er#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x630c, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:23:28 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0x40046208, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1197.898182][ T2529] misc userio: No port type given on /dev/userio 02:23:28 executing program 4: socketpair(0x1, 0x2000000001, 0x0, &(0x7f0000000740)={0xffffffffffffffff}) recvmsg$kcm(r0, &(0x7f0000000440)={&(0x7f0000000040)=@l2, 0x80, &(0x7f0000000300)=[{&(0x7f0000000780)=""/4096, 0x1000}, {&(0x7f00000000c0)=""/247, 0xf7}, {&(0x7f0000001780)=""/4096, 0x1000}, {&(0x7f00000001c0)=""/207, 0xcf}, {&(0x7f00000002c0)=""/61, 0x3d}], 0x5, &(0x7f0000000380)=""/97, 0x61}, 0x10142) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8943, &(0x7f0000000000)='ip6gre0\x00') 02:23:28 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0x40049409, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1198.008791][ T2579] binder: 2578:2579 unknown command 0 [ 1198.048132][ T2579] binder: 2578:2579 ioctl c0306201 20000240 returned -22 02:23:28 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x630d, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:23:28 executing program 4: r0 = accept4$vsock_stream(0xffffffffffffffff, &(0x7f0000000040)={0x28, 0x0, 0x2711, @hyper}, 0x10, 0x0) getsockopt$IP_VS_SO_GET_INFO(r0, 0x0, 0x481, &(0x7f0000000080), &(0x7f00000000c0)=0xc) socketpair(0x1, 0x2000000001, 0x0, &(0x7f0000000740)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8943, &(0x7f0000000000)='ip6gre0\x00') [ 1198.202001][ T2699] binder: 2695:2699 unknown command 0 [ 1198.212312][ T2699] binder: 2695:2699 ioctl c0306201 20000240 returned -22 02:23:29 executing program 5: r0 = open(&(0x7f0000000500)='./bus\x00', 0x141042, 0x0) close(r0) syz_open_dev$loop(&(0x7f0000000540)='/dev/loop#\x00', 0x0, 0x105082) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0x526987c9) read(r1, &(0x7f0000000200)=""/250, 0x1e0000) 02:23:29 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0x4018620d, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:23:29 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40046302, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:23:29 executing program 4: r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dlm-control\x00', 0x8041, 0x0) ioctl$SIOCAX25DELFWD(r0, 0x89eb, &(0x7f00000000c0)={@rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}}) r1 = syz_open_dev$audion(&(0x7f0000000040)='/dev/audio#\x00', 0x1026, 0xa6000) ioctl$RTC_WIE_ON(r1, 0x700f) socketpair(0x1, 0x2000000001, 0x9, &(0x7f0000000740)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8943, &(0x7f0000000000)='ip6gre0\x00') 02:23:29 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188") r1 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r1, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r1, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) 02:23:29 executing program 1: socket$inet_udplite(0x2, 0x2, 0x88) write$USERIO_CMD_SET_PORT_TYPE(0xffffffffffffffff, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(0xffffffffffffffff, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) [ 1198.728752][ T2810] binder: BC_ACQUIRE_RESULT not supported [ 1198.755477][ T2829] binder: BINDER_SET_CONTEXT_MGR already set [ 1198.775208][ T2829] binder: 2815:2829 ioctl 4018620d 20000240 returned -16 [ 1198.785354][ T2810] binder: 2809:2810 ioctl c0306201 20000240 returned -22 02:23:29 executing program 1: socket$inet_udplite(0x2, 0x2, 0x88) write$USERIO_CMD_SET_PORT_TYPE(0xffffffffffffffff, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(0xffffffffffffffff, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) 02:23:29 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0x4020940d, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:23:29 executing program 4: socketpair(0x1, 0x2000000001, 0x0, &(0x7f0000000740)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_inet6_tcp_SIOCINQ(r1, 0x541b, &(0x7f0000000040)) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8943, &(0x7f0000000000)='ip6gre0\x00') 02:23:29 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40046304, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:23:29 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0045878, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:23:29 executing program 1: socket$inet_udplite(0x2, 0x2, 0x88) write$USERIO_CMD_SET_PORT_TYPE(0xffffffffffffffff, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(0xffffffffffffffff, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) [ 1199.032635][ T2974] binder: 2957:2974 unknown command 0 [ 1199.051012][ T2974] binder: 2957:2974 ioctl c0306201 20000240 returned -22 02:23:30 executing program 5: r0 = open(&(0x7f0000000500)='./bus\x00', 0x141042, 0x0) close(r0) syz_open_dev$loop(&(0x7f0000000540)='/dev/loop#\x00', 0x0, 0x105082) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0x526987c9) read(r1, &(0x7f0000000200)=""/250, 0x1e1000) 02:23:30 executing program 4: socketpair(0x1, 0x2000000001, 0x0, &(0x7f0000000740)) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000000c0)='ip6gre0\x00'}, 0x30) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8943, &(0x7f0000000040)='ip\x95g\xa1\xa70\x00?\x056\xf6\x02\xb5U\x17\xfbV\xce\x910\x959\x06.;\xdc\x8c\xdf\x02no\xcaH\xed\x1f\xa8&\xf3kr?