85623e223be06df21139a6cef5fb8691d3ca7e908c5b34643bd79332fd3e7955ac53b37bdc1a8000cd2316fd663616cdff1d07f9dcb7edd95ac6fb27e1ce6ebe5616a8bfc72705d060b73601f32b85ed2e8d4"}, @generic="6c414a7222972794ee4898cb84ca4aa2a17e99fa10c88b74aeb60d972c378aa9e848ea757abf1c4159e931bec953a72003c8821770f9e7cfab16b00d46634e3e0674512bfa82daba418e32cf87375b22b13dcd8ab290c5e1220f1b5a23748f6861c381b010", @typed={0x8, 0x76, @u32=0x7fffffff}, @typed={0xc, 0x7b, @u64}, @generic="ac171afe4702e2b36a75ec7c51d34c4af1fae96b8e78e96bf8991f6ca98c0a1d7f5fe816301030e4ec11bf638824c7bd5cbaa2ef566c11aa1f5465539102cdc479c71b68d6e2002f1db4ee302e4ae1ed5558cd77d6d03d5f59a38f040b92fa0c2997e4441d6abe10b543c567360b6d29a4b49b0ddc8a3b77e251752b42572921e90444403bc9dc3897df72f3c60e33cc6652e12b9d200543c3e1681195af219e470681e7861dbeb43f841eb22b5fc2e64d58da2742274ae2901163e4ac0b5a6bcfc86f33d45fbe80941117b742d38ad81441ab9dae658fc1a3f2118535f48cb212a455cfaa5e646feb67fc489df5c6b6"]}, @nested={0x1298, 0x88, [@generic="70efa7a34aa5bf4150e783711c2fe6715f7550eb6903b067f7ba43713729a53c64f06d80f1984fa708815c3ec856c309eaab392a3a55738461cb08992cd0d0e88469fcedd5e71e745fb4cb716fc66dc46187994f58ddad55c608bdbc75abc48437296c98f37b50fa370b98cfadf717403fc82e0b73a181d67a0471940cfe914c6849edbc187df20ff83f883813ce063398e948364b348471349ff433f9743fc87ab97a55778adf8511ff84b55f09ff1925d23daf2e717975584ae8899ea60f03bb7da93d5793bd0b594428132f43fa9d5f561c68607742298f668dbe916869c9", @typed={0x14, 0x51, @ipv6=@empty}, @typed={0xb0, 0x24, @binary="236ce04359157207189e86f2863db02cb27fc521794cb519cf228890f370256115b92820929922297649bf9e7cc53c95fd3241b2fbd1a307b0dd9787a1ab4d7b4adf6de9a36c5a22793798530cfcaceb6680a2d8b228c6956394d906d9497e23f617a128807c7957ae34e4bdc98afb70f7ac9cc9eb7026ea9741d60b75b689ed64bc89aff504c8461784e9ccd24c8bd28a98068b3555801ebef4d48c10aa19d320e2656450325868345ac49a"}, @typed={0x8, 0x56, @str='\x00'}, @generic="f7c59a67abcf58565ce13ce40e03980325b8cd4ad9c556bd93c309f83ee16c773ac7ebd2e10c2ecbe7e37fa0f680b926dfb7803e5265bc82645942c55670da5c9020517b7b262d6176f238e07209f639510b4a75bb2c2e0af3fe020d54f625cacae6b46c8b0907d9c1ed6c5bdcc67c", @typed={0x8, 0x2a, @fd=r3}, @generic="d97e409be1a742bd75951935128b1353bdf1d11a8acb4d1358c11ec2d58e19c3346c9346a0055c0e2e9576d48480a924ee3e6446ff259a9dac5fc80eaa35a8328dabd7ef66df3a2299cb26fc31448c674ed8946c", @typed={0x8, 0x44, @fd=r0}, @typed={0x14, 0x80, @ipv6=@mcast2}, @generic="31d6c0f9c52c95e15de90fea5d6717f505d214cf15339b99635d8de2fcca8f62f4b1e9dc2644d7cb53c440eb5b9cd1c2045715f7d02ed4c028840450d41b270b701b936efcb4520f27edcb73d6d6f022598c3c39953955150b76c8065bac3e60fba898e972221c0c8fbb78e734a28654dc87a0b464f9e14873230bff4914601dea009b9fd764dc0aebfd4cd6821761af1a46707b97fe524a3aa7fd9f105812ce7e56694a9e52755eeaff3900e05eb15de3e0c01a7060a5b45bcbcaefe6ec59681a511127feb8ff6478f0ce8504f88d6792bebcc722a987ad27fae5c78add18a161b1de2a4aa8bd83d2efd9e299b80156e15248e0d4c3e9553c1fa3f8077ff9c31737ebf789e6e049381bf90a884fe9a717ad4f17a8fa1153aae8e57fe20904e0e075f9ff675609a70f1ae67b47b8533f58f87a30f3aa2ea49e9f4f1375f3a25cf75ad834b5c40361d0d29dd770b6818c5ba274fba25678ecc7349cddc3c31d06c17dddea9c05301ab07221985eb208209ddfb69b827547d4d9d9943d3df235495dd5c68220db34a9344505172e14fc439d8af61b58fd43938a294fb192057cbbf2df9ce156f48e739bb52324cc71ce04065fc87340d8a380a860ba662eea52af5ff135b6403b2a8b68c856d3f7c0ae46d4752ed8a4b187934fd730bd574e861545a5edf1084f341ad67cd3630826bfc0e31f27744380bb499726accbb4b342cda4f5aa09fe9799776eff54108b4e1ffe1f2566816e5e6b61f25c0a376fcf4f0f42b559afdfb6a546fcdd759056d26fe41b030fc52663874e337669bf0fb4f6392d15530580f5d9519bab414d6b6057b2815980293bf823d4dbb764d51ff04db2621c9c3a283838d6d6d61ef945dab822d9d64cf21d389e94773e551e63ee14fcd286bbdddf5a419b981ac5efd90eb53aa073cc96b0f59b5c2d3895d933551f6c5f30f8f2cfaa0d6a80569c26878227d5472f19311aab0999e964bc7fd10bd2caad9e483b955de4333b2047ef08b53f2e3700a59ab022849daf74c79fe857de98466f15053c81bc72919badb3d4b9fda15cb62084ef5b9a6ec2d41be3bb1af43d164d69c6c6b8dea548d1268d2a651126ae640f1b69a44bf54339ef3bfce4b63a50314d643a6ec2e352c1e20e30fc36e1cefe7c7c586763cd40e1a5006e6f73d196fa2d5a6ee3e75a3e0c590278110bd88b76f628c96a4b15713fa349cc65246eea6d510a101b415befd4c1ec2509976560b2334435398ce2bfbb5601034abb9898d2d6b34927dfadae5eb99dd6b72e6cf54cb7af870dfee03be82e3be37c6bac9478a8825bb3566c2ecb0f0690b4e17b0fd32c9b494897d49e1d3460e9a489e953251ab6374bc5ba0c0bfd1b31d92b6faa633acbb0dd32be0dd05e85e23efe9d03fd82c675e4cbb8e2b58bf5b4e49b7b233c8b6d038014479be04d40b85074f081f99777787ecf3624e6f9e8558a1ffa9cdfc0aa9e6a398606033755787c157117e31b50569330b4bd990ce6fcaa2a8aaf7e0af216c10112ba827f395cb6127c87bbf085cc8d8239491444ad262d2f57f0be6e71da292d7f80ead80db6bbdeafcd357ff5bf62e1ba15c54f2f97ec64449450efbf687b7d34b7f90c30bc7418da1aba6113fada8088c0344cacd3722ed79ba897fc17d0761224171ec952cdf05b82485237a5615e998b7c35999c3b2eed0515a2e37a7e88312393a12ff6dd674397ab0d54d4811f6eabbd17793aa1c762c09f1837eed5df3df96229610945d6fef665401a25f278cbd9d2c0389497789f10cf9433bb1140f9f0788ebe4bd350faac1c2f5b1810ea959d3807d4c2e026bc1f9a2bb1228218b89be065caf32854cc99e51a5607839d75a74df3400ab8aa4d71bc7dcb72da30e0288439f43eda4371f9c4844773d33393ae673553f35a576f32a83fdfe166fc450d64f8ffc81a6a46a55a84352ab8cf7650a7780273c8e18d14dd50e9990b5824f304014b134d26b476e1b5292d2b5fcff699083c2df256e6d99636ba7b5ea8c0696534ba1c4744c5d1c90205e0ff2bb41f7d1a96db5da57cd278701ca2f077d0d92ec601fec0a9195a561fb2ffbcd97806e580c6388e42c7f5cbef438e6064de2a01bf1ac4f63a60349753615fce838e9bb2ff001837b2cc4aad15c82823d2b4b3070ea3b4ff430d17b851efe7127e6fc4007f1e732c4f60ced8b879a4b0e489b3d198f0794cca79e1395162fde73d24c399fb96a41f97fe30d4b0cb343941ab4505d3d57f0955ad4af483f3af3d931395b47aedd9d95666ae853287c7881ace73fba7eea4674ad968c91fb85db09d212b064d4e89e81507266605239f643fd67a88fdf17f893af9702f2da77dcac015be00ebfdf63ed8d63380d3ccea2f3e195275d365f33f6edda1c91c0248fe98f1d5ad135ae74c9f3483403adc2f0d7eab9ff88ad152b90c72b1526e307f83aa8c95285e5dee62053d694a16882e7cf1917212153c3b51685c8157dfea1d0ee8251376ad938df2cdd608cc936b32d6e1a7a6b97c51ce089335159de5ba2987bd5e30e8a1aadee3ec4922b99ccc6d6f44a202652f75fcda70e60bdc2d8cfbc41e8f47cb4bd29240ae8a19f9713f37dd253687edfa05dc7a1e8e6471eed5beac041b7e063d676df8a8657ddf273e05ef36838c2372c5c12ad40282dde04b98b21eb7067bcf6aceca236973937b413a7568380190d14176ddb4aeec40bc0da63dd9e6236dc908a929d6abb5eefa9f82aeaae89af8f529d83ab0d29bb7c8479f1dc3ec8187c9c6bf4baea185e1a8fd694443a556cdacdc745192448f08766595ff84cf5317fbfe9a3446204f023b073bd7a89e91977471ab14177b1f1f7344b38d4be72a7b4f432e913841f3b8125a49c6cf518b4730cadad1b89f9f0bd2736a5d8a0125c15057ae738466ae85b987aaa157968df7eaa06b88fc47a0426c9b8847e84a87822c68043ea166b2fb1fbbed60a2489007e50fc9cca1e3216c5ad10ebb6bc0e986ed123d8f47693b793a17f99160b8238caaf266b105c01ecfce0e51835efb840b42e5f2108aa2db3a5784fb7c3bd2889f6b48b7984404a3c4f57829779a2cd1fd2775610edce5829d0cf047e8e91fecf7434811fed721a038e2a9dc15c13f9c14e6ce022ea15e57cd3f8fcfb9ec36e829766e2d0a24176ba49906ad06656faca31c36c48a59b8aa942b15c9d4d5fe5750087a87d42db74f7daab9d1fbec679e7c946bb084ea4afcf3ec5d74f2a79e5dfee043829d6fda0a0fba5a59e1b7a4ff9ea2171679063be0dae80281e80829f9af93a311bbe636b81cb6380b552dedbeeb55d80371c66691b6cb9b177ad85a5d9dbf67b96c9b23bd91e53dcad685b6bf3e9a730297a2aaafb5d78da7ef62127a65d8bb1bd0c55c062133639eb6ef91a0c43789d653fa287aba9c3b7e95256161b3813ebf62f7967f09c75248190c839dd472fe8965235dfe14042d554eae211acb0204f07f9c40577173ca9d4b0367252a5eb140ba645500c877e79913994e630fdaa7f9d631243c3819d741ee71f3b2b8944439517498aae6e5d47b163f67007de59214793846f967a1d153a2bbf96c2158b2a35d80e2a64a1c2c677ce4865f93a56ca561568502c43a8b7b37de282627c4a08e313ff4bbb30d239f9c860e72ab7b1769a8be9543563f7d0206b85c41f4ae2dd758dc3639f424f110b3f3bf84335d00ec1aece58605fa7f28636103d6ade0eef9f2ae8edbd0ec2e03992810fdef087444ba3642b5822941ea31f087d4cbbc872f9f3673e2c0a8de05f54d7c888a65a211d29a9a6be655258266e0ade48d1c857d61c8a9919ec4b5b2eb629d8a83e33bcb2b4845c959e512e8c10e97a808de409337e8d8ba91886c5bfe0326f3d01cc562467a8225ced6c96bf80f1d5aa5f4ccb884790c5e93bc14547dc0fa921d014bdd7d56175da05f0f4c1643116427f246a0f05ebbe30558e8b93cc2a7f0af6969b07b7e201b88f3f94228bb819b4562a89b47bfae5341540a45676ec7529c95f2aab349aa9955b9bb2a040c33b18ee23fa1c361682a6e6c0952d70410ac4a6e3501040f2cb3e3adf6edfc1a923b199e0e84d765e9d972636f71d001bf01b6f0638b68ccb99e962a450fbb3d27afa0071eee4bf6161d9e84aa2af35bea37676ece4216d6ef9098f9b43333e30c67dd636813d8392c5136826d9f5bc13d4aa3f5d6f21885863b77dc8f8b38a121dc24f6e5d26ed5f8fba1e68c024ad489fc80c4f9115893eff9eef526224b90a4eb2a59f3195d6ef43dc10a555e915970d1dbe4b42eb01af81626e6052d61005dce041c8bb001db542c61cdb45dfa375ddd672be2c53d31b62d56d0f534bda4e8d24f60aa2314d17fe893708c0ddb771f9075ed5c7fcc6bfbe66c1995f9b65b207fe6e1ce431f4cf4917f2a35d1696c0cb09721f6b8da095ad0cc40bfab0ed1713104fc129381e6b676cf101472d1837a26e186446fdb5d68ad13fddea64ff827e7c6577f94cb5d876cacb9c9e296c9b0d32ab771c7ace13a6c5c1c87b0e24f9cdee59545261e4c0fe3b58a096727f2673fc5de4f8300bebf314cb5aad1015e97ea2a91efc8a0a7615627a5df28b3489f10e5993aa009b08b7b24e3d0bef2d2a854b908f39948cc76afa2ccfa1c70c7192f50cd6bc6b4f7d9db93e68dbc3e3f3efded606216f759ab97dbdb98f08ffe8be0b13fe7b6f947a4ad1274b6766c91df65bba8bf1aad15eb47b6c22cf438e397b8ef15c3f09e97f64dbf5cdc841cf8d1c58542a6e0f8d9ca8fa2816d13b9b0ed3e8031be4c9937a994f08e764b157bd133a3ddc1e61796ec6028b5f9fc6eb6c2219a6dad8e12a2023f69c9523d2e531fbf8889218b2e89b1aa011e434615174bc47cb80232de75f7dd2667e4ceeec97b3fb56a583428150ba8d9656e5eb5f2fbe74d1b9649364b00f391ab770682b92d81ded36327e9e9973195bb267bd3c05f4edb8d1d57945946f7816cb59b66dbf84018048786961fcd2a00ce0dc419dd0a10c3874b096f375d0ea856002dff7c2ff792b9e144ffe0490f5d0085e87d7c89e1f3c3527a9b7e9422736a67d092b0dbafd69712558cf24246949f76014af68e6029b5b918ad9c0fda3ddde57784ddcfc212e22e205e92d5b75714bb6ede8ccaaca93a7156faf1eff075a8aecf13177ff25a0ce2c027ee630a62a5ec71837258395f86a2fe18cec343301eeab7a0568812824591c15f918a96b0f6d62eb44de395ade508eef72a6f1ec39717f9a2359631a54bfc217ed20676075c394e3bfa7a1260ab22333d83e6d8e998117c302624ffe360ae1830ecc1d004a51d498afcdf0f0722423f845196ab2f73627674fba725a55a22e8b51cc6f2b14a4f4c6416ae23f78acb3467d08c2a46877ff013b6bbefa508ad6a567f1a1298b1be281f67bbf4d5e23ce102bf1295c508d286461566b473e28bf322fcd4bcc853921b1932c1c04811371b06186d6629655d69d3f34a48691d4e01e5234cb1a638f9553f9d0c1f8f7ea8e218386e689ee4d0f9ad1c8ab70d0b5068b0a688cacc0d993ece9ff7303141c2dc07cc9c767f181b580362d814e11fa05014031579065c12239a380f77274535305956df49f28c7bf227861269d753c501c7c1b9129f31aad1aa8f731763639796592866f6057ea74ec90c2e1def21923ac92ae40e8ee3958032f347bf6d90eec0ba332b2a9956e34c9ca9bc689829ae70c836fb98ca72ba778dbfbf24dea78d015eacf9ed5a95193d16df56648d50bef44a73796690b4e635e30e9d090b3c52e3b55673"]}, @typed={0x8, 0x63, @fd=r0}]}, 0x17f4}], 0x6, &(0x7f0000000ac0)=[@cred={0x20, 0x1, 0x2, r2, r5, r7}, @cred={0x20, 0x1, 0x2, r2, r5, r8}], 0x40, 0x40000}, 0x8004) keyctl$get_persistent(0x16, r5, r6) r9 = openat$vcs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/vcs\x00', 0x0, 0x0) r10 = dup2(r9, r1) tkill(r2, 0x15) semget$private(0x0, 0x7, 0x8) ioctl$DRM_IOCTL_AGP_RELEASE(r10, 0x6431) [ 2544.189548] binder: send failed reply for transaction 3776 to 432:433 [ 2544.210876] binder: 432:433 ioctl c0306201 20000600 returned -14 13:49:02 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x74000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) [ 2544.296386] binder: undelivered TRANSACTION_ERROR: 29190 [ 2544.302928] binder: undelivered TRANSACTION_COMPLETE [ 2544.340499] binder: undelivered TRANSACTION_ERROR: 29189 [ 2544.393640] binder_alloc: 442: binder_alloc_buf, no vma [ 2544.407445] binder: 442:443 transaction failed 29189/-3, size 0-0 line 3035 [ 2544.427469] binder: send failed reply for transaction 3779 to 442:443 [ 2544.448345] binder: 442:443 ioctl c0306201 20000600 returned -14 13:49:02 executing program 4: signalfd4(0xffffffffffffffff, &(0x7f0000000ff8), 0x8, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000340), 0x10000014c) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x900}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 13:49:02 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0x8baa030000000000}) 13:49:02 executing program 1: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-vsock\x00', 0x2, 0x0) clone(0x100002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) rt_sigreturn() perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) dup2(r2, r0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1e2ba62e) recvfrom(r1, 0x0, 0x0, 0x0, 0x0, 0x0) recvfrom(r2, &(0x7f0000000180)=""/184, 0xfffffffffffffd84, 0x10100, 0x0, 0xfffffffffffffd51) setsockopt$IP_VS_SO_SET_EDIT(r0, 0x0, 0x483, &(0x7f00000000c0)={0x0, @dev={0xac, 0x14, 0x14, 0x1d}, 0x4e24, 0x1, 'fo\x00', 0xc, 0x20, 0x37}, 0x2c) 13:49:02 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x7a000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) [ 2544.503932] binder: undelivered TRANSACTION_ERROR: 29190 [ 2544.510153] binder: undelivered TRANSACTION_COMPLETE [ 2544.535807] binder: undelivered TRANSACTION_ERROR: 29189 [ 2544.600054] binder_alloc: 457: binder_alloc_buf, no vma [ 2544.637261] binder: 457:460 transaction failed 29189/-3, size 0-0 line 3035 [ 2544.666572] binder: send failed reply for transaction 3782 to 457:460 [ 2544.676321] binder: 457:460 ioctl c0306201 20000600 returned -14 13:49:02 executing program 2: socket$netlink(0x10, 0x3, 0x0) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='fdinfo/3\x00') exit(0x0) pread64(r0, 0x0, 0x0, 0x3) setsockopt$inet_sctp_SCTP_MAX_BURST(r0, 0x84, 0x14, &(0x7f0000000000)=@int=0x4, 0x4) 13:49:02 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x13, &(0x7f00000000c0)=0x100000001, 0x151) connect$inet6(r2, &(0x7f0000000080), 0x1c) r3 = dup2(r2, r2) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r3, 0x6, 0x16, &(0x7f0000000440), 0x131f64) clone(0x2102001ff9, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) setsockopt$inet6_int(r2, 0x29, 0x48, &(0x7f0000000040)=0x4, 0x4) setsockopt$inet6_MCAST_JOIN_GROUP(r2, 0x29, 0x2a, 0x0, 0x0) 13:49:02 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0xe4ffffff00000000}) 13:49:02 executing program 1: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-vsock\x00', 