\xf9\xf6\xff\xb3X\xc4 \\p\xef\xf7\x9bN\v\x1c|^8/(\x1eh_\xf1\xbf\xba\xa1\xd4\xd3\x7f\x123*\xd4%IL\xb0O\xbb$\x11\x8ca1DVI\xe2\x05\x91\x81\xe0J\xb9\'\xda/\x8610\x8e\xdc\xdd\xbe\x17\x0e\xd8\xba\x90%_O\xb6v_\xa7') 02:23:30 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0045878, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:23:30 executing program 1: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r0, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r0, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) 02:23:30 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40046307, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:23:30 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b0") r1 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r1, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r1, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) [ 1199.683897][ T3053] binder: 3052 invalid dec weak, ref 737 desc 0 s 1 w 0 [ 1199.703473][ T3053] binder: 3052:3053 unknown command 0 [ 1199.720094][ T3053] binder: 3052:3053 ioctl c0306201 20000240 returned -22 02:23:30 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0046209, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:23:30 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40086303, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:23:30 executing program 4: r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dlm-monitor\x00', 0x80000, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000080)='dctcp\x00', 0x6) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x8943, &(0x7f0000000000)='ip6gre0\x00') 02:23:30 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc018620b, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1199.857593][ T3209] binder: 3207:3209 BC_FREE_BUFFER u0000000000000000 no match [ 1199.870709][ T3209] binder: 3207:3209 unknown command 0 [ 1199.896103][ T3209] binder: 3207:3209 ioctl c0306201 20000240 returned -22 02:23:30 executing program 4: socketpair(0x1, 0x2000000001, 0x0, &(0x7f0000000740)={0xffffffffffffffff}) openat$audio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/audio\x00', 0x0, 0x0) syz_open_dev$midi(&(0x7f0000000080)='/dev/midi#\x00', 0x2, 0x3fd) perf_event_open$cgroup(&(0x7f0000000180)={0x1, 0x70, 0x1, 0x4, 0x0, 0xffffffff, 0x0, 0x2, 0x10, 0x0, 0x0, 0x1, 0x80000000, 0xffff, 0x7fffffff, 0x6, 0xa9c, 0x400, 0x3, 0x9, 0x6, 0x401, 0x80000000, 0x3, 0x0, 0x101, 0x714, 0x5, 0x1, 0x7fff, 0x1, 0x6, 0x7, 0x3, 0x7, 0x4, 0x8, 0x1, 0x0, 0x0, 0x5, @perf_config_ext={0x7fffffff, 0x3f}, 0x0, 0x8, 0x100000000, 0x2, 0x6, 0x2, 0x8000}, 0xffffffffffffff9c, 0x0, 0xffffffffffffff9c, 0xa) dup(r0) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000200)='/dev/vcs\x00', 0x100, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8943, &(0x7f0000000140)='ip6gre0\x00') 02:23:30 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x4008630a, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1200.054395][ T3391] binder: BC_ATTEMPT_ACQUIRE not supported [ 1200.060335][ T3391] binder: 3343:3391 ioctl c0306201 20000240 returned -22 02:23:31 executing program 5: r0 = open(&(0x7f0000000500)='./bus\x00', 0x141042, 0x0) close(r0) syz_open_dev$loop(&(0x7f0000000540)='/dev/loop#\x00', 0x0, 0x105082) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0x526987c9) read(r1, &(0x7f0000000200)=""/250, 0x1e2000) 02:23:31 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:23:31 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40086310, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1200.594914][ T3455] binder: 3454 BINDER_GET_NODE_INFO_FOR_REF: only handle may be non-zero. [ 1200.594928][ T3455] binder: 3454:3455 ioctl c018620c 20000240 returned -22 [ 1200.610784][ T3458] binder: 3453:3458 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 1200.632327][ T3458] binder: 3453:3458 unknown command 0 [ 1200.637965][ T3458] binder: 3453:3458 ioctl c0306201 20000240 returned -22 02:23:31 executing program 1: r0 = openat$userio(0xffffffffffffff9c, 0x0, 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r0, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r0, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) 02:23:31 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40046307, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:23:31 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0189436, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:23:31 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x400c630e, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:23:31 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b0") r1 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r1, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r1, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) 02:23:31 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40046307, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:23:31 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc020660b, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:23:31 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x400c630f, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1201.058837][ T3468] binder: 3462:3468 unknown command 0 [ 1201.085442][ T3468] binder: 3462:3468 ioctl c0306201 20000240 returned -22 02:23:31 executing program 1: r0 = openat$userio(0xffffffffffffff9c, 0x0, 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r0, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r0, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) [ 1201.244323][ T3484] binder: 3482:3484 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 1201.278747][ T3484] binder: 3482:3484 unknown command 0 [ 1201.296904][ T3484] binder: 3482:3484 ioctl c0306201 20000240 returned -22 02:23:32 executing program 5: r0 = open(&(0x7f0000000500)='./bus\x00', 0x141042, 0x0) close(r0) syz_open_dev$loop(&(0x7f0000000540)='/dev/loop#\x00', 0x0, 0x105082) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0x526987c9) read(r1, &(0x7f0000000200)=""/250, 0x1e3000) 02:23:32 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306202, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:23:32 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40046307, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:23:32 executing program 1: r0 = openat$userio(0xffffffffffffff9c, 0x0, 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r0, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r0, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) 02:23:32 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40106308, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1201.471261][ T3495] binder: 3493:3495 ioctl c0306202 20000240 returned -22 [ 1201.493088][ T3500] binder: 3492:3500 BC_INCREFS_DONE node 753 has no pending increfs request 02:23:32 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x400c630f, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:23:32 executing program 1: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x0, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r0, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r0, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) [ 1201.527539][ T3500] binder: 3492:3500 unknown command 0 [ 1201.547304][ T3500] binder: 3492:3500 ioctl c0306201 20000240 returned -22 02:23:32 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b0") r1 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r1, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r1, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) 02:23:32 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306225, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:23:32 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40106309, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:23:32 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x400c630f, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:23:32 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc030625a, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1201.851363][ T3516] binder: 3512:3516 ioctl c0306225 20000240 returned -22 [ 1201.872932][ T3519] binder: 3513:3519 BC_ACQUIRE_DONE node 756 has no pending acquire request [ 1201.882531][ T3519] binder: 3513:3519 unknown command 0 [ 1201.888563][ T3519] binder: 3513:3519 ioctl c0306201 20000240 returned -22 [ 1201.985249][ T3526] binder: 3524:3526 ioctl c030625a 20000240 returned -22 02:23:33 executing program 5: r0 = open(&(0x7f0000000500)='./bus\x00', 0x141042, 0x0) close(r0) syz_open_dev$loop(&(0x7f0000000540)='/dev/loop#\x00', 0x0, 0x105082) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0x526987c9) read(r1, &(0x7f0000000200)=""/250, 0x1e4000) 02:23:33 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40406300, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:23:33 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x400c630f, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:23:33 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc030625c, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1202.364333][ T3531] binder: 3530:3531 ioctl c030625c 20000240 returned -22 [ 1202.395418][ T3536] binder: 3533:3536 got transaction to context manager from process owning it 02:23:33 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40106309, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:23:33 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0xa, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1202.428247][ T3536] binder_transaction: 4 callbacks suppressed [ 1202.428265][ T3536] binder: 3533:3536 transaction failed 29201/-22, size 0-0 line 2986 02:23:33 executing program 1: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x0, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r0, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r0, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) [ 1202.497023][ T22] binder_release_work: 4 callbacks suppressed [ 1202.497032][ T22] binder: undelivered TRANSACTION_ERROR: 29201 02:23:33 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = openat$userio(0xffffffffffffff9c, 0x0, 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r1, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r1, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) 02:23:33 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40406301, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:23:33 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40106309, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1202.562018][ T3547] binder: 3542:3547 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1202.597520][ T3547] binder: 3542:3547 transaction failed 29189/-22, size 0-0 line 2995 [ 1202.635047][ T3551] binder: 3548:3551 got reply transaction with no transaction stack [ 1202.664765][ T3551] binder: 3548:3551 transaction failed 29201/-71, size 0-0 line 2900 02:23:33 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40106309, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:23:33 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x5a, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1202.697679][ T22] binder: undelivered TRANSACTION_ERROR: 29189 [ 1202.745414][ T22] binder: undelivered TRANSACTION_ERROR: 29201 [ 1202.831919][ T3564] binder: 3563:3564 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1202.841156][ T3564] binder: 3563:3564 transaction failed 29189/-22, size 0-0 line 2995 [ 1202.866749][ T22] binder: undelivered TRANSACTION_ERROR: 29189 02:23:33 executing program 5: r0 = open(&(0x7f0000000500)='./bus\x00', 0x141042, 0x0) close(r0) syz_open_dev$loop(&(0x7f0000000540)='/dev/loop#\x00', 0x0, 0x105082) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0x526987c9) read(r1, &(0x7f0000000200)=""/250, 0x1e5000) 02:23:33 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:23:33 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = openat$userio(0xffffffffffffff9c, 0x0, 