0x2, 0x0) clone(0x100002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x8000000000005, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = syz_open_dev$mouse(&(0x7f0000001440)='/dev/input/mouse#\x00', 0x7, 0x408c40) r4 = syz_genetlink_get_family_id$SEG6(&(0x7f00000014c0)='SEG6\x00') sendmsg$SEG6_CMD_SET_TUNSRC(r3, &(0x7f00000015c0)={&(0x7f0000001480)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000001580)={&(0x7f0000001500)={0x44, r4, 0x100, 0x70bd25, 0x25dfdbfb, {}, [@SEG6_ATTR_SECRET={0x4}, @SEG6_ATTR_ALGID={0x8}, @SEG6_ATTR_SECRET={0x10, 0x4, [0x1000, 0x800, 0x6]}, @SEG6_ATTR_DST={0x14, 0x1, @rand_addr="d6da4ca3997309107a9758b00bca0e81"}]}, 0x44}, 0x1, 0x0, 0x0, 0x80}, 0x88c1) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) dup2(r2, r0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1e2ba62e) ioctl$sock_SIOCBRDELBR(r3, 0x89a1, &(0x7f0000000100)='bcsh0\x00') recvfrom(r1, 0x0, 0x0, 0x0, 0x0, 0x0) recvfrom(r2, &(0x7f0000000180)=""/184, 0xfffffffffffffd84, 0x10100, 0x0, 0xfffffffffffffd51) 13:49:02 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0xff600000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) [ 2544.746755] binder: undelivered TRANSACTION_ERROR: 29190 [ 2544.761693] binder: undelivered TRANSACTION_COMPLETE [ 2544.798046] binder: undelivered TRANSACTION_ERROR: 29189 [ 2544.830564] binder_alloc: 472: binder_alloc_buf, no vma 13:49:02 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0xfdfdffff00000000}) [ 2544.845499] binder: 472:473 transaction failed 29189/-3, size 0-0 line 3035 [ 2544.865229] binder: send failed reply for transaction 3785 to 472:473 13:49:02 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0xffffff7f00000000}) [ 2544.902618] binder: 472:473 ioctl c0306201 20000600 returned -14 13:49:03 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x400000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) [ 2544.984297] binder: undelivered TRANSACTION_COMPLETE [ 2545.104193] binder: 488:491 got reply transaction with no transaction stack [ 2545.117994] binder: 488:491 transaction failed 29201/-71, size 0-0 line 2801 [ 2545.143104] binder: 488:491 ioctl c0306201 20000600 returned -14 [ 2545.306996] binder: release 488:489 transaction 3788 in, still active [ 2545.318031] binder: send failed reply for transaction 3788 to 488:489 [ 2545.335361] binder: undelivered TRANSACTION_COMPLETE 13:49:03 executing program 4: signalfd4(0xffffffffffffffff, &(0x7f0000000ff8), 0x8, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000340), 0x10000014c) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0xa00}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 13:49:03 executing program 5: r0 = socket$unix(0x1, 0x5, 0x0) getsockopt$IP_VS_SO_GET_DESTS(0xffffffffffffffff, 0x0, 0x484, 0x0, 0x0) getsockname(r0, &(0x7f0000000480)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @loopback}}}, &(0x7f0000000000)=0xdd) openat(0xffffffffffffff9c, 0x0, 0x80000, 0x0) fchmodat(0xffffffffffffffff, 0x0, 0x0) write$P9_RWSTAT(0xffffffffffffffff, 0x0, 0x0) dup2(r0, r1) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) getsockname(r1, 0x0, &(0x7f00000000c0)) 13:49:03 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x60ffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:49:03 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0xffffffff00000000}) [ 2545.616168] binder_alloc: 495: binder_alloc_buf, no vma [ 2545.642742] binder: 495:501 transaction failed 29189/-3, size 0-0 line 3035 13:49:03 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x20000, 0x0) ioctl$BLKFLSBUF(r0, 0x1261, &(0x7f0000000040)=0x3af) socket$netlink(0x10, 0x3, 0x0) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='fdinfo/3\x00') exit(0x0) pread64(r1, 0x0, 0x0, 0x3) 13:49:03 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) prctl$PR_GET_NAME(0x10, 0x0) openat$null(0xffffffffffffff9c, 0x0, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) write$P9_RLERROR(r0, 0x0, 0x0) 13:49:03 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0x0, 0x2}) 13:49:03 executing program 1: openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-vsock\x00', 0x2, 0x0) clone(0x100002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$binfmt_misc(r1, &(0x7f0000000100)=ANY=[], 0xa0) recvfrom(r0, 0x0, 0x0, 0x0, 0x0, 0x0) recvfrom(r1, &(0x7f0000000180)=""/184, 0xfffffffffffffd84, 0x10100, 0x0, 0xfffffffffffffd51) [ 2545.679605] binder: send failed reply for transaction 3791 to 495:501 [ 2545.699598] binder: 495:501 ioctl c0306201 20000600 returned -14 13:49:03 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x740000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:49:03 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0x0, 0x3}) 13:49:03 executing program 5: perf_event_open(&(0x7f0000000280)={0x2000000005, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, @perf_bp={&(0x7f00000000c0), 0x8}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000000c0)) [ 2545.789306] binder: undelivered TRANSACTION_COMPLETE [ 2545.855631] binder_alloc: 524: binder_alloc_buf, no vma [ 2545.879135] binder: 524:525 transaction failed 29189/-3, size 0-0 line 3035 13:49:03 executing program 5: poll(0x0, 0x0, 0x23588b21) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) [ 2545.916892] binder: send failed reply for transaction 3794 to 524:525 [ 2545.947556] binder: 524:525 ioctl c0306201 20000600 returned -14 [ 2546.005444] binder: undelivered TRANSACTION_COMPLETE 13:49:04 executing program 4: signalfd4(0xffffffffffffffff, &(0x7f0000000ff8), 0x8, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000340), 0x10000014c) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0xb00}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 13:49:04 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0x0, 0x4}) 13:49:04 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x7fffffffefff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:49:04 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) pwrite64(r0, &(0x7f0000000000)="e0c8705d28ace94e7ddc97550f561684e0bb68ad93b5aff09612e93b738007e60477c8", 0xfffffffffffffd8f, 0x0) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='fdinfo/3\x00') exit(0x0) acct(&(0x7f0000000040)='./file0\x00') write(r1, &(0x7f0000000180)="e5a5bf463f526713f5313499d09ceaf94825bafb0693aed8508e92be165f625df7c53308aa86c35cf1a8300e90eeeefb00edb8b187024c5906e353e0822d8b697499aab2a358c926b600ee0a50bbb71fdb292e164b7cde4b1b53b02756df36001651ea4fe584d8984661aae5af5004d8c7294ff2d9f0c0e0534d72a006567b8373a05ad216e3d6ecdd031e54a7ec7d47e6197d476aa7ca9e6b66248c3d371d8cd15cd866cc6fc736ec912d4bb3f9db560c9a1c8c9641d62661bd9c40aa25eeb0af1a61fd469a5658207ddabc8eaf57e621379b69720125fd3abc58d15fa63a5855f0c244b8eabfeb766d82a9bb4dec828b062582", 0xf4) pread64(r1, 0x0, 0x0, 0x3) getsockopt$netlink(r0, 0x10e, 0xf, &(0x7f00000000c0)=""/83, &(0x7f0000000140)=0x53) 13:49:04 executing program 1: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-vsock\x00', 0x2, 0x0) clone(0x100002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000600)='/dev/sequencer2\x00', 0x101002, 0x0) ioctl$PPPIOCGNPMODE(r1, 0xc008744c, &(0x7f0000000640)={0xfb, 0x3}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$bt_hci(r2, 0x0, 0x3, &(0x7f0000000240)=""/211, &(0x7f00000000c0)=0xd3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r4 = syz_open_dev$vcsa(&(0x7f0000000100)='/dev/vcsa#\x00', 0xf631, 0x0) getsockopt$bt_l2cap_L2CAP_LM(r4, 0x6, 0x3, &(0x7f0000000140), &(0x7f0000000340)=0x4) r5 = dup2(r3, r0) write$binfmt_misc(r2, &(0x7f0000000140)=ANY=[], 0x1e2ba62e) getsockopt$inet6_IPV6_XFRM_POLICY(r5, 0x29, 0x23, &(0x7f0000000440)={{{@in6=@mcast1, @in, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in6=@initdev}}, &(0x7f0000000540)=0xe8) mount$overlay(0x0, &(0x7f00000003c0)='./file0\x00', &(0x7f0000000400)='overlay\x00', 0x201000, &(0x7f0000000580)={[{@xino_off='xino=off'}, {@index_off='index=off'}, {@metacopy_off='metacopy=off'}, {@xino_on='xino=on'}, {@xino_off='xino=off'}, {@lowerdir={'lowerdir', 0x3d, './file0'}}], [{@appraise_type='appraise_type=imasig'}, {@fowner_gt={'fowner>', r6}}, {@dont_hash='dont_hash'}]}) recvfrom(r2, 0x0, 0x0, 0x0, 0x0, 0x0) recvfrom(r3, &(0x7f0000000180)=""/184, 0xfffffffffffffd84, 0x10100, 0x0, 0xfffffffffffffd51) getsockopt$bt_rfcomm_RFCOMM_LM(r1, 0x12, 0x3, &(0x7f0000000680), &(0x7f00000006c0)=0x4) [ 2546.674090] binder_alloc: 540: binder_alloc_buf, no vma [ 2546.687550] binder: 540:544 transaction failed 29189/-3, size 0-0 line 3035 [ 2546.710183] binder: send failed reply for transaction 3797 to 540:544 13:49:04 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0x0, 0x5}) [ 2546.732317] binder: 540:544 ioctl c0306201 20000600 returned -14 13:49:04 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x940000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:49:04 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0x0, 0x6}) 13:49:04 executing program 5: [ 2546.840568] binder: undelivered TRANSACTION_COMPLETE 13:49:05 executing program 5: [ 2546.917104] binder_alloc: 561: binder_alloc_buf, no vma [ 2546.944754] binder: 561:562 ioctl c0306201 20000600 returned -14 13:49:05 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0x0, 0x7}) 13:49:05 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x30710000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) [ 2547.166996] binder: 571:572 ioctl c0306201 20000600 returned -14 13:49:05 executing program 4: signalfd4(0xffffffffffffffff, &(0x7f0000000ff8), 0x8, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000340), 0x10000014c) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0xd00}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 13:49:05 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) r1 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$inet_sctp_SCTP_AUTOCLOSE(r1, 0x84, 0x78, &(0x7f0000000000), 0x4) 13:49:05 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0x0, 0x8}) 13:49:05 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0xa0500000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:49:05 executing program 2: socket$netlink(0x10, 0x3, 0x0) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='fdinfo/3\x00') exit(0x0) pread64(r0, 0x0, 0x0, 0x3) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x8000, 0x0) 13:49:05 executing program 1: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000280)='/dev/vhost-vsock\x00', 0x2, 0x0) clone(0x100002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = accept4$rose(0xffffffffffffff9c, &(0x7f00000000c0)=@full={0xb, @dev, @rose, 0x0, [@null, @netrom, @netrom, @null, @null, @netrom]}, &(0x7f0000000100)=0x40, 0x80000) getsockopt$IP_VS_SO_GET_DAEMON(r1, 0x0, 0x487, &(0x7f0000000140), &(0x7f0000000240)=0x30) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r0) write$binfmt_misc(r2, &(0x7f0000000140)=ANY=[], 0x1e2ba62e) recvfrom(r2, 0x0, 0x0, 0x0, 0x0, 0x0) recvfrom(r3, &(0x7f0000000180)=""/184, 0xfffffffffffffd84, 0x10100, 0x0, 0xfffffffffffffd51) 13:49:05 executing program 5: r0 = syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0x4, 0x0) ioctl$VIDIOC_SUBSCRIBE_EVENT(r0, 0x4020565a, &(0x7f00000001c0)={0x3, 0x100000000098f905, 0xe7}) 13:49:05 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0x0, 0xa}) [ 2547.763381] binder: 588:591 ioctl c0306201 20000600 returned -14 13:49:05 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0xa0700000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:49:05 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) execveat(0xffffffffffffffff, 0x0, &(0x7f0000000800)=[&(0x7f00000007c0)='TPROXY\x00'], 0x0, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af00, &(0x7f00000007c0)=ANY=[]) [ 2547.920081] binder: 603:604 ioctl c0306201 20000600 returned -14 13:49:06 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0x0, 0x10}) 13:49:06 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x100000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) [ 2548.182410] binder: 612:613 ioctl c0306201 20000600 returned -14 13:49:06 executing program 4: signalfd4(0xffffffffffffffff, &(0x7f0000000ff8), 0x8, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000340), 0x10000014c) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0xe00}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 13:49:06 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0x0, 0x48}) 13:49:06 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) r1 = syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0x4, 0x0) ioctl$VIDIOC_SUBSCRIBE_EVENT(r1, 0x4020565a, &(0x7f0000000040)={0x3, 0x100000000098f905, 0x3}) dup3(r0, r1, 0x0) 13:49:06 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:49:06 executing program 2: socket$netlink(0x10, 0x3, 0x0) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='fdinfo/3\x00') exit(0x0) pread64(r0, 0x0, 0x0, 0x3) syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x400040) 13:49:06 executing program 1: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-vsock\x00', 0x2, 0x0) clone(0x100002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x0, 0x498, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40, 0xffffffffffffffff, 0x0, 0x80000000, 0x0, 0x20000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x31, 0x9}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = dup2(r2, r0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1e2ba62e) recvfrom(r1, 0x0, 0x0, 0x0, 0x0, 0x0) recvfrom(r2, &(0x7f0000000180)=""/184, 0xfffffffffffffd84, 0x10100, 0x0, 0xfffffffffffffd51) getsockopt$inet6_IPV6_IPSEC_POLICY(r3, 0x29, 0x22, &(0x7f0000000240)={{{@in=@multicast1, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@loopback}, 0x0, @in=@broadcast}}, &(0x7f00000000c0)=0xe8) setuid(r4) [ 2548.741398] binder_alloc_new_buf_locked: 4 callbacks suppressed [ 2548.741407] binder_alloc: 622: binder_alloc_buf, no vma 13:49:06 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) r1 = syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0x4, 0x0) ioctl$VIDIOC_SUBSCRIBE_EVENT(r1, 0x4020565a, &(0x7f0000000040)={0x3, 