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r1, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r1, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) 02:23:33 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40106308, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:23:33 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x5c, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1203.269479][ T3573] binder: 3572:3573 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1203.275235][ T3575] binder: 3568:3575 got reply transaction with no transaction stack 02:23:34 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40106308, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1203.311003][ T3573] binder_alloc: 3568: binder_alloc_buf, no vma [ 1203.339364][ T3573] binder: 3572:3573 transaction failed 29189/-3, size 0-0 line 3148 [ 1203.349335][ T3575] binder: 3568:3575 transaction failed 29201/-71, size 0-0 line 2900 02:23:34 executing program 1: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x0, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r0, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r0, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) 02:23:34 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = openat$userio(0xffffffffffffff9c, 0x0, 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r1, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r1, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) 02:23:34 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x4048635c, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1203.409808][ T22] binder: undelivered TRANSACTION_ERROR: 29201 02:23:34 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40106308, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:23:34 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x2, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1203.468071][ T22] binder: undelivered TRANSACTION_ERROR: 29189 [ 1203.526818][ T3590] binder: 3589:3590 unknown command 1078485852 [ 1203.558236][ T3590] binder: 3589:3590 ioctl c0306201 20000240 returned -22 02:23:34 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x0, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r1, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r1, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) [ 1203.574978][ T3594] binder: 3592:3594 unknown command 16388 [ 1203.597169][ T3594] binder: 3592:3594 ioctl c0306201 20000240 returned -22 02:23:34 executing program 5: r0 = open(&(0x7f0000000500)='./bus\x00', 0x141042, 0x0) close(r0) syz_open_dev$loop(&(0x7f0000000540)='/dev/loop#\x00', 0x0, 0x105082) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0x526987c9) read(r1, &(0x7f0000000200)=""/250, 0x1e6000) 02:23:34 executing program 4 (fault-call:3 fault-nth:0): r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080), 0x111}}, 0x20) dup2(r1, r0) 02:23:34 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x3, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:23:34 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486365, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:23:35 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080), 0x111}}, 0x20) dup2(r1, r0) [ 1204.197522][ T3609] binder: 3607:3609 unknown command 64 [ 1204.220490][ T3611] binder: 3608:3611 unknown command 1078485861 [ 1204.222941][ T3609] binder: 3607:3609 ioctl c0306201 20000240 returned -22 [ 1204.255539][ T3611] binder: 3608:3611 ioctl c0306201 20000240 returned -22 02:23:35 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x4, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:23:35 executing program 1: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(0xffffffffffffffff, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r0, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r0, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) 02:23:35 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:23:35 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r2 = request_key(&(0x7f0000000240)='logon\x00', &(0x7f0000000280)={'syz', 0x2}, &(0x7f00000002c0)='posix_acl_access!.^\x00', 0xffffffffffffffff) add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000100)={'syz', 0x3}, &(0x7f0000000140)="cb22ed0541c2d62ce2043f0b8e5e86dd3afdfaec597942fbd7427fb271304efc31ee1cb9c232fe79261d5a0e26633cdd9a2bd9602cf99177e33d913391a62b5d932905294891ac4f4d952868ffb6532d66b53111df3b138412ed7b718c990b490bfdff5456988fa7b9b47b910d89c1778d5ff83870f238387d24f6743e15ffafc5019b38dab5ef955853c2f62b5afd8b1155d9a924e06d9b49b280cd45ccab5397d2d8940f807a36c2367e58b26d9b3df4712514f770c67b7e562d2cfeb2002cfcd5bb4370b524c47fcf56a45b4f889d0d2209bad9024372fae4e70a3890419de8", 0xe1, r2) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080), 0x111}}, 0x20) r3 = dup2(r1, r0) socket$vsock_dgram(0x28, 0x2, 0x0) clock_gettime(0x0, &(0x7f0000001f80)={0x0, 0x0}) write$eventfd(r3, &(0x7f0000002000)=0xb3, 0x8) socket$inet_dccp(0x2, 0x6, 0x0) recvmmsg(r3, &(0x7f0000001dc0)=[{{0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000300)=""/78, 0x4e}, {&(0x7f00000003c0)=""/134, 0x86}], 0x2, &(0x7f00000004c0)=""/75, 0x4b}, 0x9}, {{&(0x7f0000000540)=@caif=@dbg, 0x80, &(0x7f0000000bc0)=[{&(0x7f00000005c0)=""/245, 0xf5}, {&(0x7f00000006c0)=""/145, 0x91}, {&(0x7f0000000780)=""/165, 0xa5}, {&(0x7f0000000840)=""/96, 0x60}, {&(0x7f00000008c0)=""/113, 0x71}, {&(0x7f0000000940)=""/115, 0x73}, {&(0x7f00000009c0)=""/174, 0xae}, {&(0x7f0000000a80)=""/184, 0xb8}, {&(0x7f0000000b40)=""/82, 0x52}], 0x9}, 0x2}, {{&(0x7f0000000c80)=@alg, 0x80, &(0x7f0000000e40)=[{&(0x7f0000000d00)=""/99, 0x63}, {&(0x7f0000000d80)=""/149, 0x95}], 0x2, &(0x7f0000000e80)=""/242, 0xf2}, 0x80000000}, {{&(0x7f0000000f80)=@rxrpc=@in6={0x21, 0x0, 0x2, 0x1c, {0xa, 0x0, 0x0, @ipv4={[], [], @initdev}}}, 0x80, &(0x7f0000001100)=[{&(0x7f0000001000)=""/96, 0x60}, {&(0x7f0000001080)=""/106, 0x6a}], 0x2, &(0x7f0000001140)=""/197, 0xc5}, 0x8000}, {{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000001240)=""/208, 0xd0}, {&(0x7f0000001340)=""/249, 0xf9}, {&(0x7f0000001440)=""/103, 0x67}, {&(0x7f00000014c0)=""/36, 0x24}], 0x4, &(0x7f0000001540)=""/173, 0xad}, 0x5}, {{&(0x7f0000001600)=@un=@abs, 0x80, &(0x7f0000001800)=[{&(0x7f0000001680)=""/238, 0xee}, {&(0x7f0000001780)=""/127, 0x7f}], 0x2, &(0x7f0000001840)=""/32, 0x20}, 0x3}, {{&(0x7f0000001880)=@rxrpc=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x0, @loopback}}, 0x80, &(0x7f0000001d00)=[{&(0x7f0000001900)=""/75, 0x4b}, {&(0x7f0000001980)=""/183, 0xb7}, {&(0x7f0000001a40)=""/84, 0x54}, {&(0x7f0000001ac0)=""/217, 0xd9}, {&(0x7f0000001bc0)=""/60, 0x3c}, {&(0x7f0000001c00)=""/254, 0xfe}], 0x6, &(0x7f0000001d80)=""/20, 0x14}, 0x8000}], 0x7, 0x40000000, &(0x7f0000001fc0)={r4, r5+30000000}) [ 1204.360775][ T3619] binder: 3618:3619 unknown command 0 [ 1204.387725][ T3619] binder: 3618:3619 ioctl c0306201 20000240 returned -22 02:23:35 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x5, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1204.435347][ T3626] binder: 3624:3626 got transaction to invalid handle [ 1204.466390][ T3626] binder: 3624:3626 transaction failed 29201/-22, size 0-0 line 2995 02:23:35 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x0, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r1, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r1, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) [ 1204.524136][ T3737] misc userio: No port type given on /dev/userio 02:23:35 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1204.574440][ T22] binder: undelivered TRANSACTION_ERROR: 29201 [ 1204.592407][ T3740] binder: 3738:3740 unknown command 285212672 [ 1204.615166][ T3740] binder: 3738:3740 ioctl c0306201 20000240 returned -22 [ 1204.659882][ T3746] binder: 3745:3746 got transaction to invalid handle [ 1204.673500][ T3746] binder: 3745:3746 transaction failed 29201/-22, size 0-0 line 2995 [ 1204.703123][ T22] binder: undelivered TRANSACTION_ERROR: 29201 02:23:35 executing program 5: r0 = open(&(0x7f0000000500)='./bus\x00', 0x141042, 0x0) close(r0) syz_open_dev$loop(&(0x7f0000000540)='/dev/loop#\x00', 0x0, 0x105082) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0x526987c9) read(r1, &(0x7f0000000200)=""/250, 0x1e7000) 02:23:35 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000200)={0x0, 0x18, 0xfa00, {0x4, &(0x7f00000001c0)={0xffffffffffffffff}, 0x13f, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_REJECT(r0, &(0x7f0000000240)={0x9, 0x108, 0xfa00, {r1, 0x5f, "3631ca", "0e2d5454cfb606cb91b20db7e61c001b55f4733e226a2dbbbf8e90530fd0deb99e439d789b9ade975fd47c3f7a0c1ab76cdc6b128c4b197161601838ececd8ff717143bf846bd00333d06bfddcc486d4bcce35b2cdced8cca26416e79071cff5e30131a78a1765600be73b67f52b367d210f3a89fff0f210eff6c5a7b84d387aa36ac955c0039e6f54d4f0b1043f75304848839751cc31e800ce51716b85bb38fd5ae18c4288b0b1b37cabd1822c84076ebeaafafe0de0fbd13fbe12f02f186e5657e56b5861317b33771af3d708678486371009551f8ff7ed331bdea1e9fced3b47ce33edc96a1437f6350deea39fc4e2c7c8ad82a98f9c788ebb1841a3293a"}}, 0x110) fcntl$getownex(r0, 0x10, &(0x7f0000000100)={0x0, 0x0}) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/vga_arbiter\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000000)={0x0, 0x70, 0x0, 0x5, 0x7, 0x3b000, 0x0, 0xfff, 0x8000, 0x3, 0x4, 0x7, 0xffff, 0x9, 0x7, 0x81, 0x59fe, 0x9, 0x2, 0x9, 0x6f38, 0x4, 0x0, 0x5, 0x2, 0x9, 0x2, 0xffffffffffff0570, 0x0, 0x3f, 0xff, 0xffffffffffffff79, 0x100000001, 0xc000000000000000, 0x8, 0x0, 0xaf9, 0x7, 0x0, 0xf1b5, 0x1, @perf_config_ext={0x5, 0x5}, 0x260, 0x3, 0x0, 0x6, 0x7, 0x8, 0x3}, r2, 0x8, r3, 0x1) r4 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080), 0x111}}, 0xffffffffffffff0d) dup2(r4, r0) 02:23:35 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x6, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:23:35 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1205.142071][ T3754] binder: 3752:3754 got transaction to invalid handle [ 1205.156171][ T3757] binder: 3755:3757 unknown command 1662058496 [ 1205.178618][ T3757] binder: 3755:3757 ioctl c0306201 20000240 returned -22 02:23:36 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080), 0x111}}, 0x20) dup2(r1, r0) [ 1205.189880][ T3754] binder: 3752:3754 transaction failed 29201/-22, size 0-0 line 2995 02:23:36 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x7, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:23:36 executing program 1: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(0xffffffffffffffff, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r0, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r0, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) 02:23:36 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1205.282061][T11612] binder: undelivered TRANSACTION_ERROR: 29201 02:23:36 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = syz_open_dev$dmmidi(&(0x7f0000000000)='/dev/dmmidi#\x00', 0x19, 0x0) ioctl$SNDRV_TIMER_IOCTL_TREAD(r1, 0x40045402, &(0x7f0000000040)) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080), 0x111}}, 0x20) dup2(r2, r0) socket$inet(0x2, 0x80005, 0xc123) setsockopt$inet6_MRT6_DEL_MFC(r1, 0x29, 0xcd, &(0x7f0000000100)={{0xa, 0x4e21, 0x2, @mcast2, 0x10001}, {0xa, 0x4e21, 0x3e587823, @local, 0x9}, 0x5876660f, [0x6, 0x6, 0x80000001, 0xff, 0x5f, 0x7ff, 0x8, 0x7ff]}, 0x5c) [ 1205.359295][ T3946] binder: 3945:3946 unknown command 1214451968 [ 1205.383215][ T3952] binder: 3950:3952 got transaction to invalid handle [ 1205.392400][ T3946] binder: 3945:3946 ioctl c0306201 20000240 returned -22 [ 1205.400220][ T3952] binder: 3950:3952 