0x100000000098f905, 0x3}) dup3(r0, r1, 0x0) [ 2548.785495] binder_transaction: 5 callbacks suppressed [ 2548.785514] binder: 622:623 transaction failed 29189/-3, size 0-0 line 3035 13:49:06 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0x0, 0x4c}) [ 2548.828432] binder_send_failed_reply: 5 callbacks suppressed [ 2548.828444] binder: send failed reply for transaction 3815 to 622:623 [ 2548.842607] binder: 622:623 ioctl c0306201 20000600 returned -14 13:49:06 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x300000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:49:06 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) r1 = syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0x4, 0x0) ioctl$VIDIOC_SUBSCRIBE_EVENT(r1, 0x4020565a, &(0x7f0000000040)={0x3, 0x100000000098f905, 0x3}) dup3(r0, r1, 0x0) [ 2548.896923] binder_release_work: 20 callbacks suppressed [ 2548.896937] binder: undelivered TRANSACTION_ERROR: 29190 [ 2548.919080] binder_release_work: 5 callbacks suppressed [ 2548.919085] binder: undelivered TRANSACTION_COMPLETE 13:49:06 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0x0, 0x60}) [ 2548.949126] binder: undelivered TRANSACTION_ERROR: 29189 13:49:07 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) r1 = syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0x4, 0x0) ioctl$VIDIOC_SUBSCRIBE_EVENT(r1, 0x4020565a, &(0x7f0000000040)={0x3, 0x100000000098f905, 0x3}) dup3(r0, r1, 0x0) [ 2549.006008] binder_alloc: 650: binder_alloc_buf, no vma [ 2549.035529] binder: 650:651 transaction failed 29189/-3, size 0-0 line 3035 [ 2549.065879] binder: send failed reply for transaction 3818 to 650:651 [ 2549.091594] binder: 650:651 ioctl c0306201 20000600 returned -14 [ 2549.172124] binder: undelivered TRANSACTION_ERROR: 29190 [ 2549.178431] binder: undelivered TRANSACTION_COMPLETE [ 2549.200355] binder: undelivered TRANSACTION_ERROR: 29189 13:49:07 executing program 4: signalfd4(0xffffffffffffffff, &(0x7f0000000ff8), 0x8, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000340), 0x10000014c) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0xf00}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 13:49:07 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0x0, 0x68}) 13:49:07 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x400000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:49:07 executing program 5: socket$inet6(0xa, 0x803, 0x6) r0 = syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0x4, 0x0) ioctl$VIDIOC_SUBSCRIBE_EVENT(r0, 0x4020565a, &(0x7f0000000040)={0x3, 0x100000000098f905, 0x3}) 13:49:07 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f0000000000)=0x0) r2 = syz_open_procfs(r1, &(0x7f0000000080)='fdinfo/3\x00') ioctl$PIO_SCRNMAP(r2, 0x4b41, &(0x7f00000000c0)="59641a4878355c507c7c88fd91c551c0c1a8b0171b8aaa329c50fded14e428fab744b7307d754f574c578d429bb63547cf9af0d7c29d83a7a7906ba0e8a4f0aadbd1b0b01517205b0c51421e936d8603324f095add5d6573c9139d2999fb4df51eff6852f38774919c55d306126b1e9fade2923d3c13a46bf41242530e6ca7248d2198a54cee9c237ca4a933436375c4a50174732e0e02ec77e30d47eae96a5784a4ca4e19156cfaa419d07360a83c89bc40293a0e386c444700c3242a2f2dd455fe31c7df2db4f2e82fd26b4bfdcae7248ac7e51a40b5d0171813109ec13990899b78c381d69748b00bae07e239252741fa1ce6f9b7464ebdafda8ecaf51544d907974b354b1fecb7205584c823a174a26e2e48f081c84ca472305c55f873f0f6ec4900350f6f50f1e28f4f5528d9592f5015541a76bd7512475d21f17406c3da8eb14f3a1f9549dbaf3bf263449599dbea619e9f11170e13bed9456bec73695612d137e646d1fe1e7bb7f5f3c0b24ee42950230912629ebfb2a050e55e86724fd43971733d2af65644f7c72ba7b209ce72d0e8aa24b6c5726f7e99f324b7c2374507cbeeb182a34649faf11dd6c66d76d84bb7cb61fb8677ec83773eff14a3ae497d61589b09c91cadcc32ec611bbe02a1b12ba236394f0f75c61342715e87846434ecd4cbf0cf32155fae66f6e1b76b462a271a67f8cfe3197daf2cdf74e2801259c321510c37110167c44db66c82c783c3e438b8d72611391dd67118f21ce471048e4159eb4daa05205a84fb469ce8b2861c1fb57cdf1a54d01ed58d3d967448b889bb8ef74e247cbe90ae1d30f353f30f3b64fd4b6f6c2c7d67bc6255effef532d9d4fb62948b9cbb6b0abcac3412072aedc190786e4e1b69cbd91cbb6a929b59cd99596aaef54cf53c061aa6560c40acfc0ef7e4d186c2e4df6b1c528eda7f23e6ffcb7fc217b58d11077927e91240a0e42954254bb6e37393ed6bcbe56dde2b3f3e40f297db4bf396e35d9ec1864086ba75fd07fedb5f00db9f9486a8df9a47fd193f59b6f3b9a80977b7360489f9d863fbd6b767b23f5c4997d14e655b3694443c87629de8b38dde5869693023aa4c68fc8e965337d42592f47b8bc180f84aa211ecabc055e4a568d33bff16a6ac571ecff72a0266bd15be1bbd8ccf38607507f3b7fd2cebc85cb257fbb57e90912fb14001dcb4fdff0a8986c4610afaea3f458783ea0290c2b0458b5dd6f75e2c3e235b9c470706bbf810647eaca3205b085ffd31e06951de6bbef4b376eabaa7ef734356ce7df6536ee7b00cde80e5be90e61ca440bf81c1b4482401b62d783b1dc2f816d99381f0faf8fd7ae37efbe477862bfb5244c76dd966539fb9af0fbd023552a1deb24a7c9bd8f56acfee96bfb1faf79ff35d42d3262c83529d551bb083f122cf04cc2671539c2d2e7a6d4a90c5c6157d7afdb1ac317a1f5e3fc53ea7ed60a5380dda896c2bccde6c0c177aa10ca5030658b301040712f40f398d623223ecd84b3cbb351bf8e8da32c3847bda982beabfc65c18c56b7cb5fd74f71563878f6feb86e14669788891ccde3690ea5450034d38eeb665c3583ff246298dbece77fe5eaafc3cad98215d7d7abb6962bb807c46e9f10c27167c0caa1a9455a77727147a10fbbe21fc404c3249eb327331aa023ba5f3f9b5e31c04e1ff3174f5f9f4e46714acebff2970aa79f0b423ab15f1be5aaa642f3c5c04b5aaaff58625d23917a369a1603039b3820e094b4b688b9c8fbd50d3ff3fb8a1f39bc1dc2e42bcc0f1dc717a2026b29249d5e178d43e9783bda2921c82b4825a1655188daeea75ee1b3ac930e124401ee5eb44aca469e72ca098d0e9257d020f297d2e9257015b81a20a04341202e0a7a67ab81927aa303c2c32022f74dd256fa011374c7e533e9302a127799c750e034e0462d02daaa7c417d1886e95d347d0f2fbfc01e1dd5251df99a170c2dcf8b8d3cab4c721d760e064a91effe0e2166c5d5d942067c0818a77a6484faf22e6323a987a52f5caaf6adf12a7fbc41ad3543c02b0da7c612571acdff0a3f2043e6ae166ebfa1cb33b8177ce6aa46f9c44b5ce80714ee061ce708d0662b120284cc082624dd0508e85d06af80dba7fcbef2d66f8f9c4f33adccef25d3a47266d2669aed11ba69abf29d864329cf23cd46fd793ff035ab3f2018f9a9735130d7cac80d4f9d314722670a1e96d7f919dbb8b93bd9f9a536aa79e39cd7e4a1a65c155f879f96cc45209fb532195684607392f63f943cfd3caab9c520c31ff28a0c779539e1a7e81dd431a53117c9fd926cdef2e628dc9a0771a0a4dfd25ac12dbc19f263dfe1277a2ed825657384ca375c9eeecc70d5717f945c4392ba064541bd8caf19f21e210fbffec6b4a3d0361151b9f9b30af9090b57c5a1e5565f4ed643ca365201a3841c5d1b228bfe5cda609b65c7d5c278f79b8ea2a39e022caa75207bda232483bdbb19ce14bb677f86ed837a5586b9df7a277c8b6994a7bf3cbdb7c0c3b5fb0e32b3824e5de0a985133fc0a8a2b4aae038f9b94b30d4078de88f26545195184b42605c9e3bfea45fc654f6981622a83ee5a3a445f8844530edfc2d76f0da2c7eae5bcf5432df61e52495a1e6348933ad59b060ec9ed2f920f886dbacc7939dabba411622f59f59e4d81dc232190a8b7a82c6b5331358edbad81fd66ebd519a7396d0a5e47abe5cd0ed18fded0c9a36b916a79fe6f25615b6c5fa5557094677f277fc12981f06c2dcfd93141486a02d66e60643993ef0c71b6a0d6231eeda0927fbd3a5d4171f0ded489c1ac0d95601d1b191f172292c260558f82016e304811eeb15119ca8ee3fe22ab8969731b00c769a29b322658f2ffc7a791be6adff1e6efec6d263295acf276b8e6afd0483e108b608d5d9591bdfa3b44383a746b9236a92042d6162bdcab1d4d24361b1399c2d39588d43971c54cf71d8d9c2a03c478533fe8bf15ca80520d8eabb104d5069b8cde2098c4368b316579b68187111aafe0705a2fe72e1fcb854b5ddd9160783d356f9613f2c9f12bb25afe89a4f6897ccb1a53dcf41ba30d6c4b3c89faa974b3fba315a998142a30e87493e4d649c20f2fe474755190bacaa27399d5b86ad83753f22b5d7c8e216c5570a0ab94e78581574ba37e8ca56cac4add6dc551817a6a33f7d844aa3e969cf0af4a61d34a937395bd07a26e79ca0f03ca5970ee363ea028e8f61553f62e47523d83545a123ce2d764a2889e7196f560dcc2305a9a8f8176a569c74588faa0e0dbf58914f16276525031408654778ba144fa94b8d19222af620a6d0ff64da7526f55e2d94e5cd59d84316a20f0e9bebbcf5532f596a1bb1bcb079e595f45741ee90ab7ed6486e9c7c4020577cecedd64618441acd2bf1e3f7c050d3d27a7fe5377b1a2f6e2e42d633b397ad2dd0fed9002c47febcf7a78d7055fb264396eb1ed2e22ab969c715f99b79858d78f337c7a4292f62d698498aa36f33d628123ca52102d654ef24594db65545ab7712d6fee3194c23b3d9e2dadc39ed4b41a80192d4843599b6a28b4d83e5620f0900ca56e7f8d1b2b76b625de0ebc76c7cfd5366ea91fca0555b6661fe9117806c023fe20847fccbf5de8aa423b9e3578abe24d953600e11efb2d0f3fb002aa383666ce2aa188021e750f7e90726854d248b5cc1b234669c501e381d3007cd5fbf3f56f52dcd8c9fdda15c57739b757c212f0b0664d8ebf12e67c90a888f23a340652bc2c0499db002b75114a5421989735c80a219c9cf8ac3f08693e82521b381ad3c44c77aeccb690a5b8c2ec0f73eb9829060a1d9eee83b047ceb7bfc5747de48b7c3f98e026819c38fd3dba505c8e62c098f631c31a07481964080466da6c824ca815b0edbec5c72f7a0371784623a89cdfc9ecba38b9c4ba6a48019f93ef5828ed646ad23d030f1e2357ede7ee351ac0f41901646364ed86e60952830d06829977a9087ed834dd8d09584b478d06282d796fc12f13b344de40f6e5ba2adae4572d2a03fc52629965610618f5ade9cfd3577d75035b4db2e9a43c9715d6ce9c57b8977494349f04a10b6ac916cfcc2a3a48add63133db3abced2919c255c85908508d287ee95aa168f236115037c22ea63298218dadcc62a1c8627b94a7ec0ec06a4e1b3155ca3f61b8cb49ef621185c12634a259881a1265433cf3563063d556e5d5604f9484246c6399bf5e1ed3c258a9664a50cd8b0886ffc23fbfc72b5c4025f97a7270ecc76658e10d12a3021381a020c752e3a1aaf493b53ceb4a2333952ce28e6ba607333d916fa7b303cc5e09151c861668da746fb8daf045be7d68973a37abf792cde886311cfc90e68f2a4cec88d76ecdcb7a71686fada5feff33971bab03846b5152728c0395ba6f455bfe84766d5d97bd8a4d3d9f5c38e53df57441d70a902ed204d7c7b2f80ddda6a3d3c661b73f9a8a556ac1f57b421c90ef285bcc2ca3f090c4e5ff29c74f3a01aba69e878e0a9ce488b0a8a239bc886d29fdd1d42024ac23dbe0323acad067f0a2dbdb8d9584f756adc135b9471feb5506f414020c6b576230d7dd7cf44b19425386bc32641f627b00b514eb8bfa9224267f85aeff2550f8011ad054e3d757fcf46761c296731eb0f530a5db34284abdd5d7cd18cf9409744662b77fc5b0d7e34d39a04a807cee564f02f551341b31e858da49adfcad98051372ac722b4dd3213d008d6cfbc6ffdae64d8e3682d7fc68dbd3629d75963494fbf475dae7f4c9a79b136108653c3e2f0cbcba8da329aac76d4862ef48ab60a6dbaea52a864a6d00feea8d433c6ef51c58eae11a3606145f401b7dcfe0907377185fc30c3d094845be68981dfc4056346e05dce4e4f2291e58d9d1a183e06c364aeab6c197e6a55841807b47d77c725e0c801dc94fa09e04485a724f22ca24fcf8b92bffcf17eb15904ea2ea344046921f1d01f73e4a14724ba414e5b04d7a03e3f2eb263cc3bdc1cb5817a63cacf1b39ac97c4ce98bc466bd5eb57df4eb3e5d11adfbeeca9739d07ffb0b707257af1bd9899fabd6f613ad3a330f009a150113c2b29cb5af53eff341014093fdca39a08c1334ec32f278306162fa08de6cb2c7413f2f9c4826d910e97cf329ef5937de898eaab2c63217fc3cc8f5ef730c43726d9d2c6141a6f508d18365e905b186d5169489956f45c8d5973921393bce3bdea28a06deab1c953eac2da3543dae5beee980ce71b23b097cdcd9139ba26791a9a7fa08719e5338851cdd503ffe1a9df783878913fa7d249bcc825886d7054f7636d43215d72c4741d70fbc2a8fbc547a67baafa741eca7db3eec1bce8d24d00b781e47c946794bc019e92ba2ef4d3203b48c9524e2c431e6be9c2c38cbe8d0cd94cd03461c507b664198eb4b02eb42ec1e4667430db5ed40c593fe18dbc9badff3b60693f7ef396733f6667320fc9001c8d79e27af41771573c6b03fb94dc33aba5d6718c489ef6c97c225907bfc1ca8f7e61a63c492e4aee7b794c3bdf9cd7d41410e70629e166535dd12766c6262937462ee607d728f4de21b3061979db79a47c206b4e2436605d625a51dff3aa9222b31c089b5a88571120eca18ea714256e35e5bb6657ce2a4903ee179d8e0979d666187ab9a481ba5cd7fcc99eb5fc179a528b2105d677d23855ac694f4cc21a76117ee691bec8c875c54de9dba02346cd92bc7ecb08a326643d60a170fe4583f1054022bbb7097a49aea8aaf825c837ced6a4d2d0a871d726739e304b53e47dc4db19753e7") exit(0x0) ioctl$sock_SIOCSIFBR(r2, 0x8941, &(0x7f0000000040)=@generic={0x3, 0x80000001, 0x6}) pread64(r2, 0x0, 0x0, 0x3) fcntl$notify(r2, 0x402, 0x0) 13:49:07 executing program 1: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-vsock\x00', 0x2, 0x0) clone(0x100002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r0, 0x407, 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) dup2(r2, r0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1e2ba62e) recvfrom(r1, 0x0, 0x0, 0x0, 0x0, 0x0) recvfrom(r2, &(0x7f0000000180)=""/184, 0xfffffffffffffd84, 0x10100, 0x0, 0xfffffffffffffd51) 13:49:07 executing program 5: socket$inet6(0xa, 0x803, 0x6) ioctl$VIDIOC_SUBSCRIBE_EVENT(0xffffffffffffffff, 0x4020565a, &(0x7f0000000040)={0x3, 0x100000000098f905, 0x3}) 13:49:07 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0x0, 0x6c}) [ 2549.786801] binder_alloc: 668: binder_alloc_buf, no vma [ 2549.798910] binder: 668:671 transaction failed 29189/-3, size 0-0 line 3035 [ 2549.818451] binder: send failed reply for transaction 3821 to 668:671 [ 2549.828096] binder: 668:671 ioctl c0306201 20000600 returned -14 13:49:07 executing program 5: socket$inet6(0xa, 0x803, 0x6) ioctl$VIDIOC_SUBSCRIBE_EVENT(0xffffffffffffffff, 0x4020565a, &(0x7f0000000040)={0x3, 0x100000000098f905, 0x3}) 13:49:07 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x500000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:49:08 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0x0, 0x74}) [ 2549.922003] binder: undelivered TRANSACTION_ERROR: 29190 [ 2549.929096] binder: undelivered TRANSACTION_COMPLETE [ 2549.955505] binder: undelivered TRANSACTION_ERROR: 29189 13:49:08 executing program 5: socket$inet6(0xa, 0x803, 0x6) ioctl$VIDIOC_SUBSCRIBE_EVENT(0xffffffffffffffff, 0x4020565a, &(0x7f0000000040)={0x3, 0x100000000098f905, 0x3}) [ 2550.004659] binder_alloc: 686: binder_alloc_buf, no vma [ 2550.020731] binder: 686:687 transaction failed 29189/-3, size 0-0 line 3035 [ 2550.056652] binder: send failed reply for transaction 3824 to 686:687 [ 2550.084027] binder: 686:687 ioctl c0306201 20000600 returned -14 [ 2550.164990] binder: undelivered TRANSACTION_ERROR: 29190 [ 2550.172682] binder: undelivered TRANSACTION_COMPLETE [ 2550.191157] binder: undelivered TRANSACTION_ERROR: 29189 13:49:08 executing program 4: signalfd4(0xffffffffffffffff, &(0x7f0000000ff8), 0x8, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000340), 0x10000014c) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x1100}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 13:49:08 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0x0, 0x7a}) 13:49:08 executing program 5: r0 = syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0x4, 0x0) ioctl$VIDIOC_SUBSCRIBE_EVENT(r0, 0x4020565a, &(0x7f0000000040)={0x3, 0x100000000098f905, 0x3}) 13:49:08 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x600000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:49:08 executing program 1: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-vsock\x00', 0x2, 