transaction failed 29201/-22, size 0-0 line 2995 02:23:36 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x0, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r1, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r1, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) 02:23:36 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0xa, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:23:36 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1205.446202][ T3977] misc userio: No port type given on /dev/userio [ 1205.470645][T11612] binder: undelivered TRANSACTION_ERROR: 29201 [ 1205.530603][ T3987] binder: 3985:3987 unknown command 16456 [ 1205.556397][ T4031] binder: 3984:4031 got transaction to invalid handle [ 1205.570616][ T3987] binder: 3985:3987 ioctl c0306201 20000240 returned -22 02:23:36 executing program 5: r0 = open(&(0x7f0000000500)='./bus\x00', 0x141042, 0x0) close(r0) syz_open_dev$loop(&(0x7f0000000540)='/dev/loop#\x00', 0x0, 0x105082) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0x526987c9) read(r1, &(0x7f0000000200)=""/250, 0x1e8000) 02:23:36 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x48, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:23:36 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080), 0x111}}, 0x20) 02:23:36 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:23:36 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1206.046175][ T4100] binder: 4096:4100 unknown command 0 [ 1206.050435][ T4119] binder: 4099:4119 got transaction to invalid handle [ 1206.072706][ T4100] binder: 4096:4100 ioctl c0306201 20000240 returned -22 02:23:36 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000580)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080), 0x111}}, 0x20) r2 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000680)='/dev/dlm-monitor\x00', 0x4000, 0x0) setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, &(0x7f00000006c0)={0x2b, @multicast1, 0x4e20, 0x4, 'lc\x00', 0x1, 0x4, 0x16}, 0x2c) r3 = dup2(r1, r0) setsockopt$IP_VS_SO_SET_DEL(r2, 0x0, 0x484, &(0x7f0000000100)={0xff, @initdev={0xac, 0x1e, 0x1, 0x0}, 0x4e22, 0x4, 'wrr\x00', 0xc, 0x7, 0x2e}, 0x2c) fgetxattr(r0, &(0x7f0000000140)=@random={'system.', 'selinux@\x00'}, &(0x7f0000000c00)=""/4096, 0x1000) close(r3) getsockopt$sock_linger(r3, 0x1, 0xd, &(0x7f0000000000), &(0x7f0000000040)=0x8) sendmsg$nl_route(r2, &(0x7f00000002c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x420}, 0xc, &(0x7f00000001c0)={&(0x7f00000003c0)=ANY=[@ANYBLOB="54000000120000002bbd7000fcdbdf2507000000", @ANYRES32=0x0, @ANYBLOB="000004000000000024000e00080000000000000000100000000000000700000000000000050004a1000000000800050063df00000800210003000000d93071805bdd7f0b43884b0730b01376a0190f8d7616fc276d968b357ccc76af83dfda084d5533e154698d274cd848aab3732b5379af65035bcb4273fbeb07528e26bb7d2ecc22340004b2ee6664e1a5c4e2be59644bfd08540c82881bb64c7b861c28a929651dde70ec16a2334e5d57ca5704d3a80a1cd2562f242181bca1671ac5604767873694b9cd89dac6d673e54d388819ec370547c8ba212187e2433f86c21d9a5ee4b80fe9e72b4b24f2c0f46888960a71b4cd887023d1b3c8c668a07a95312fead851d601bc1df8beffc97671ef4e9449c84ba36fd62a1cef58df896edbcfc6c345be2267e51db136ee87339fe24d8c72"], 0x54}, 0x1, 0x0, 0x0, 0x20000001}, 0x20000000) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r3, 0xc4c85512, &(0x7f0000000700)={{0xa, 0x6, 0x81, 0x8, 'syz0\x00', 0x1}, 0x1, [0x2, 0x3f, 0x4, 0x8, 0x4, 0x200, 0x1, 0x6, 0x2, 0x2, 0x8, 0x7ff, 0x5, 0x80, 0x3, 0x4, 0x0, 0x800, 0x0, 0x0, 0x10000, 0x7, 0x6, 0x48, 0x8, 0x2, 0x40, 0xffffffffffffffff, 0xffff, 0x2, 0x7, 0x9, 0x7, 0x101, 0x2532, 0x7ff, 0x7fff, 0x1000, 0x3, 0x101, 0xf3, 0x3f, 0x1000000000000, 0x0, 0x5, 0x9, 0x6, 0xfffffffffffff000, 0x5, 0x1, 0x3ff, 0x6cd, 0x800, 0x26, 0xffff, 0x100000000, 0x4, 0x2, 0x8, 0x800, 0x0, 0x10000, 0x3920, 0x7fffffff, 0x9, 0x3, 0x100, 0x81, 0xb781, 0x101, 0x8000, 0xee, 0x10001, 0x6, 0x6, 0x3, 0x3, 0x80000001, 0x0, 0xc0c, 0x14e, 0xdd08, 0x8, 0x6, 0x1, 0x8, 0x6, 0x6, 0x7fff, 0x1, 0x6, 0x1000, 0xadf, 0x100, 0xe5, 0x10, 0x1f, 0x10001, 0x1f, 0xff, 0x0, 0x6, 0x6, 0x1, 0x5ecb, 0x6, 0x2, 0x100000001, 0x3, 0x100000001, 0x3ff, 0x485b183b, 0x4, 0x2, 0x1, 0x3, 0x0, 0xde5a, 0x100, 0x1, 0x7, 0x8, 0x4, 0x7fff, 0x400000000000, 0x7, 0x7, 0x2]}) 02:23:36 executing program 1: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(0xffffffffffffffff, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r0, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r0, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) 02:23:36 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x4c, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1206.165201][ T4207] binder: 4205:4207 got transaction to invalid handle 02:23:37 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x48, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1206.258927][ T4231] binder: 4230:4231 unknown command 0 [ 1206.266884][ T4231] binder: 4230:4231 ioctl c0306201 20000240 returned -22 02:23:37 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(0xffffffffffffffff, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r1, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) 02:23:37 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x60, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:23:37 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080), 0x111}}, 0x20) dup2(r1, r0) openat$vim2m(0xffffffffffffff9c, &(0x7f0000000000)='/dev/video35\x00', 0x2, 0x0) [ 1206.342010][ T4318] misc userio: No port type given on /dev/userio [ 1206.361773][ T4320] binder: 4317:4320 got transaction to invalid handle [ 1206.481712][ T4386] misc userio: No port type given on /dev/userio 02:23:37 executing program 5: r0 = open(&(0x7f0000000500)='./bus\x00', 0x141042, 0x0) close(r0) syz_open_dev$loop(&(0x7f0000000540)='/dev/loop#\x00', 0x0, 0x105082) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0x526987c9) read(r1, &(0x7f0000000200)=""/250, 0x1e9000) 02:23:37 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x4c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:23:37 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x68, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:23:37 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) fcntl$setstatus(r1, 0x4, 0x2c01) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080), 0x111}}, 0x20) dup2(r1, r0) [ 1206.946455][ T4434] binder: 4433:4434 got transaction to invalid handle 02:23:37 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x6c, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:23:37 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x60, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:23:37 executing program 1: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, 0x0, 0x0) readv(r0, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r0, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) 02:23:37 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080), 0x111}}, 0x20) dup2(r0, r0) 02:23:37 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x74, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1207.138540][ T4549] binder: 4548:4549 got transaction to invalid handle [ 1207.161863][ T4551] misc userio: Invalid payload size 02:23:38 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(0xffffffffffffffff, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r1, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) 02:23:38 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x68, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1207.215172][ T4582] misc userio: No port type given on /dev/userio 02:23:38 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x7a, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1207.370059][ T4668] misc userio: No port type given on /dev/userio 02:23:38 executing program 5: r0 = open(&(0x7f0000000500)='./bus\x00', 0x141042, 0x0) close(r0) syz_open_dev$loop(&(0x7f0000000540)='/dev/loop#\x00', 0x0, 0x105082) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0x526987c9) read(r1, &(0x7f0000000200)=""/250, 0x1ea000) 02:23:38 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080), 0x111}}, 0x20) r2 = dup2(r1, r0) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r2, 0x84, 0x1a, &(0x7f0000000100)={0x0, 0x52, "c1da11fb9e6d13d755c120026936ef9b19a77d282ed2d67c0f269c6ba28c433cdd1ea59464cde16c22b62cc2f8377592411ba1ca0e1c1c130318fba3d3acd544f42c122cd9c534a7a8144c48127d35e25ce7"}, &(0x7f0000000040)=0x5a) getsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r2, 0x84, 0x76, &(0x7f0000000180)={r3, 0x7}, &(0x7f00000001c0)=0x8) ioctl$sock_inet_SIOCGIFNETMASK(r2, 0x891b, &(0x7f0000000000)={'ip6erspan0\x00', {0x2, 0x4e20, @local}}) 02:23:38 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x6c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:23:38 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x300, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:23:38 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x500, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1207.860480][ T4682] binder_transaction: 7 callbacks suppressed [ 1207.860497][ T4682] binder: 4676:4682 transaction failed 29201/-22, size 0-0 line 2995 02:23:38 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x74, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:23:38 executing program 1: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, 0x0, 0x0) readv(r0, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r0, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) 02:23:38 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080), 0x111}}, 0x20) r2 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20\x00', 0x20000, 0x0) ioctl$BLKSECTGET(r2, 0x1267, &(0x7f0000000100)) ioctl$sock_SIOCOUTQNSD(r2, 0x894b, &(0x7f0000000040)) dup2(r1, r0) [ 1207.979170][T11612] binder_release_work: 7 callbacks suppressed [ 1207.979178][T11612] binder: undelivered TRANSACTION_ERROR: 29201 02:23:38 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x600, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1208.061966][ T4788] binder: 4787:4788 transaction failed 29201/-22, size 0-0 line 2995 [ 1208.083887][ T4792] misc userio: Invalid payload size 02:23:38 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(0xffffffffffffffff, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r1, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) 02:23:38 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x7a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1208.154264][T11612] binder: undelivered TRANSACTION_ERROR: 29201 [ 1208.178457][ T4896] misc userio: No port type given on /dev/userio 02:23:38 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080), 0x111}}, 0x20) r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/btrfs-control\x00', 0xb80, 0x0) setsockopt$RXRPC_MIN_SECURITY_LEVEL(r2, 0x110, 0x4, &(0x7f0000000040)=0x1, 0x4) r3 = dup2(r1, r0) setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r3, 0x10e, 0x8, &(0x7f0000000100)=0x9, 0x4) [ 1208.263470][ T4912] binder: 4903:4912 transaction failed 29201/-22, size 0-0 line 2995 [ 1208.299088][ T4941] misc userio: No port type given on /dev/userio [ 1208.319195][T11612] binder: undelivered TRANSACTION_ERROR: 29201 02:23:39 executing program 5: r0 = open(&(0x7f0000000500)='./bus\x00', 0x141042, 0x0) close(r0) syz_open_dev$loop(&(0x7f0000000540)='/dev/loop#\x00', 0x0, 0x105082) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0x526987c9) read(r1, &(0x7f0000000200)=""/250, 0x1eb000) 02:23:39 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x700, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:23:39 