0x0) clone(0x100002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) dup2(r2, r0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1e2ba62e) getrusage(0xffffffffffffffff, &(0x7f00000000c0)) recvfrom(r1, 0x0, 0x0, 0x0, 0x0, 0x0) recvfrom(r2, &(0x7f0000000180)=""/184, 0xfffffffffffffd84, 0x10100, 0x0, 0xfffffffffffffd51) 13:49:08 executing program 2: socket$netlink(0x10, 0x3, 0x0) r0 = getpgrp(0xffffffffffffffff) r1 = syz_open_procfs(r0, &(0x7f00000000c0)='attr/sockcreate\x00') syz_open_dev$video4linux(&(0x7f0000000000)='/dev/v4l-subdev#\x00', 0x1, 0x400) exit(0x0) ioctl$sock_SIOCSPGRP(r1, 0x8902, &(0x7f0000000040)=r0) pread64(r1, 0x0, 0x0, 0x3) 13:49:08 executing program 5: r0 = syz_open_dev$video(0x0, 0x4, 0x0) ioctl$VIDIOC_SUBSCRIBE_EVENT(r0, 0x4020565a, &(0x7f0000000040)={0x3, 0x100000000098f905, 0x3}) [ 2550.799101] binder_alloc: 700: binder_alloc_buf, no vma [ 2550.819244] binder: 700:703 transaction failed 29189/-3, size 0-0 line 3035 [ 2550.839580] binder: send failed reply for transaction 3827 to 700:703 13:49:08 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0x0, 0x300}) [ 2550.860650] binder: 700:703 ioctl c0306201 20000600 returned -14 13:49:08 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x700000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:49:09 executing program 5: r0 = syz_open_dev$video(0x0, 0x4, 0x0) ioctl$VIDIOC_SUBSCRIBE_EVENT(r0, 0x4020565a, &(0x7f0000000040)={0x3, 0x100000000098f905, 0x3}) [ 2550.916665] binder: undelivered TRANSACTION_ERROR: 29190 [ 2550.923834] binder: undelivered TRANSACTION_COMPLETE [ 2550.950108] binder: undelivered TRANSACTION_ERROR: 29189 13:49:09 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0x0, 0x500}) 13:49:09 executing program 5: r0 = syz_open_dev$video(0x0, 0x4, 0x0) ioctl$VIDIOC_SUBSCRIBE_EVENT(r0, 0x4020565a, &(0x7f0000000040)={0x3, 0x100000000098f905, 0x3}) [ 2551.038915] binder_alloc: 724: binder_alloc_buf, no vma [ 2551.072376] binder: 724:725 transaction failed 29189/-3, size 0-0 line 3035 [ 2551.139946] binder: send failed reply for transaction 3830 to 724:725 [ 2551.188512] binder: 724:725 ioctl c0306201 20000600 returned -14 [ 2551.291504] binder: undelivered TRANSACTION_COMPLETE [ 2551.612861] syz-executor.1 invoked oom-killer: gfp_mask=0x7000c0(GFP_KERNEL_ACCOUNT), order=0, oom_score_adj=1000 [ 2551.648780] CPU: 1 PID: 709 Comm: syz-executor.1 Not tainted 5.0.0+ #6 [ 2551.655504] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2551.664887] Call Trace: [ 2551.667518] dump_stack+0x172/0x1f0 [ 2551.671210] dump_header+0x10f/0xb6c [ 2551.674972] ? _raw_spin_unlock_irqrestore+0xa4/0xe0 [ 2551.680118] ? ___ratelimit+0x60/0x595 [ 2551.684050] ? do_raw_spin_unlock+0x57/0x270 [ 2551.688508] oom_kill_process.cold+0x10/0x6f5 [ 2551.693054] ? task_will_free_mem+0x139/0x6e0 [ 2551.697600] out_of_memory+0x79a/0x1280 [ 2551.701628] ? mem_cgroup_unmark_under_oom+0x8d/0xb0 [ 2551.706775] ? oom_killer_disable+0x280/0x280 [ 2551.711313] ? mem_cgroup_unmark_under_oom+0x8d/0xb0 [ 2551.716507] mem_cgroup_out_of_memory+0x99/0xe0 [ 2551.721234] ? memcg_memory_event+0x40/0x40 [ 2551.725607] ? _raw_spin_unlock+0x2d/0x50 [ 2551.729788] ? mem_cgroup_unmark_under_oom+0x8d/0xb0 [ 2551.734948] try_charge+0xfec/0x1570 [ 2551.738699] ? find_held_lock+0x35/0x130 [ 2551.742793] ? mem_cgroup_oom_trylock+0x1a0/0x1a0 [ 2551.747682] ? get_mem_cgroup_from_mm+0x10b/0x2b0 [ 2551.752556] ? find_held_lock+0x35/0x130 [ 2551.756654] ? get_mem_cgroup_from_mm+0x10b/0x2b0 [ 2551.761540] memcg_kmem_charge_memcg+0x7c/0x130 [ 2551.766249] ? memcg_kmem_put_cache+0xb0/0xb0 [ 2551.770789] ? get_mem_cgroup_from_mm+0x128/0x2b0 [ 2551.775680] memcg_kmem_charge+0x13b/0x340 [ 2551.779954] __alloc_pages_nodemask+0x437/0x710 [ 2551.784659] ? kasan_kmalloc+0x9/0x10 [ 2551.788507] ? __alloc_pages_slowpath+0x2900/0x2900 [ 2551.793748] ? __alloc_skb+0x3cd/0x5e0 [ 2551.797693] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 2551.803280] alloc_pages_current+0x107/0x210 [ 2551.807742] alloc_skb_with_frags+0x1a5/0x580 [ 2551.812288] sock_alloc_send_pskb+0x72d/0x8a0 [ 2551.816844] ? sock_wmalloc+0x120/0x120 [ 2551.820873] ? lock_downgrade+0x810/0x810 [ 2551.825062] ? finish_wait+0x260/0x260 [ 2551.828990] ? kasan_check_read+0x11/0x20 [ 2551.833193] unix_stream_sendmsg+0x5f7/0x990 [ 2551.837655] ? unix_stream_sendpage+0xb10/0xb10 [ 2551.842387] ? __lock_acquire+0x53b/0x4700 [ 2551.846667] ? smack_socket_sendmsg+0xb1/0x1a0 [ 2551.851593] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 2551.857181] ? security_socket_sendmsg+0x93/0xc0 [ 2551.861977] ? unix_stream_sendpage+0xb10/0xb10 [ 2551.866700] sock_sendmsg+0xdd/0x130 [ 2551.870455] sock_write_iter+0x27c/0x3e0 [ 2551.874563] ? sock_sendmsg+0x130/0x130 [ 2551.878584] ? __fget+0x340/0x540 [ 2551.882088] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 2551.887668] ? iov_iter_init+0xea/0x220 [ 2551.891720] __vfs_write+0x613/0x8e0 [ 2551.895492] ? kernel_read+0x120/0x120 [ 2551.899437] ? rw_verify_area+0x118/0x360 [ 2551.903626] vfs_write+0x20c/0x580 [ 2551.907232] ksys_write+0xea/0x1f0 [ 2551.910829] ? __ia32_sys_read+0xb0/0xb0 [ 2551.914930] ? do_syscall_64+0x26/0x610 [ 2551.918940] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 2551.924341] ? do_syscall_64+0x26/0x610 [ 2551.928353] __x64_sys_write+0x73/0xb0 [ 2551.932281] do_syscall_64+0x103/0x610 [ 2551.936238] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 2551.941459] RIP: 0033:0x457e29 [ 2551.944691] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 2551.964089] RSP: 002b:00007fc498bfdc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 2551.971874] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000457e29 [ 2551.979180] RDX: 000000001e2ba62e RSI: 0000000020000140 RDI: 0000000000000004 [ 2551.986480] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 2551.993787] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fc498bfe6d4 [ 2552.001083] R13: 00000000004c7260 R14: 00000000004dcde8 R15: 00000000ffffffff [ 2552.023883] memory: usage 307200kB, limit 307200kB, failcnt 338 [ 2552.037261] memory+swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 2552.047253] kmem: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 2552.062231] Memory cgroup stats for /syz1: cache:104KB rss:187464KB rss_huge:75776KB shmem:184KB mapped_file:0KB dirty:0KB writeback:0KB swap:0KB inactive_anon:0KB active_anon:187552KB inactive_file:8KB active_file:0KB unevictable:0KB [ 2552.094805] oom-kill:constraint=CONSTRAINT_NONE,nodemask=(null),cpuset=syz1,mems_allowed=0-1,oom_memcg=/syz1,task_memcg=/syz1,task=syz-executor.1,pid=32713,uid=0 13:49:10 executing program 4: signalfd4(0xffffffffffffffff, &(0x7f0000000ff8), 0x8, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000340), 0x10000014c) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x157c}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 13:49:10 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0x0, 0x600}) 13:49:10 executing program 5: r0 = syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0x0, 0x0) ioctl$VIDIOC_SUBSCRIBE_EVENT(r0, 0x4020565a, &(0x7f0000000040)={0x3, 0x100000000098f905, 0x3}) 13:49:10 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0xa00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) [ 2552.116657] Memory cgroup out of memory: Kill process 32713 (syz-executor.1) score 1160 or sacrifice child [ 2552.134308] Killed process 32713 (syz-executor.1) total-vm:73104kB, anon-rss:16564kB, file-rss:35800kB, shmem-rss:0kB [ 2552.177742] binder_alloc: 739: binder_alloc_buf, no vma [ 2552.216283] binder: 739:740 transaction failed 29189/-3, size 0-0 line 3035 [ 2552.249083] binder: send failed reply for transaction 3833 to 739:740 [ 2552.276298] binder: 739:740 ioctl c0306201 20000600 returned -14 [ 2552.355916] binder: undelivered TRANSACTION_COMPLETE [ 2552.412263] syz-executor.1 invoked oom-killer: gfp_mask=0x6142c0(GFP_KERNEL|__GFP_NOWARN|__GFP_COMP|__GFP_NOMEMALLOC), order=1, oom_score_adj=1000 [ 2552.441024] CPU: 0 PID: 731 Comm: syz-executor.1 Not tainted 5.0.0+ #6 [ 2552.447766] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2552.457142] Call Trace: [ 2552.459776] dump_stack+0x172/0x1f0 [ 2552.463435] dump_header+0x10f/0xb6c [ 2552.467194] ? _raw_spin_unlock_irqrestore+0xa4/0xe0 [ 2552.472330] ? ___ratelimit+0x60/0x595 [ 2552.476275] ? do_raw_spin_unlock+0x57/0x270 [ 2552.480733] oom_kill_process.cold+0x10/0x6f5 [ 2552.485272] out_of_memory+0x79a/0x1280 [ 2552.489272] ? retint_kernel+0x2d/0x2d [ 2552.493203] ? oom_killer_disable+0x280/0x280 [ 2552.497764] mem_cgroup_out_of_memory+0x99/0xe0 [ 2552.502474] ? memcg_memory_event+0x40/0x40 [ 2552.506834] ? _raw_spin_unlock+0x2d/0x50 [ 2552.511012] ? mem_cgroup_unmark_under_oom+0x8d/0xb0 [ 2552.516146] try_charge+0xb4a/0x1570 [ 2552.519909] ? mem_cgroup_oom_trylock+0x1a0/0x1a0 [ 2552.524785] ? rcu_lockdep_current_cpu_online+0xe3/0x130 [ 2552.530280] ? rcu_read_lock_sched_held+0x110/0x130 [ 2552.535337] ? __alloc_pages_nodemask+0x5e9/0x710 [ 2552.540230] ? do_raw_spin_unlock+0x57/0x270 [ 2552.544691] memcg_kmem_charge_memcg+0x7c/0x130 [ 2552.549401] ? memcg_kmem_put_cache+0xb0/0xb0 [ 2552.553934] ? cache_grow_begin+0x5a2/0x8c0 [ 2552.558320] ? lockdep_hardirqs_on+0x415/0x5d0 [ 2552.562948] ? trace_hardirqs_on+0x67/0x230 [ 2552.567310] cache_grow_begin+0x25f/0x8c0 [ 2552.571502] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 2552.577076] ? __cpuset_node_allowed+0x136/0x540 [ 2552.581877] fallback_alloc+0x1fd/0x2d0 [ 2552.585897] ____cache_alloc_node+0x1be/0x1e0 [ 2552.590435] kmem_cache_alloc_node_trace+0xec/0x720 [ 2552.595498] __kmalloc_node_track_caller+0x3d/0x70 [ 2552.600466] __kmalloc_reserve.isra.0+0x40/0xf0 [ 2552.605182] __alloc_skb+0x10b/0x5e0 [ 2552.609702] ? skb_scrub_packet+0x440/0x440 [ 2552.614043] ? _raw_spin_unlock_irq+0x28/0x90 [ 2552.618565] ? lockdep_hardirqs_on+0x415/0x5d0 [ 2552.623189] ? trace_hardirqs_on+0x67/0x230 [ 2552.627539] alloc_skb_with_frags+0x93/0x580 [ 2552.631963] ? finish_task_switch+0x146/0x790 [ 2552.636478] sock_alloc_send_pskb+0x72d/0x8a0 [ 2552.640993] ? smack_inet_conn_request+0xa70/0xa70 [ 2552.645952] ? sock_wmalloc+0x120/0x120 [ 2552.649939] ? unix_gc+0xdb0/0xdb0 [ 2552.653498] ? __might_sleep+0x95/0x190 [ 2552.657496] ? unix_stream_sendpage+0xb10/0xb10 [ 2552.662209] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 2552.667785] ? security_socket_getpeersec_dgram+0x93/0xc0 [ 2552.673362] unix_stream_sendmsg+0x5f7/0x990 [ 2552.677814] ? unix_stream_sendpage+0xb10/0xb10 [ 2552.682514] ? __lock_acquire+0x53b/0x4700 [ 2552.686797] ? smack_socket_sendmsg+0xb1/0x1a0 [ 2552.691408] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 2552.696987] ? security_socket_sendmsg+0x93/0xc0 [ 2552.701773] ? unix_stream_sendpage+0xb10/0xb10 [ 2552.706475] sock_sendmsg+0xdd/0x130 [ 2552.710229] sock_write_iter+0x27c/0x3e0 [ 2552.714315] ? sock_sendmsg+0x130/0x130 [ 2552.718326] ? __fget+0x340/0x540 [ 2552.721804] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 2552.727370] ? iov_iter_init+0xea/0x220 [ 2552.731387] __vfs_write+0x613/0x8e0 [ 2552.735138] ? kernel_read+0x120/0x120 [ 2552.739082] ? rw_verify_area+0x118/0x360 [ 2552.743268] vfs_write+0x20c/0x580 [ 2552.746845] ksys_write+0xea/0x1f0 [ 2552.750418] ? __ia32_sys_read+0xb0/0xb0 [ 2552.754513] ? do_syscall_64+0x26/0x610 [ 2552.758517] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 2552.763913] ? do_syscall_64+0x26/0x610 [ 2552.767929] __x64_sys_write+0x73/0xb0 [ 2552.771854] do_syscall_64+0x103/0x610 [ 2552.775781] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 2552.780993] RIP: 0033:0x457e29 [ 2552.784215] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 2552.803135] RSP: 002b:00007fc498bbbc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 2552.810884] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000457e29 [ 2552.818683] RDX: 000000001e2ba62e RSI: 0000000020000140 RDI: 0000000000000008 [ 2552.825980] RBP: 000000000073c040 R08: 0000000000000000 R09: 0000000000000000 [ 2552.833271] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fc498bbc6d4 [ 2552.840560] R13: 00000000004c7260 R14: 00000000004dcde8 R15: 00000000ffffffff [ 2552.859392] memory: usage 290600kB, limit 307200kB, failcnt 338 [ 2552.865972] memory+swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 2552.880081] kmem: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 2552.886392] Memory cgroup stats for /syz1: cache:104KB rss:171072KB rss_huge:75776KB shmem:184KB mapped_file:0KB dirty:0KB writeback:0KB swap:0KB inactive_anon:0KB active_anon:171024KB inactive_file:8KB active_file:0KB unevictable:0KB [ 2552.914253] oom-kill:constraint=CONSTRAINT_NONE,nodemask=(null),cpuset=syz1,mems_allowed=0-1,oom_memcg=/syz1,task_memcg=/syz1,task=syz-executor.1,pid=553,uid=0 [ 2552.937988] Memory cgroup out of memory: Kill process 553 (syz-executor.1) score 1160 or sacrifice child [ 2552.949481] Killed process 553 (syz-executor.1) total-vm:72972kB, anon-rss:16556kB, file-rss:35800kB, shmem-rss:0kB [ 2552.996538] syz-executor.1 invoked oom-killer: gfp_mask=0x6000c0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 2553.021200] CPU: 1 PID: 706 Comm: syz-executor.1 Not tainted 5.0.0+ #6 [ 2553.027911] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2553.037279] Call Trace: [ 2553.039896] dump_stack+0x172/0x1f0 [ 2553.043541] dump_header+0x10f/0xb6c [ 2553.047270] ? _raw_spin_unlock_irqrestore+0xa4/0xe0 [ 2553.052383] ? ___ratelimit+0x60/0x595 [ 2553.056282] ? do_raw_spin_unlock+0x57/0x270 [ 2553.060716] oom_kill_process.cold+0x10/0x6f5 [ 2553.065232] ? task_will_free_mem+0x139/0x6e0 [ 2553.069757] out_of_memory+0x79a/0x1280 [ 2553.073754] ? oom_killer_disable+0x280/0x280 [ 2553.078266] ? mem_cgroup_unmark_under_oom+0x8d/0xb0 [ 2553.083389] mem_cgroup_out_of_memory+0x99/0xe0 [ 2553.088067] ? memcg_memory_event+0x40/0x40 [ 2553.092404] ? _raw_spin_unlock+0x2d/0x50 [ 2553.096556] ? mem_cgroup_unmark_under_oom+0x8d/0xb0 [ 2553.101668] try_charge+0xb4a/0x1570 [ 2553.105398] ? find_held_lock+0x35/0x130 [ 2553.109473] ? mem_cgroup_oom_trylock+0x1a0/0x1a0 [ 2553.114334] ? kasan_check_read+0x11/0x20 [ 2553.118494] ? get_mem_cgroup_from_mm+0x128/0x2b0 [ 2553.123349] mem_cgroup_try_charge+0x24d/0x5e0 [ 2553.127948] mem_cgroup_try_charge_delay+0x1f/0xa0 [ 2553.132894] wp_page_copy+0x408/0x1740 [ 2553.136790] ? find_held_lock+0x35/0x130 [ 2553.140867] ? pmd_pfn+0x1d0/0x1d0 [ 2553.144419] ? lock_downgrade+0x810/0x810 [ 2553.148579] ? __pte_alloc_kernel+0x220/0x220 [ 2553.153087] ? kasan_check_read+0x11/0x20 [ 2553.157244] ? do_raw_spin_unlock+0x57/0x270 [ 2553.161669] do_wp_page+0x2ed/0x1520 [ 2553.165402] ? rwlock_bug.part.0+0x90/0x90 [ 2553.169643] ? lock_acquire+0x16f/0x3f0 [ 2553.173637] ? finish_mkwrite_fault+0x4f0/0x4f0 [ 2553.178336] ? add_mm_counter_fast.part.0+0x40/0x40 [ 2553.183391] __handle_mm_fault+0x22db/0x3f20 [ 2553.187828] ? vmf_insert_mixed_mkwrite+0x40/0x40 [ 2553.192693] ? find_held_lock+0x35/0x130 [ 2553.196775] ? handle_mm_fault+0x322/0xb30 [ 2553.201037] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 2553.206592] ? sync_mm_rss+0xa4/0x1c0 [ 2553.210414] handle_mm_fault+0x43f/0xb30 [ 2553.214498] __do_page_fault+0x5da/0xd60 [ 2553.218584] do_page_fault+0x71/0x581 [ 2553.222402] page_fault+0x1e/0x30 [ 2553.225879] RIP: 0010:copy_user_enhanced_fast_string+0xe/0x20 [ 2553.231784] Code: 89 d1 c1 e9 03 83 e2 07 f3 48 a5 89 d1 f3 a4 31 c0 0f 1f 00 c3 0f 1f 80 00 00 00 00 0f 1f 00 83 fa 40 0f 82 70 ff ff ff 89 d1 a4 31 c0 0f 1f 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 83 [ 2553.250714] RSP: 0018:ffff8881bcd5f728 EFLAGS: 00010206 [ 2553.256100] RAX: 0000000000000000 RBX: 0000000000001000 RCX: 0000000000000880 [ 2553.263396] RDX: 0000000000001000 RSI: ffff88814d757780 RDI: 0000000020bd9000 [ 2553.270695] RBP: ffff8881bcd5f760 R08: ffffed1029aeb000 R09: 0000000000000000 [ 2553.277991] R10: ffffed1029aeafff R11: ffff88814d757fff R12: 0000000020bd8880 [ 2553.285288] R13: ffff88814d757000 R14: 0000000020bd9880 R15: 00007ffffffff000 [ 2553.292612] ? copyout+0xe2/0x100 [ 2553.296103] _copy_to_iter+0x27e/0x1080 [ 2553.300103] ? debug_check_no_obj_freed+0x200/0x464 [ 2553.305173] ? iov_iter_copy_from_user_atomic+0xb80/0xb80 [ 2553.310746] ? check_stack_object+0x114/0x160 [ 2553.315275] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 2553.320854] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 2553.326428] ? __phys_addr_symbol+0x30/0x70 [ 2553.330775] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 2553.335822] ? __check_object_size+0x3d/0x42f [ 2553.340355] simple_copy_to_iter+0x36/0x40 [ 2553.344641] __skb_datagram_iter+0x480/0x750 [ 2553.349084] ? __lock_is_held+0xb6/0x140 [ 2553.353187] ? skb_kill_datagram+0x130/0x130 [ 2553.357661] skb_copy_datagram_iter+0x92/0x310 [ 2553.362287] unix_stream_read_actor+0x7f/0xc0 [ 2553.366809] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 2553.372384] unix_stream_read_generic+0x876/0x1c20 [ 2553.377360] ? unix_release+0x90/0x90 [ 2553.381188] ? __fget+0x340/0x540 [ 2553.384669] ? lock_downgrade+0x810/0x810 [ 2553.388844] ? finish_wait+0x260/0x260 [ 2553.392756] ? __fget+0x367/0x540 [ 2553.396222] unix_stream_recvmsg+0xc3/0x100 [ 2553.400555] ? unix_stream_splice_read+0x220/0x220 [ 2553.405502] ? unix_state_double_unlock+0x70/0x70 [ 2553.410370] ? security_socket_recvmsg+0x9b/0xd0 [ 2553.415144] ? unix_stream_splice_read+0x220/0x220 [ 2553.420101] sock_recvmsg+0xd0/0x110 [ 2553.423834] __sys_recvfrom+0x1ff/0x350 [ 2553.427824] ? __ia32_sys_send+0x100/0x100 [ 2553.432092] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 2553.437646] ? put_timespec64+0xda/0x140 [ 2553.441729] ? nsecs_to_jiffies+0x30/0x30 [ 2553.445928] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 2553.450717] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 2553.455490] ? do_syscall_64+0x26/0x610 [ 2553.459480] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 2553.464865] __x64_sys_recvfrom+0xe1/0x1a0 [ 2553.469124] do_syscall_64+0x103/0x610 [ 2553.473028] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 2553.478232] RIP: 0033:0x457e29 [ 2553.481437] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 2553.500355] RSP: 002b:00007fc498bfdc78 EFLAGS: 00000246 ORIG_RAX: 000000000000002d [ 2553.508082] RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 0000000000457e29 [ 2553.515363] RDX: fffffffffffffd84 RSI: 0000000020000180 RDI: 0000000000000005 [ 2553.522651] RBP: 000000000073bf00 R08: 0000000000000000 R09: fffffffffffffd51 [ 2553.529937] R10: 0000000000010100 R11: 0000000000000246 R12: 00007fc498bfe6d4 [ 2553.537221] R13: 00000000004c4a98 R14: 00000000004d8528 R15: 00000000ffffffff [ 2553.546893] memory: usage 274136kB, limit 307200kB, failcnt 338 [ 2553.559195] memory+swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 2553.566091] kmem: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 2553.576125] Memory cgroup stats for /syz1: cache:104KB rss:154680KB rss_huge:75776KB shmem:184KB mapped_file:0KB dirty:0KB writeback:0KB swap:0KB inactive_anon:0KB active_anon:154504KB inactive_file:8KB active_file:0KB unevictable:0KB [ 2553.633775] oom-kill:constraint=CONSTRAINT_NONE,nodemask=(null),cpuset=syz1,mems_allowed=0-1,oom_memcg=/syz1,task_memcg=/syz1,task=syz-executor.1,pid=32592,uid=0 [ 2553.654553] Memory cgroup out of memory: Kill process 32592 (syz-executor.1) score 1160 or sacrifice child [ 2553.674541] Killed process 32592 (syz-executor.1) total-vm:72972kB, anon-rss:16556kB, file-rss:35796kB, shmem-rss:0kB 13:49:11 executing program 1: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-vsock\x00', 0x2, 0x0) clone(0x100002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x0, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) dup2(r2, r0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1e2ba62e) recvfrom(r1, 0x0, 0x0, 0x0, 0x0, 0x0) recvfrom(r2, &(0x7f0000000180)=""/184, 0xfffffffffffffd84, 0x10100, 0x0, 0xfffffffffffffd51) 13:49:11 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/attr/sockcreate\x00', 0x2, 0x0) r1 = syz_open_dev$dspn(&(0x7f00000000c0)='/dev/dsp#\x00', 0xfffffffffffffff8, 0x107000) ioctl$IOC_PR_PREEMPT_ABORT(r1, 0x401870cc, &(0x7f0000000100)={0x3, 0x8001, 0xfffffffffffffff7, 0x1ff}) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='fdinfo/3\x00') exit(0x0) fchmod(r0, 0xc0) ioctl$KVM_SIGNAL_MSI(r2, 0x4020aea5, &(0x7f0000000040)={0xd000, 0x1d000, 0x1, 0x0, 0x8}) pread64(r2, 0x0, 0x0, 0x3) getsockopt$inet_IP_XFRM_POLICY(r2, 0x0, 0x11, &(0x7f0000000180)={{{@in6=@mcast1, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@loopback}, 0x0, @in=@initdev}}, &(0x7f0000000280)=0xe8) getgroups(0x4, &(0x7f00000002c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xee00, 0xee00]) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000300)={0x0, 0x0, 0x0}, &(0x7f0000000340)=0xc) r6 = getegid() fsetxattr$system_posix_acl(r2, &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000380)={{}, {0x1, 0x2}, [{0x2, 0x4, r3}], {0x4, 0x6}, [{0x8, 0x4, r4}, {0x8, 0x7, r5}, {0x8, 0x2, r6}], {0x10, 0x1}, {0x20, 0x2}}, 0x44, 0x2) 13:49:11 executing program 5: r0 = syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0x0, 0x0) ioctl$VIDIOC_SUBSCRIBE_EVENT(r0, 0x4020565a, &(0x7f0000000040)={0x3, 0x100000000098f905, 0x3}) 13:49:11 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0x0, 0x700}) 13:49:11 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x2000000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:49:11 executing program 4: signalfd4(0xffffffffffffffff, &(0x7f0000000ff8), 0x8, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000340), 0x10000014c) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x1f40}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 13:49:11 executing program 5: r0 = syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0x0, 0x0) ioctl$VIDIOC_SUBSCRIBE_EVENT(r0, 0x4020565a, &(0x7f0000000040)={0x3, 0x100000000098f905, 0x3}) 13:49:11 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0x0, 0xa00}) [ 2553.828546] binder_alloc: 759: binder_alloc_buf, no vma [ 2553.849882] binder: 759:763 transaction failed 29189/-3, size 0-0 line 3035 [ 2553.878009] binder: send failed reply for transaction 3836 to 759:763 [ 2553.904765] binder: 759:763 ioctl c0306201 20000600 returned -14 13:49:11 executing program 5: syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0x4, 0x0) ioctl$VIDIOC_SUBSCRIBE_EVENT(0xffffffffffffffff, 0x4020565a, &(0x7f0000000040)={0x3, 0x100000000098f905, 0x3}) 13:49:12 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0x0, 0xf1a}) 13:49:12 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x4800000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) [ 2554.006541] binder_release_work: 4 callbacks suppressed [ 2554.006550] binder: undelivered TRANSACTION_ERROR: 29190 [ 2554.018325] binder: undelivered TRANSACTION_COMPLETE 13:49:12 executing program 5: syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0x4, 0x0) ioctl$VIDIOC_SUBSCRIBE_EVENT(0xffffffffffffffff, 0x4020565a, &(0x7f0000000040)={0x3, 0x100000000098f905, 0x3}) 13:49:12 executing program 1: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vhost-vsock\x00', 0x2, 0x0) clone(0x100002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = dup2(r2, r0) recvfrom(r1, 0x0, 0x0, 0x0, 0x0, 0x0) recvfrom(r2, &(0x7f0000000180)=""/184, 0xfffffffffffffd84, 0x10100, 0x0, 0xfffffffffffffd51) setsockopt$RDS_GET_MR_FOR_DEST(r3, 0x114, 0x7, &(0x7f00000002c0)={@rxrpc=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x4e22, @empty}}, {&(0x7f0000000240)=""/121, 0x79}, &(0x7f0000000000), 0x1}, 0xa0) ioctl$sock_SIOCBRDELBR(r2, 0x89a1, &(0x7f00000000c0)='sit0\x00') [ 2554.054544] binder: undelivered TRANSACTION_ERROR: 29189 [ 2554.075813] binder_alloc: 782: binder_alloc_buf, no vma [ 2554.118022] binder: 782:783 transaction failed 29189/-3, size 0-0 line 3035 [ 2554.153877] binder: send failed reply for transaction 3839 to 782:783 [ 2554.165693] binder: 782:783 ioctl c0306201 20000600 returned -14 [ 2554.215955] binder: undelivered TRANSACTION_ERROR: 29190 [ 2554.221965] binder: undelivered TRANSACTION_COMPLETE [ 2554.236871] binder: undelivered TRANSACTION_ERROR: 29189 13:49:12 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = openat$null(0xffffffffffffff9c, &(0x7f00000016c0)='/dev/null\x00', 0x80000, 0x0) ioctl$KVM_SIGNAL_MSI(r1, 0x4020aea5, &(0x7f0000001700)={0x100000, 0xd000, 0x20, 0x6, 0x9}) r2 = gettid() r3 = syz_open_procfs(r2, &(0x7f0000000000)='fdinfo/3\x00') exit(0x0) pread64(r3, 0x0, 0x0, 0x3) writev(r0, &(0x7f00000002c0)=[{&(0x7f0000000040)="ffb8ffa81c6f3efce338c6df2b82d996ff63687cf00cf8a0149473c396c70c8a8d61a980a65af9d17dbe929b943d9f2781c8f5b3409f920df4fe73c0ffe3aefd7ffd9ab8e9afc6", 0x47}, {&(0x7f00000000c0)="413ae2de33085994016f010c7c9a14e3a165bc2b143a02c4923c0b52d6f5f2f1ab410b223d467f18948d8e6cd47c485f01f50a5e974d21d14a8c163ef461c1c561ea9b99c3344e8315e88b99f930b687dcaf2852a843bb54b3882bac16959fe9e25b0db65980b21c987affd67a7abc40a111566818e074c245f0af683e28f9707a6556cd6766f8e76c28e86f8b1e4eb8e367bc8ebafac39f78761b99c646c35b6581f5e4b1e52dc4ad68edfb4bc3bbf591dc6665ce8f75db64252cae4afc0c5252ef3525eac72316799aa89064f1f9be2332e26ef06403eb4f137d4e102f4a6538fcb3439159caa7de63dbd4b1eda662b891", 0xf2}, {&(0x7f00000001c0)="934f88e362c7e7a773fad866ea0b4f7cf3dc2b89072e0ef4d77ec8a6ada1b22d57b888c1d3ac45b9f8494d8afcda8394e468864e453ef6b431c2faa23afa7a0f437e398bb6de5b52628d6a487e6e2acb1d7b775867de1a7a86258a17f13b88c2f69e20ce871c63a628eed8dd02ed3eaf4fd7bdb7e433f0de7e8b386f9387456b592ace67ae6b1cc4231636685b1865a870532041e67eafa257ef9bef6e5a0b4f519081b18b7cef73029c9663128aa6837aba7ea97c2b9949460d32dc947e21b730c3a58f17093cf09fb4421993b070cf78c581318e5200a58eba00117cbcb19222b0ef7a6d395c90", 0xe8}], 0x3) sendmmsg$unix(r3, &(0x7f0000001680)=[{&(0x7f0000000300)=@abs={0x0, 0x0, 0x4e20}, 0x6e, &(0x7f0000001600)=[{&(0x7f0000000380)="0854496e2489fea0d026f0909f5258b8aecf46b4e7ddac06c88b977babdbd4a5766c0bd80f44a8d12f7a492dba2004b1dfa5e6ce8dbc1120c3e60e22461107f4a038c732f05596377899a1910c73eccb5670684661012b48611c284b1a152f4116a581a47966c5f9d06f911c8ba08fd09399febb0c8f3e992d0279b1136afac2360ae5d070367a7ab5c58cea72be5cf61b3f990d82172b73baafb2ca42", 0x9d}, {&(0x7f0000000440)="257211631c50858a071e409ed5a56a3d25761f298a78468c6532e93ece6e07d529412ee830ef8ee94ad8a16a4c5c1f8eee83b6ade056536ffbc951433b0b72e1f790299ffe3566674923178b0a1c1863dcc57adfa6ad41", 0x57}, {&(0x7f00000004c0)="9f112aa1b2dca5525a3d731293fb3c9ecab50ca075999854180463b56664059fb6666c04778566f8cc52073acde22bb252ba9125767c35db5d059732778b3f", 0x3f}, {&(0x7f0000000500)="19093482ffefd43033c6b9c4635440d8c92474e2c951266d94a8e69430602cf119efd6b4b3fde3621fc7eb3798de100477a31d5d4f0b7cff6c1f1466acfdc649a44c733c154d924708968b181dc2e6e13862af39b9eb3ca8cb127074f5c4080a23fd743a516da12678cb96999e85cc2d419a058b729ff937ee3442c113ca14debea42c86a1cb9f0d01677a34ca1482c1fc85523ac507c0b921a083152eb631cc38b30a8aabb2a7cde348b26bd4a339a5647cf1f19199e8193aeea3c0729975a70dbca8945250c717750abfcbc050ba598fd31ede75ee99676f50a6121cf4ce8e5b9bb87ed589f4cd467c4917d5d4187ce89d92ca850b87875318b68a93bed503aa0c92afd9c5c928def571fc2f8dac0789d915c0957a078142391ea5a9eb9c32e575c17d3712c04bf79248b6bb20f1cb4371a88483f9b1cb40ccceb3c22f59bce04b4993c95ae38b4415f144e1f52b8069a8fe52e1fb1c1f041ab64eff2be42cf33f564f72801d2cfd6149e80e9756157e10c9cbaabab40327a313f8b6c6d0e74271db1b31f344729eb32d1231a4e6a07f4e75c0209f86ab9d4000a83643c6952bf6488945abd730f09c1b38dabba0a48a94aa26ca44c029e40fbc6c1a866d7b4311d31664a2fd0469c078aadeb2374b4c77facd0b717a5190bb9624feaa8f88c897a94720a4d7ca57fe39f1eabd5e1aea7a2aa6028c36d4249aec44e0271853875a7f895bafaa86bcb98000aeaa4ae020c2706f7453a470d51f0f3e3cce9ed6a83bb6bb13efb87b93d5345b4373a1a8d25a0e5ad1501723015df74e5571865dcfbbf60e7d504cb9060eaef96614e9ebe156c87e6f27607bbebca03165c042448a9e2afe42b62c50e6bdde1aa33f04ae5167221fa099eeb2d5e4f579483b886f0554c47dc88d1dd4ca13daabd6c7cb488b5fce2b26aef3b192b219da10f7ed8becf28a8a0eb2e78f4129581d6b1d25fff8da3001748153a243601110fde3c5c4a2ffcffc946c6b38f47ba95af2e7b3af16499d46b65ddaec38ac828b75f391f6f079fe9b99aa7f7cb90bef6039806b8c0e1ad26e4ee05ef86ada1368a71b8997cef505d659a9591a1dd705c0e81acc7dcf794b102343c9e5745f7af39a2451579cc957c2bf3c6b1a7a95ebd08ff7282eaac61a2ca9ad5728cb3ae750501102fc448ad9e4e3c51e5ea04a74cd236dee6efb62857c1a04d79fd1bc9841b83b1794f87306a144384f3e702fb9d0be11c8cb1ea05ec0784a376e8a056288064071e92312e5593260e4e5451d9ab09a3a07cce1add948767a595da098c69cdb3083ab93d4f398860a3938c683f7facf3c785733ea456c862ad2eba9f87857484f4a183e4e2aa28292ae51038c491fa753f844d46bca79b6486f92db08745f21c3cff620f164ce3afacf789f66beb3305c931044653a1e3b20561dbcb9b426a40016968256a3171926114e958513ee2347bf142c781bd01a19d23e29d94320465695108ea38fafb2214832a5ed0a59a5d1709ece97976234398efcd611b9e97b1e7ff0c5530d3ad08177af26052bd20eae2cec776f31db701a9a42f88c8f54f43bc175c97aece02cc58b935852bd46ec021c375668e37af5e9a9255e7f6ef59e5de77007d45b72af30c5cb44be60a6fca8e94443326db7aa4984e5423c6cf0222197d787d8bc5698c2335f6c4e922cb1c51b64015c5262c0e685f8f467b55cbb118003f55ee98722b37ab8a988121c964cfd9b7f616ecb3b70458335f906925b30c3fd9899e99207d31d3aa6b5b44a26ec0b5a56ef1d8b7c2dab612ab941cfaa1de78003cff048d022af984614d71f43c9ff0e71b35818996dc954afa69610d2e90c6214fb74af3c8551c7b9d2343608fa05ac592be9460c8c0d80de27797f4c37c76017cd33300db4b54707c672f369e6aa8d0b98c25c1b2e7ae18a3a6dd2ed9846fae17c458a84c934b719fd4d776ec1b990ee148a1023f5aafff3d345576a3d59b900ad2ba2b7610324ba4950fdecc78b92372100051f075891052c0fb0b8fea42ecf1c16507dc8a72530b70a8f5e109092390c55d75b7062041c04904a68c95914d808fe979b1025f527ad37736d83dc9ea4541e61d25a2204bd0c10195c083621ad65baa12b20558aa1d0aaa1cc62fca4ab71e1600c6131bdd36c528f7aa9989f2f4a87a396b66672e522b3100b23751a6b483c7772a30e5990bf6c1f6f8de13d5d9b56daab47bfcde1f8c53e64ca2de0cdde752bf8ac182cd02d3256f9d7f1269ebdfa2340dc05ade79ddba9dbe0470cc651ec6e5063d17201bcec16f3807d2de4aeafdb822c7d0f679d28911aadad7273fd4d60a457075e915d1e94ce04d147337ec33d326b2850edfd2ceb29dadc2850970f5fdc465dd9357433cb1c6cb751e6455cd08796b67e9630fe1e5fe4eb1c9d00f8866b170aa0b2bf0cffcb1f86590c26ed829ce603bb57d94b7c4d8501af7cbb82f4804535837595a3d5d155f4e37300c7ce92972566c31eb20dc1454d7a531b1c64eab00598c70dc1ccc26339837d67c87a2340c09d0c65990454960e9afb82ad488a1bae5ad99a7e6f228c276b7954d05e2aed5bb7e2a3db026c6d28619ecc66914af0caf4c6e88a216e27c8c679b7717cff15e7bee28478594304324815bb497751ec3e2f66286d86c7c3604bdcb69abd9100fb1886d8db2fe0f28eeee13cc748494b812cb5feadfa7a2610c16de8ad8ae5f51fc030c693268ed4b12a731dc4d0ca3fec0778667d7922f03bf3f683c81c13928e659fa7679db1c7fac3e9a8a177ff017840b80403ecb7a5dfcc99e38b7d4f9fcf249eff377bc084b0746d9736117847e6f68e9c31b5baa73e025da75e3a558369efcdc593909d5de82b057305e6d5ea292b93d3cf6a0b65741c97696b992d92d6354fd19c20dc52f67390d23e23ea8545dca29db002cdaeaae6a2fa194958af11d608100eecf2fe2acbc097b6a2b94df219c3f2bc370ba38ed6c6596d92b1a07a6bc5708957836acc74385b177edd30d3ba2b3514f203dba461929d5fdf2db75f23521a3978a93cddcc93182d0d609f5a8cd8f2f84abcc130ec8a3717728f081862247b3c12c5a806dea0e213a536fe22efee631c8dfd80fa4fe86d4005adcfedd4a5531059596afd0145e2f21980e5048f218bbd5b1d2ff5de72998424a47c10e0dde1961d9a641852cae6432fd457fe6082bc93058092cbe4f331d4687da097d3f4bb875a9096cf8f9a6d073b80b35d9e630090affc55afce7161448c7d8b69c05b91f22f4ff682121d8ff0d7b1383288f55bd0684062ab029a7e54db0aee409cb6ed1afd88ce5d26a225ee998e8d32876babe6df41e6e29ecb8765483adeb3b63876007d7d581de1f1e3be5843b7384278863c4bbbbdee49dc00d63abe9ecee020c53969881176a0e43fe5e9fbdc1238bed1895b05d1a85720637758fabc573c2fb3f565b7e523cfb8f0c962635afddf4baf9caa398e6f8095115f12bb1ebd057466bc609130c80f0b32e592f1ebff53fd12d9d71cbab5d9b8df9f831a7bfe8b68fdbb9e4dac1ed61b39e1ce6f25a9c5de8bdc1143aa26853a77702925f4182e2715e222da31bd3f01b8029ea86aa8103a7134a94bcc8ac612628a1bcd0e19fd46ca9d4276f718997712d9448ef6cb22c55e7eaad52ec31bf5a90c4077805cd0872cd691ecf0d71999d18fcc22f0e5cf38e7a3d4a5c6d1bbce005f441df87dff4cff3b833d2912e811d16e3a336309478a07e10be3f274b44b5d7debea19ed881315a7199db1317e1c1b24c0bf037a717dd1c7061732f8189afd883e980db21a49ccbd7b5a309c68eed60530a5edd51b2feceb000846bbea2925837a02ddc5c24fd4071f150502a7dcac903d438ed9e83a8859bf3c36915aad6a121249510f516d378b8314fa8648f2e6ec00237407d67e6148785f7e98a80d32ac71d68888cd411a9da2b94a88c6684e1ca72848e3069143a2e0a2d480a6ad42bdaf6d963f4d644aca8e1449cdcfa8047c0a00d29e3a890426ba716cd68a32fc377dc19ed6a9045b7c180fed808d0139d9e19775e1de8d1b325623b8d4ca4b6e3a0d6dbac4d98abf42346b74556b28d53be0f87b96e000ddae38d9ecf8834a565eebc69d2465d97d373001650492443c342e231da1e2e3e47de77c49b3cbfc70f62faf009f315e97cf4fd575599a3d899717cbcb941ec530acfe623dce67ef541f3f0e59a40e912f6969592628adcde87dc6323b203e498c1fc2dd034fdfa8b2e64edc126ffaae73f2e2d1b2d6759a92540def5c89cd22f6929054bc51a7ac693ee7bc7ab1378a73c6ff5d834e5098d6950fccd467d37dddc5d73029ca1dd7c861d8c5e54d586d4ea434106be48bd892d4af9b6ce93c603e22e648c92285af48889686ff5e063744a274668f42f1c414cba6a36a64b535e06cbfc33573bb047163fed5afa308f4703d0c88e1f7d6824e0ce27715caff4abf698d00f53b68ceb2f009ef1178ddab9d1f252ff1857096239aece192bfe9c457270c5fc581f93b517cabaf80ee280fba7569d753634d9c8c3d191f94d0d819026c7416a630279b9dceb40f48cbe01d01b4ea287425e0395d8f52a318a02e16733a4d5bcddb740a4bd368df1fc33354f1a6bd730e826bfacd72a6525683eccb757a0915caca707323d0ed1aa276d39adf72ecc0f1243f7db299e4d49295e0237574cf46196d77751c5197ed9197b6a784fddbdd33d0a6ca6805a4679ece88e1c70ee06ba2c591f6eaa51e00aabe5673ebc136e0cf12156b9b48ab0b8ed6dc677fbd02f2fe3850247086a22f2b38a5d0d28226094bfbdb0921198b47b9b6354c9751dfe10887a41840fe7a78b6622f4a144d7dd6cec5e36d4abdf1dc8d4c01e1d1589191057cb86dcda15b8ab83bc345407036f9e052823314321420905f7c4342119922ac1eafbbd699abd3e46d5a975b36d8e96c1158fcd77ec62fa629cbbecc3a8dd621f87036974955efc87e79ac4da33cb35f601fb03f79f7868002a617d2d8220727da7fdcf0fc21a6f288e2849bc54f7e6e6408fa0a3b9cb8aec03c0347ded42a8e5914949cf1a83d79a0270f8ddfcdf66ec63b5ff3e284d20dd0e143c746dadf2c137958b0b6e1b7d6987cfcd3a9df92411860244af8947a8a78e04d067c16f23276bf7eaa830526bcc5614f2e7f1a85414fd127b980527696ffb58295aab34fd469d3a36afade7194122483f0cc614ac6946037edef99e662f3c26d6cfb9547f954752cf5e143f13a9484468345bf21d3f740cc387445c5ee6d71a4b100336b6d9b57f4961308c3c49854ec814f997a1983a1fdc8b911c09ee3b71901e937ce24d4e00bede06dd7a883d469ddf1697e5c928f94d1842ae7afb142d1d35a020234599b712cea287875a912618d3cb0766b74770c190a1cb577caa1e4f10fdcf6ae9600a6c8bf4ae5848fde3db73107494f6e927123ef95c1dea8b79a4ada3a9bd1e2d186335cc1a4954124d2e985bae962970d46cb5709383bc264f276dcbea95db18b83f5371237f05d12c0bff33c071772f371178e5897bb9ce9d6c3fec534f3b8c4ed79516de40d4da63a7f7187e7207a333ba90f617d3f1df3eb91d0370410588b4bdc0bef43a4b967ae2ea2dc645a0ec01074a1ecd2c716fc03038638be59241cb052daa371fd943d4426d70a7f6748a5790d225ac17af9e4ec3d6130a202be9ce1fb4232c723cd2ecc667fbf059308422ac9debdfb24a965a6c26f826ffa14ff5c352d0ee22372f783410954e354b68cb0a3410bb9d7f1ed5472275e5c951a30", 0x1000}, {&(0x7f0000001500)="dd0023d162fc1bc9f948080793d7248eeff10e504daa7744082841c0a52aba78de5d3f5854043e878e99fbf19210002be242a73c59f7aa0c8de1c3e173fe43edfefbc11d47ffb8c65a2d0e66ab95bf92f0c1f82c60599f941dcb612b069063c0ccd138e3ac76b591f433fb2e18b8cffd237bb4ee906e805a50b3fa99d3e4f28bc63716bc19c6957162781c717cd543718679bb85076e2a45950edb198c6a947ac7a89828662a831e0b790d2a4bd531a4503970b316d3eeda27dee83aec1073ec93efd49e7d", 0xc5}], 0x5, 0x0, 0x0, 0x800}], 0x1, 0x4011) 13:49:12 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0x0, 0x1a0f}) 13:49:12 executing program 5: syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0x4, 0x0) ioctl$VIDIOC_SUBSCRIBE_EVENT(0xffffffffffffffff, 0x4020565a, &(0x7f0000000040)={0x3, 0x100000000098f905, 0x3}) 13:49:12 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x4c00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) [ 2554.673267] binder_alloc: 796: binder_alloc_buf, no vma 13:49:12 executing program 4: signalfd4(0xffffffffffffffff, &(0x7f0000000ff8), 0x8, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000340), 0x10000014c) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x2000}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 13:49:12 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0x0, 0x1f00}) 13:49:12 executing program 5: r0 = syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0x4, 0x0) ioctl$VIDIOC_SUBSCRIBE_EVENT(r0, 0x4020565a, 0x0) [ 2554.714184] binder: 796:798 transaction failed 29189/-3, size 0-0 line 3035 [ 2554.734125] binder: send failed reply for transaction 3842 to 796:798 13:49:12 executing program 5: r0 = syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0x4, 0x0) ioctl$VIDIOC_SUBSCRIBE_EVENT(r0, 0x4020565a, 0x0) [ 2554.768571] binder: 796:798 ioctl c0306201 20000600 returned -14 13:49:12 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0x0, 0x2000}) 13:49:12 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x6000000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) [ 2554.858537] binder: undelivered TRANSACTION_ERROR: 29190 [ 2554.864361] binder: undelivered TRANSACTION_COMPLETE [ 2554.877113] binder: undelivered TRANSACTION_ERROR: 29189 13:49:12 executing program 5: r0 = syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0x4, 0x0) ioctl$VIDIOC_SUBSCRIBE_EVENT(r0, 0x4020565a, 0x0) 13:49:13 executing program 1: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-vsock\x00', 0x2, 0x0) clone(0x100002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x7, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = dup2(r2, r0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1e2ba62e) recvfrom(r1, 0x0, 0x0, 0x0, 0x0, 0x0) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000100)='TIPCv2\x00') sendmsg$TIPC_NL_PEER_REMOVE(r3, &(0x7f00000002c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x80000400}, 0xc, &(0x7f0000000140)={&(0x7f0000000240)={0x5c, r4, 0x820, 0x70bd2d, 0x25dfdbfd, {}, [@TIPC_NLA_NET={0x48, 0x7, [@TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x40}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x3f}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0xb24c}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x8}]}]}, 0x5c}, 0x1, 0x0, 0x0, 0x10}, 0x40000) recvfrom(r2, &(0x7f0000000180)=""/184, 0xfffffffffffffd84, 0x10100, 0x0, 0xfffffffffffffd51) [ 2554.939137] binder_alloc: 818: binder_alloc_buf, no vma [ 2554.963831] binder: 818:820 transaction failed 29189/-3, size 0-0 line 3035 [ 2554.997984] binder: send failed reply for transaction 3845 to 818:820 [ 2555.004639] binder: 818:820 ioctl c0306201 20000600 returned -14 [ 2555.098119] binder: undelivered TRANSACTION_ERROR: 29190 [ 2555.104517] binder: undelivered TRANSACTION_COMPLETE [ 2555.118150] binder: undelivered TRANSACTION_ERROR: 29189 13:49:13 executing program 2: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x40000, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r0, 0x40605346, &(0x7f00000000c0)={0x800, 0x0, {0x3, 0x0, 0x400, 0x3, 0x1ff}}) ioctl$PERF_EVENT_IOC_PERIOD(r0, 0x40082404, &(0x7f0000000040)=0x3) socket$netlink(0x10, 0x3, 0x0) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='fdinfo/3\x00') exit(0x0) pread64(r1, 0x0, 0x0, 0x3) 13:49:13 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0x0, 0x3f00}) 13:49:13 executing program 5: r0 = syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0x4, 0x0) ioctl$VIDIOC_SUBSCRIBE_EVENT(r0, 0x4020565a, &(0x7f0000000040)={0x0, 0x100000000098f905, 0x3}) 13:49:13 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x6800000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) [ 2555.583203] binder_alloc: 834: binder_alloc_buf, no vma [ 2555.603291] binder: 834:836 transaction failed 29189/-3, size 0-0 line 3035 [ 2555.621922] binder: send failed reply for transaction 3848 to 834:836 [ 2555.634752] binder: 834:836 ioctl c0306201 20000600 returned -14 [ 2555.660988] binder: undelivered TRANSACTION_ERROR: 29190 [ 2555.666909] binder: undelivered TRANSACTION_COMPLETE [ 2555.679203] binder: undelivered TRANSACTION_ERROR: 29189 13:49:13 executing program 4: signalfd4(0xffffffffffffffff, &(0x7f0000000ff8), 0x8, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000340), 0x10000014c) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x4000}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 13:49:13 executing program 1: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-vsock\x00', 0x2, 0x0) clone(0x100002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = syz_open_dev$amidi(&(0x7f00000000c0)='/dev/amidi#\x00', 0x5, 0x0) setsockopt$SO_VM_SOCKETS_BUFFER_MIN_SIZE(r3, 0x28, 0x1, &(0x7f0000000100), 0x8) setsockopt$inet6_udp_int(r3, 0x11, 0xb, &(0x7f0000000140)=0x9, 0x4) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) dup2(r2, r0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1e2ba62e) recvfrom(r1, 0x0, 0x0, 0x0, 0x0, 0x0) recvfrom(r2, &(0x7f0000000180)=""/184, 0xfffffffffffffd84, 0x10100, 0x0, 0xfffffffffffffd51) 13:49:13 executing program 5: r0 = syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0x4, 0x0) ioctl$VIDIOC_SUBSCRIBE_EVENT(r0, 0x4020565a, &(0x7f0000000040)={0x0, 0x100000000098f905, 0x3}) 13:49:13 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0x0, 0x4800}) 13:49:13 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x6c00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) [ 2555.764730] binder_alloc: 847: binder_alloc_buf, no vma 13:49:13 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0x0, 0x4c00}) 13:49:13 executing program 5: r0 = syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0x4, 0x0) ioctl$VIDIOC_SUBSCRIBE_EVENT(r0, 0x4020565a, &(0x7f0000000040)={0x0, 0x100000000098f905, 0x3}) [ 2555.813242] binder: 847:848 transaction failed 29189/-3, size 0-0 line 3035 [ 2555.853521] binder: send failed reply for transaction 3851 to 847:848 [ 2555.874356] binder: 847:848 ioctl c0306201 20000600 returned -14 13:49:13 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x7400000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) [ 2555.947765] binder: undelivered TRANSACTION_COMPLETE [ 2556.005406] binder_alloc: 863: binder_alloc_buf, no vma [ 2556.019201] binder: 863:864 transaction failed 29189/-3, size 0-0 line 3035 [ 2556.038061] binder: send failed reply for transaction 3854 to 863:864 [ 2556.054277] binder: 863:864 ioctl c0306201 20000600 returned -14 [ 2556.116140] binder: undelivered TRANSACTION_COMPLETE 13:49:14 executing program 2: socket$netlink(0x10, 0x3, 0x0) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='fdinfo/3\x00') exit(0x0) pread64(r0, 0x0, 0x84, 0x0) 13:49:14 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0x0, 0x6000}) 13:49:14 executing program 5: r0 = syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0x4, 0x0) ioctl$VIDIOC_SUBSCRIBE_EVENT(r0, 0x4020565a, &(0x7f0000000040)={0x3, 0x0, 0x3}) 13:49:14 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x7a00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) [ 2556.469152] binder_alloc: 869: binder_alloc_buf, no vma [ 2556.474633] binder: 869:870 transaction failed 29189/-3, size 0-0 line 3035 [ 2556.498739] binder: send failed reply for transaction 3857 to 869:870 [ 2556.505438] binder: 869:870 ioctl c0306201 20000600 returned -14 [ 2556.586662] binder: undelivered TRANSACTION_COMPLETE 13:49:14 executing program 4: signalfd4(0xffffffffffffffff, &(0x7f0000000ff8), 0x8, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000340), 0x10000014c) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x401f}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 13:49:14 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0x0, 0x6800}) 13:49:14 executing program 5: r0 = syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0x4, 0x0) ioctl$VIDIOC_SUBSCRIBE_EVENT(r0, 0x4020565a, &(0x7f0000000040)={0x3, 0x0, 0x3}) 13:49:14 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0xffefffffff7f0000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:49:14 executing program 1: openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-vsock\x00', 0x2, 0x0) clone(0x100002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = dup2(r1, r1) setsockopt$IP_VS_SO_SET_FLUSH(r2, 0x0, 0x485, 0x0, 0x0) write$binfmt_misc(r0, &(0x7f0000000140)=ANY=[], 0x1e2ba62e) recvfrom(r0, 0x0, 0x0, 0x0, 0x0, 0x0) recvfrom(r1, &(0x7f00000000c0)=""/184, 0x8d, 0x10100, 0x0, 0x0) [ 2556.795457] binder_alloc: 883: binder_alloc_buf, no vma [ 2556.808847] binder: 883:885 transaction failed 29189/-3, size 0-0 line 3035 [ 2556.816037] binder: send failed reply for transaction 3860 to 883:885 [ 2556.838396] binder: 883:885 ioctl c0306201 20000600 returned -14 13:49:14 executing program 5: r0 = syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0x4, 0x0) ioctl$VIDIOC_SUBSCRIBE_EVENT(r0, 0x4020565a, &(0x7f0000000040)={0x3, 0x0, 0x3}) 13:49:14 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0x0, 0x6c00}) 13:49:14 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0xffffffffff600000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) [ 2556.895788] binder: undelivered TRANSACTION_COMPLETE [ 2556.974766] binder_alloc: 898: binder_alloc_buf, no vma [ 2557.002819] binder: 898:903 transaction failed 29189/-3, size 0-0 line 3035 [ 2557.021369] binder: send failed reply for transaction 3863 to 898:903 [ 2557.034716] binder: 898:903 ioctl c0306201 20000600 returned -14 [ 2557.092939] binder: undelivered TRANSACTION_COMPLETE 13:49:15 executing program 5: r0 = syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0x4, 0x0) ioctl$VIDIOC_SUBSCRIBE_EVENT(r0, 0x4020565a, &(0x7f0000000040)={0x3, 0x100000000098f905}) 13:49:15 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0x0, 0x7400}) 13:49:15 executing program 2: getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffff9c, 0x29, 0x22, &(0x7f00000010c0)={{{@in=@empty, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast2}, 0x0, @in=@dev}}, &(0x7f00000011c0)=0xe8) bpf$PROG_LOAD(0x5, &(0x7f0000001200)={0x1f, 0x8, &(0x7f0000000000)=@framed={{0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x5}, [@ldst={0x3, 0x3, 0x7, 0x0, 0xf, 0x0, 0x1d}, @ldst={0x2, 0x3, 0x3, 0x0, 0xb, 0x4, 0xfffffffffffffff0}, @generic={0x7, 0x0, 0x1000, 0x81, 0x401}, @call={0x85, 0x0, 0x0, 0x12}, @jmp={0x5, 0x4, 0x0, 0x8, 0x0, 0x1, 0xffffffffffffffff}]}, &(0x7f0000000040)='syzkaller\x00', 0xff, 0x1000, &(0x7f00000000c0)=""/4096, 0x41000, 0x1, [], r0, 0x7}, 0x48) socket$netlink(0x10, 0x3, 0x0) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='fdinfo/3\x00') exit(0x0) pread64(r1, 0x0, 0x0, 0x3) 13:49:15 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) [ 2557.433538] binder: 907:909 ioctl c0306201 20000600 returned -14 13:49:15 executing program 4: signalfd4(0xffffffffffffffff, &(0x7f0000000ff8), 0x8, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000340), 0x10000014c) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x4d01}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 13:49:15 executing program 5: r0 = syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0x4, 0x0) ioctl$VIDIOC_SUBSCRIBE_EVENT(r0, 0x4020565a, &(0x7f0000000040)={0x3, 0x100000000098f905}) 13:49:15 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0x0, 0x7a00}) 13:49:15 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:49:15 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x2303}) r1 = socket$kcm(0x29, 0x5, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$KVM_SET_REGS(r0, 0x4090ae82, 0x0) close(r0) [ 2557.832349] binder: 920:922 ioctl c0306201 20000600 returned -14 13:49:15 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0x0, 0x3aa8a}) 13:49:15 executing program 5: r0 = syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0x4, 0x0) ioctl$VIDIOC_SUBSCRIBE_EVENT(r0, 0x4020565a, &(0x7f0000000040)={0x3, 0x100000000098f905}) 13:49:15 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) [ 2557.970741] device nr0 entered promiscuous mode 13:49:16 executing program 5: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000040)='net/protocols\x00') lseek(r0, 0x4000000000000, 0x0) 13:49:16 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0x0, 0x3aa8b}) [ 2558.109690] binder: 938:942 got reply transaction with no transaction stack [ 2558.124724] binder: 938:942 ioctl c0306201 20000600 returned -14 13:49:16 executing program 2: socket$netlink(0x10, 0x3, 0x0) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='fdinfo/3\x00') ioctl$SG_SET_DEBUG(r0, 0x227e, &(0x7f0000000000)) exit(0x36) pread64(r0, 0x0, 0x0, 0x3) 13:49:16 executing program 5: [ 2558.462362] binder: release 938:939 transaction 3872 in, still active [ 2558.560310] device nr0 entered promiscuous mode 13:49:16 executing program 4: signalfd4(0xffffffffffffffff, &(0x7f0000000ff8), 0x8, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000340), 0x10000014c) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x7c15}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 13:49:16 executing program 5: 13:49:16 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0x0, 0x1000000}) 13:49:16 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:49:16 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x2303}) r1 = socket$kcm(0x29, 0x5, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$KVM_SET_REGS(r0, 0x4090ae82, 0x0) close(r0) 13:49:16 executing program 5: 13:49:16 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0x0, 0x2000000}) [ 2558.885934] binder_alloc_new_buf_locked: 2 callbacks suppressed [ 2558.885943] binder_alloc: 958: binder_alloc_buf, no vma [ 2558.914216] binder_transaction: 3 callbacks suppressed [ 2558.914236] binder: 958:964 transaction failed 29189/-3, size 0-0 line 3035 13:49:17 executing program 5: [ 2558.938660] binder_send_failed_reply: 3 callbacks suppressed [ 2558.938672] binder: send failed reply for transaction 3875 to 958:964 [ 2558.972970] binder: 958:964 ioctl c0306201 20000600 returned -14 13:49:17 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:49:17 executing program 5: [ 2559.076343] binder_release_work: 16 callbacks suppressed [ 2559.076352] binder: undelivered TRANSACTION_ERROR: 29190 [ 2559.086789] device nr0 entered promiscuous mode [ 2559.096590] binder_release_work: 3 callbacks suppressed [ 2559.096595] binder: undelivered TRANSACTION_COMPLETE [ 2559.114710] binder: undelivered TRANSACTION_ERROR: 29189 [ 2559.211720] binder: 975:978 got reply transaction with no transaction stack [ 2559.230281] binder: 975:978 transaction failed 29201/-71, size 0-0 line 2801 13:49:17 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl$EXT4_IOC_MIGRATE(r0, 0x6609) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='fdinfo/3\x00') exit(0x0) pread64(r1, 0x0, 0x0, 0x3) 13:49:17 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind(r0, &(0x7f0000000200)=@ll, 0x80) [ 2559.263589] binder: 975:978 ioctl c0306201 20000600 returned -14 [ 2559.620608] binder: release 975:976 transaction 3878 in, still active [ 2559.627607] binder: send failed reply for transaction 3878 to 975:976 [ 2559.635897] binder: undelivered TRANSACTION_ERROR: 29201 [ 2559.641721] binder: undelivered TRANSACTION_COMPLETE [ 2559.646970] binder: undelivered TRANSACTION_ERROR: 29189 13:49:17 executing program 4: signalfd4(0xffffffffffffffff, &(0x7f0000000ff8), 0x8, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000340), 0x10000014c) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x7d00}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 13:49:17 executing program 5: 13:49:17 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0x0, 0x3000000}) 13:49:17 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:49:17 executing program 1: 13:49:17 executing program 1: 13:49:17 executing program 5: 13:49:17 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0x0, 0x4000000}) [ 2559.873430] binder_alloc: 989: binder_alloc_buf, no vma [ 2559.905922] binder: 989:991 transaction failed 29189/-3, size 0-0 line 3035 [ 2559.937565] binder: send failed reply for transaction 3881 to 989:991 [ 2559.948049] binder: 989:991 ioctl c0306201 20000600 returned -14 13:49:18 executing program 1: 13:49:18 executing program 5: [ 2560.073557] binder: undelivered TRANSACTION_ERROR: 29190 [ 2560.080657] binder: undelivered TRANSACTION_COMPLETE [ 2560.100010] binder: undelivered TRANSACTION_ERROR: 29189 13:49:18 executing program 2: socket$netlink(0x10, 0x3, 0x0) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='fdinfo/3\x00') socket$netlink(0x10, 0x3, 0x15) exit(0x0) pread64(r0, 0x0, 0x0, 0x0) 13:49:18 executing program 1: 13:49:18 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:49:18 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0x0, 0x5000000}) 13:49:18 executing program 5: 13:49:18 executing program 4: signalfd4(0xffffffffffffffff, &(0x7f0000000ff8), 0x8, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000340), 0x10000014c) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x9a02}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 13:49:18 executing program 1: 13:49:18 executing program 1: 13:49:18 executing program 5: 13:49:18 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0x0, 0x6000000}) [ 2560.915029] binder_alloc: 1011: binder_alloc_buf, no vma [ 2560.945982] binder: 1011:1016 transaction failed 29189/-3, size 0-0 line 3035 13:49:19 executing program 1: [ 2560.984717] binder: send failed reply for transaction 3884 to 1011:1016 [ 2561.017809] binder: 1011:1016 ioctl c0306201 20000600 returned -14 13:49:19 executing program 5: 13:49:19 executing program 2: socket$netlink(0x10, 0x3, 0x0) r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x4, 0x101000) getsockopt$MISDN_TIME_STAMP(r0, 0x0, 0x1, &(0x7f0000000140), &(0x7f0000000180)=0x4) r1 = openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x10000, 0x0) faccessat(r0, &(0x7f00000001c0)='./file0\x00', 0x0, 0x400) r2 = socket$inet6_udp(0xa, 0x2, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fsetxattr$security_smack_entry(r2, &(0x7f0000000000)='security.SMACK64IPOUT\x00', &(0x7f00000000c0)='GPLvboxnet0em1md5sum\x00', 0x15, 0x2) connect$inet6(r2, &(0x7f0000000040)={0xa, 0x0, 0x0, @remote, 0x5}, 0x1c) r3 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r3, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r2, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) sendmmsg(r3, &(0x7f0000005fc0), 0x80000000000006a, 0x0) ioctl$KVM_SET_CPUID(r1, 0x4008ae8a, &(0x7f00000000c0)=ANY=[@ANYBLOB="03000000000000001900008009000000000000805f42000009000000000400000009000000f9ffffff000000000f00008001000000060000000800000000800000000000000000000000000000000000"]) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='fdinfo/3\x00') exit(0x0) pread64(r4, 0x0, 0x0, 0x3) 13:49:19 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x48, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) [ 2561.106789] binder: undelivered TRANSACTION_ERROR: 29190 [ 2561.117602] binder: undelivered TRANSACTION_COMPLETE [ 2561.147718] binder: undelivered TRANSACTION_ERROR: 29189 13:49:19 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0x0, 0x7000000}) 13:49:19 executing program 1: 13:49:19 executing program 5: [ 2561.197150] binder_alloc: 1031: binder_alloc_buf, no vma [ 2561.228606] binder: 1031:1032 transaction failed 29189/-3, size 0-0 line 3035 [ 2561.259557] binder: send failed reply for transaction 3887 to 1031:1032 [ 2561.286912] binder: 1031:1032 ioctl c0306201 20000600 returned -14 [ 2561.370372] binder: undelivered TRANSACTION_ERROR: 29190 [ 2561.376715] binder: undelivered TRANSACTION_COMPLETE [ 2561.390037] binder: undelivered TRANSACTION_ERROR: 29189 13:49:19 executing program 4: signalfd4(0xffffffffffffffff, &(0x7f0000000ff8), 0x8, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000340), 0x10000014c) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x2000b}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 13:49:19 executing program 1: 13:49:19 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0x0, 0x8000000}) 13:49:19 executing program 5: 13:49:19 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x4c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:49:19 executing program 1: 13:49:20 executing program 5: [ 2561.930031] binder_alloc: 1054: binder_alloc_buf, no vma [ 2561.935560] binder: 1054:1055 transaction failed 29189/-3, size 0-0 line 3035 [ 2561.968160] binder: send failed reply for transaction 3890 to 1054:1055 13:49:20 executing program 2: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='fdinfo/3\x00') exit(0x0) connect$rose(r0, &(0x7f0000000040)=@short={0xb, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, 0x1, @default}, 0x1c) pread64(r0, 0x0, 0x0, 0x3) mkdirat(r0, &(0x7f0000000000)='./file0\x00', 0x180) 13:49:20 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0x0, 0xa000000}) [ 2561.993800] binder: 1054:1055 ioctl c0306201 20000600 returned -14 13:49:20 executing program 5: 13:49:20 executing program 1: 13:49:20 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x60, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) [ 2562.115124] binder: undelivered TRANSACTION_COMPLETE [ 2562.197529] binder_alloc: 1073: binder_alloc_buf, no vma [ 2562.219223] binder: 1073:1074 transaction failed 29189/-3, size 0-0 line 3035 [ 2562.240019] binder: send failed reply for transaction 3893 to 1073:1074 [ 2562.258557] binder: 1073:1074 ioctl c0306201 20000600 returned -14 [ 2562.309389] binder: undelivered TRANSACTION_COMPLETE 13:49:20 executing program 4: signalfd4(0xffffffffffffffff, &(0x7f0000000ff8), 0x8, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000340), 0x10000014c) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x7d000}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 13:49:20 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0x0, 0x10000000}) 13:49:20 executing program 5: 13:49:20 executing program 1: 13:49:20 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x68, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) 13:49:20 executing program 5: 13:49:20 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = fcntl$getown(r0, 0x9) r2 = syz_open_procfs(r1, &(0x7f0000000080)='fdinfo/3\x00') exit(0x401) pread64(r2, 0x0, 0x0, 0x3) [ 2562.966631] binder_alloc: 1080: binder_alloc_buf, no vma [ 2562.980942] binder: 1080:1085 transaction failed 29189/-3, size 0-0 line 3035 13:49:21 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f00000000c0)=0x100000001, 0x151) connect$inet6(r0, &(0x7f0000000040), 0x1c) dup2(r0, r0) write(0xffffffffffffffff, &(0x7f00000011c0)="16", 0x1) r1 = memfd_create(&(0x7f0000000140)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\x94a\xac', 0x0) write$binfmt_misc(r1, &(0x7f0000000280)=ANY=[@ANYBLOB="73797a30668d7be6c0fba0bf518b2b202ad55ad534a2d03e218d67340eebca25e112c62155449e1506973e24200d8244f60db7bbdf1ffac8b3bf99b1ead65b0fb916e636a162f061ddd94fec7b0dd244c4a2520d1a23897a2c3ce2dcabd439bf96965f8a91915efeacaa23b579cf59497303da9f8259e5f6"], 0x78) write$binfmt_misc(r1, &(0x7f0000000000)=ANY=[], 0x87bb09c6) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x41, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) lseek(r1, 0x0, 0x4) fsetxattr$security_smack_entry(0xffffffffffffffff, 0x0, &(0x7f00000003c0)='veth0_to_team\x00', 0xe, 0x1) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCGIFDSTADDR(r3, 0x8917, &(0x7f0000000100)={'veth0_to_team\x00', {0x2, 0x0, @rand_addr=0x5949}}) r4 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x200002, 0x0) splice(r2, &(0x7f0000000040), r1, &(0x7f0000000080), 0x110, 0x1) pipe2$9p(&(0x7f0000000300), 0x0) getsockname$packet(r4, &(0x7f00000001c0), 0xfffffffffffffffd) creat(&(0x7f0000000180)='./file0\x00', 0x108) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) 13:49:21 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x9, 0x0) setsockopt$inet_sctp6_SCTP_AUTO_ASCONF(0xffffffffffffffff, 0x84, 0x1e, &(0x7f0000000700), 0x4) ioctl$VIDIOC_STREAMOFF(r0, 0x40045613, &(0x7f0000000040)=0x9) 13:49:21 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0x0, 0x1a0f0000}) [ 2563.013614] binder: send failed reply for transaction 3896 to 1080:1085 [ 2563.037539] binder: 1080:1085 ioctl c0306201 20000600 returned -14 13:49:21 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e177d82c8073f794bee8cab76761555d3676404fb3c728f045f7d9ecc9b266253"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x6c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, 0x0}) [ 2563.104378] binder: undelivered TRANSACTION_COMPLETE 13:49:21 executing program 3: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0x0, 0x0, 0x1f000000}) [ 2563.165988] binder_alloc: 1102: binder_alloc_buf, no vma [ 2563.180715] binder: 1102:1103 transaction failed 29189/-3, size 0-0 line 3035 [ 2563.201426] binder: send failed reply for transaction 3899 to 1102:1103 [ 2563.232660] [ 2563.234335] ====================================================== [ 2563.236331] ------------[ cut here ]------------ [ 2563.240641] WARNING: possible circular locking dependency detected [ 2563.240651] 5.0.0+ #6 Not tainted [ 2563.240655] ------------------------------------------------------ [ 2563.240663] syz-executor.1/1093 is trying to acquire lock: [ 2563.240669] 000000000718ecc4 (&mm->mmap_sem){++++}, at: __do_page_fault+0x9c2/0xd60 [ 2563.240711] [ 2563.240711] but task is already holding lock: [ 2563.253563] IRQs not enabled as expected [ 2563.255244] 000000006f909779 (&sb->s_type->i_mutex_key#11){+.+.}, at: generic_file_write_iter+0xdf/0x610 [ 2563.255286] [ 2563.255286] which lock already depends on the new lock. [ 2563.255286] [ 2563.272033] WARNING: CPU: 0 PID: 3867 at fs/eventpoll.c:1756 ep_poll+0x31e/0xe50 [ 2563.275005] [ 2563.275005] the existing dependency chain (in reverse order) is: [ 2563.280968] Kernel panic - not syncing: panic_on_warn set ... [ 2563.285023] [ 2563.285023] -> #2 (&sb->s_type->i_mutex_key#11){+.+.}: [ 2563.294633] CPU: 0 PID: 3867 Comm: udevd Not tainted 5.0.0+ #6 [ 2563.302960] down_write+0x38/0x90 [ 2563.310466] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2563.318083] shmem_fallocate+0x15a/0xc60 [ 2563.323934] Call Trace: [ 2563.330761] ashmem_shrink_scan+0x1d7/0x4f0 [ 2563.336664] dump_stack+0x172/0x1f0 [ 2563.340617] ashmem_ioctl+0x2f0/0x11a0 [ 2563.349963] ? ep_poll+0x240/0xe50 [ 2563.354529] do_vfs_ioctl+0xd6e/0x1390 [ 2563.357101] panic+0x2cb/0x65c [ 2563.361920] ksys_ioctl+0xab/0xd0 [ 2563.365531] ? __warn_printk+0xf3/0xf3 [ 2563.369919] __x64_sys_ioctl+0x73/0xb0 [ 2563.373445] ? ep_poll+0x31e/0xe50 [ 2563.377841] do_syscall_64+0x103/0x610 [ 2563.381017] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 2563.384976] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 2563.388844] ? __warn.cold+0x5/0x45 [ 2563.393230] [ 2563.393230] -> #1 (ashmem_mutex){+.+.}: [ 2563.396768] ? __warn+0xe8/0x1d0 [ 2563.401196] __mutex_lock+0xf7/0x1310 [ 2563.406729] ? ep_poll+0x31e/0xe50 [ 2563.412454] mutex_lock_nested+0x16/0x20 [ 2563.416083] __warn.cold+0x20/0x45 [ 2563.421524] ashmem_mmap+0x55/0x520 [ 2563.424875] ? vprintk_emit+0x1ce/0x6d0 [ 2563.429206] mmap_region+0xc37/0x1760 [ 2563.432742] ? ep_poll+0x31e/0xe50 [ 2563.437311] do_mmap+0x8e2/0x1080 [ 2563.440843] report_bug+0x263/0x2b0 [ 2563.444973] vm_mmap_pgoff+0x1c5/0x230 [ 2563.448947] do_error_trap+0x11b/0x200 [ 2563.453252] ksys_mmap_pgoff+0x4aa/0x630 [ 2563.456771] do_invalid_op+0x37/0x50 [ 2563.460729] __x64_sys_mmap+0xe9/0x1b0 [ 2563.464339] ? ep_poll+0x31e/0xe50 [ 2563.468735] do_syscall_64+0x103/0x610 [ 2563.472604] invalid_op+0x14/0x20 [ 2563.477180] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 2563.480882] RIP: 0010:ep_poll+0x31e/0xe50 [ 2563.485266] [ 2563.485266] -> #0 (&mm->mmap_sem){++++}: [ 2563.488800] Code: ff 44 89 ee e8 e3 73 ad ff 45 84 ed 0f 85 39 fe ff ff e8 95 72 ad ff 48 c7 c7 e0 3c 76 87 c6 05 62 72 96 07 01 e8 00 bc 80 ff <0f> 0b e9 1a fe ff ff e8 76 72 ad ff 4c 89 f0 48 ba cf f7 53 e3 a5 [ 2563.493200] lock_acquire+0x16f/0x3f0 [ 2563.496631] RSP: 0018:ffff888097dc7ce0 EFLAGS: 00010286 [ 2563.502337] down_read+0x3b/0x90 [ 2563.506459] RAX: 0000000000000000 RBX: ffff8880979a8300 RCX: 0000000000000000 [ 2563.511989] __do_page_fault+0x9c2/0xd60 [ 2563.530876] RDX: 0000000000000000 RSI: ffffffff815a90a6 RDI: ffffed1012fb8f8e [ 2563.535202] do_page_fault+0x71/0x581 [ 2563.535219] page_fault+0x1e/0x30 [ 2563.540563] RBP: ffff888097dc7e98 R08: ffff888097dba2c0 R09: ffffed1015d05021 [ 2563.544445] iov_iter_fault_in_readable+0x377/0x450 [ 2563.551698] R10: ffffed1015d05020 R11: ffff8880ae828107 R12: 1ffff11012fb8fa6 [ 2563.551710] R13: 0000000000000000 R14: 0000000000000bb8 R15: 00000000ffffffea [ 2563.556293] generic_perform_write+0x195/0x530 [ 2563.563547] ? vprintk_func+0x86/0x189 [ 2563.567848] __generic_file_write_iter+0x25e/0x630 [ 2563.571818] ? ep_modify+0x8e0/0x8e0 [ 2563.579077] generic_file_write_iter+0x360/0x610 [ 2563.584596] ? _raw_spin_unlock_irq+0x28/0x90 [ 2563.591857] __vfs_write+0x613/0x8e0 [ 2563.599114] ? trace_hardirqs_on+0x67/0x230 [ 2563.604204] vfs_write+0x20c/0x580 [ 2563.608076] ? kasan_check_read+0x11/0x20 [ 2563.613511] ksys_write+0xea/0x1f0 [ 2563.617215] ? __schedule+0x1387/0x1cc0 [ 2563.622470] __x64_sys_write+0x73/0xb0 [ 2563.626950] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 2563.631174] do_syscall_64+0x103/0x610 [ 2563.635477] ? __fget_light+0x1a9/0x230 [ 2563.639525] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 2563.643664] do_epoll_wait+0x1b3/0x200 [ 2563.647706] [ 2563.647706] other info that might help us debug this: [ 2563.647706] [ 2563.651675] __x64_sys_epoll_wait+0x97/0xf0 [ 2563.656057] Chain exists of: [ 2563.656057] &mm->mmap_sem --> ashmem_mutex --> &sb->s_type->i_mutex_key#11 [ 2563.656057] [ 2563.661594] do_syscall_64+0x103/0x610 [ 2563.665971] Possible unsafe locking scenario: [ 2563.665971] [ 2563.669943] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 2563.675628] CPU0 CPU1 [ 2563.679508] RIP: 0033:0x7fc73b9eb943 [ 2563.687624] ---- ---- [ 2563.691961] Code: 00 31 d2 48 29 c2 64 89 11 48 83 c8 ff eb ea 90 90 90 90 90 90 90 90 83 3d b5 dc 2a 00 00 75 13 49 89 ca b8 e8 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 34 c3 48 83 ec 08 e8 3b c4 00 00 48 89 04 24 [ 2563.703463] lock(&sb->s_type->i_mutex_key#11); [ 2563.707345] RSP: 002b:00007ffcc866c168 EFLAGS: 00000246 ORIG_RAX: 00000000000000e8 [ 2563.713381] lock(ashmem_mutex); [ 2563.718559] RAX: ffffffffffffffda RBX: 0000000000000bb8 RCX: 00007fc73b9eb943 [ 2563.723210] lock(&sb->s_type->i_mutex_key#11); [ 2563.726915] RDX: 0000000000000008 RSI: 00007ffcc866c260 RDI: 000000000000000a [ 2563.731561] lock(&mm->mmap_sem); [ 2563.750469] RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000001 [ 2563.755207] [ 2563.755207] *** DEADLOCK *** [ 2563.755207] [ 2563.762908] R10: 0000000000000bb8 R11: 0000000000000246 R12: 0000000000000003 [ 2563.768888] 2 locks held by syz-executor.1/1093: [ 2563.776145] R13: 0000000000000000 R14: 0000000000f75880 R15: 0000000000f5c250 [ 2563.783402] #0: 000000008757eece (sb_writers#5){.+.+}, at: vfs_write+0x429/0x580 [ 2563.834379] #1: 000000006f909779 (&sb->s_type->i_mutex_key#11){+.+.}, at: generic_file_write_iter+0xdf/0x610 [ 2563.844462] [ 2563.844462] stack backtrace: [ 2563.848971] CPU: 1 PID: 1093 Comm: syz-executor.1 Not tainted 5.0.0+ #6 [ 2563.855722] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2563.865072] Call Trace: [ 2563.867671] dump_stack+0x172/0x1f0 [ 2563.871307] print_circular_bug.isra.0.cold+0x1cc/0x28f [ 2563.876675] __lock_acquire+0x2f00/0x4700 [ 2563.880852] ? mark_held_locks+0x100/0x100 [ 2563.885088] ? mark_held_locks+0x100/0x100 [ 2563.889322] ? __lock_is_held+0xb6/0x140 [ 2563.893385] lock_acquire+0x16f/0x3f0 [ 2563.897196] ? __do_page_fault+0x9c2/0xd60 [ 2563.901437] down_read+0x3b/0x90 [ 2563.904806] ? __do_page_fault+0x9c2/0xd60 [ 2563.909044] __do_page_fault+0x9c2/0xd60 [ 2563.913108] do_page_fault+0x71/0x581 [ 2563.916918] page_fault+0x1e/0x30 [ 2563.920380] RIP: 0010:iov_iter_fault_in_readable+0x377/0x450 [ 2563.926207] Code: 89 f6 41 88 57 e0 e8 98 2b 47 fe 45 85 f6 74 c1 e9 70 fe ff ff e8 09 2a 47 fe 0f 1f 00 0f ae e8 44 89 f0 48 8b 8d 68 ff ff ff <8a> 11 89 c3 0f 1f 00 41 88 57 d0 31 ff 89 de e8 65 2b 47 fe 85 db [ 2563.945123] RSP: 0018:ffff88805061f9b8 EFLAGS: 00010246 [ 2563.950991] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000020400f87 [ 2563.958275] RDX: 0000000000040000 RSI: ffffffff8328b757 RDI: 0000000000000007 [ 2563.965562] RBP: ffff88805061fa58 R08: ffff8880536b4480 R09: fffff940009bb957 [ 2563.972844] R10: fffff940009bb956 R11: ffffea0004ddcab7 R12: 0000000000001000 [ 2563.980126] R13: 0000000000001000 R14: 0000000000000000 R15: ffff88805061fa30 [ 2563.987425] ? iov_iter_fault_in_readable+0x367/0x450 [ 2563.992660] ? iov_iter_fault_in_readable+0x367/0x450 [ 2563.997871] ? copy_page_from_iter+0x750/0x750 [ 2564.002500] generic_perform_write+0x195/0x530 [ 2564.007100] ? page_endio+0x780/0x780 [ 2564.010928] ? current_time+0x140/0x140 [ 2564.014915] ? lock_acquire+0x16f/0x3f0 [ 2564.018898] __generic_file_write_iter+0x25e/0x630 [ 2564.023837] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 2564.028868] generic_file_write_iter+0x360/0x610 [ 2564.033637] ? __generic_file_write_iter+0x630/0x630 [ 2564.038754] ? __fget+0x340/0x540 [ 2564.042217] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 2564.047759] ? iov_iter_init+0xea/0x220 [ 2564.051737] __vfs_write+0x613/0x8e0 [ 2564.055460] ? kernel_read+0x120/0x120 [ 2564.059360] ? rcu_read_lock_sched_held+0x110/0x130 [ 2564.064383] ? rcu_sync_lockdep_assert+0x73/0xb0 [ 2564.069156] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 2564.074720] ? __sb_start_write+0x1ac/0x360 [ 2564.079067] vfs_write+0x20c/0x580 [ 2564.082621] ksys_write+0xea/0x1f0 [ 2564.086189] ? __ia32_sys_read+0xb0/0xb0 [ 2564.090257] ? do_syscall_64+0x26/0x610 [ 2564.094236] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 2564.099604] ? do_syscall_64+0x26/0x610 [ 2564.103583] __x64_sys_write+0x73/0xb0 [ 2564.107477] do_syscall_64+0x103/0x610 [ 2564.111371] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 2564.116567] RIP: 0033:0x457e29 [ 2564.119764] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 2564.138671] RSP: 002b:00007fc498bfdc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 2564.146391] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000457e29 [ 2564.153673] RDX: 0000000087bb09c6 RSI: 0000000020000000 RDI: 0000000000000004 [ 2564.160953] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 2564.168226] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fc498bfe6d4 [ 2564.175498] R13: 00000000004c7260 R14: 00000000004dcde8 R15: 00000000ffffffff [ 2564.183588] Kernel Offset: disabled [ 2564.187222] Rebooting in 86400 seconds..