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x300, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:23:39 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000)='/dev/hwrng\x00', 0x0, 0x0) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000140)='IPVS\x00') sendmsg$IPVS_CMD_NEW_SERVICE(r1, &(0x7f0000000280)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000240)={&(0x7f0000000180)=ANY=[@ANYBLOB="84000000", @ANYRES16=r2, @ANYBLOB="000b2abd7000ffdbdf25010000000800040000000080080400000008000500080000004000020008000700ff00000008000900030000000800080000010000080008003f000000140001000000000000000000000000000000080004003f00000008000600010000000800040000000000"], 0x84}, 0x1, 0x0, 0x0, 0x4000}, 0x10) r3 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080), 0x111}}, 0x20) dup2(r3, r0) 02:23:39 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0xa00, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1208.775307][ T5016] binder: 5009:5016 transaction failed 29201/-22, size 0-0 line 2995 02:23:39 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x500, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1208.868936][T11612] binder: undelivered TRANSACTION_ERROR: 29201 02:23:39 executing program 1: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, 0x0, 0x0) readv(r0, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r0, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) 02:23:39 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r2 = add_key(&(0x7f0000000040)='id_resolver\x00', &(0x7f0000000100)={'syz', 0x3}, 0x0, 0x0, 0x0) keyctl$KEYCTL_PKEY_DECRYPT(0x1a, &(0x7f0000000140)={r2, 0x797, 0x1}, 0x0, &(0x7f0000000180)="e59cf06719d00f9c8617f65b4a60e36e86e7cf4beda328c1a0a30a0217d6846e262567482900cc8c3077e8ed6ac64f01de4c41562a2ec3ed95912e", &(0x7f00000001c0)=""/50) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080), 0x111}}, 0x20) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) dup2(r1, r0) 02:23:39 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x2000, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1208.989620][ T5133] binder: 5125:5133 transaction failed 29201/-22, size 0-0 line 2995 [ 1209.016074][ T5153] misc userio: Invalid payload size 02:23:39 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r1, 0x0, 0x0) readv(r1, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r1, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) 02:23:39 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x4800, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:23:39 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x600, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1209.079173][ T5235] misc userio: No port type given on /dev/userio [ 1209.105010][ T22] binder: undelivered TRANSACTION_ERROR: 29201 [ 1209.155919][ T5240] binder: 5239:5240 transaction failed 29201/-22, size 0-0 line 2995 [ 1209.170183][ T5242] misc userio: Invalid payload size [ 1209.209649][T11612] binder: undelivered TRANSACTION_ERROR: 29201 [ 1209.237050][ T5246] misc userio: No port type given on /dev/userio 02:23:40 executing program 5: r0 = open(&(0x7f0000000500)='./bus\x00', 0x141042, 0x0) close(r0) syz_open_dev$loop(&(0x7f0000000540)='/dev/loop#\x00', 0x0, 0x105082) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0x526987c9) read(r1, &(0x7f0000000200)=""/250, 0x1ec000) 02:23:40 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080), 0x111}}, 0x20) dup2(0xffffffffffffffff, r0) 02:23:40 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x700, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:23:40 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x4c00, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:23:40 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x6000, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1209.673929][ T5270] binder_transaction: 7 callbacks suppressed [ 1209.673940][ T5270] binder: 5249:5270 got transaction to invalid handle 02:23:40 executing program 4: r0 = syz_open_dev$usbmon(&(0x7f0000000140)='/dev/usbmon#\x00', 0x9, 0x4000) r1 = syz_open_dev$radio(&(0x7f0000000180)='/dev/radio#\x00', 0x2, 0x2) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r1, &(0x7f00000001c0)={0x10000000}) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r3 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080), 0x111}}, 0x20) r4 = dup2(r3, r2) getsockopt$EBT_SO_GET_INFO(r4, 0x0, 0x80, &(0x7f0000000000)={'nat\x00'}, &(0x7f0000000100)=0x78) [ 1209.728305][ T5270] binder: 5249:5270 transaction failed 29201/-22, size 0-0 line 2995 02:23:40 executing program 1: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000000), 0x2) readv(r0, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r0, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) 02:23:40 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0xa00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1209.799731][T11612] binder: undelivered TRANSACTION_ERROR: 29201 02:23:40 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x6800, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1209.867744][ T5366] binder: 5364:5366 got transaction to invalid handle [ 1209.893367][ T5366] binder: 5364:5366 transaction failed 29201/-22, size 0-0 line 2995 02:23:40 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r1, 0x0, 0x0) readv(r1, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r1, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) 02:23:40 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x6c00, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:23:40 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1209.991894][T11612] binder: undelivered TRANSACTION_ERROR: 29201 [ 1209.999719][ T5473] misc userio: No port type given on /dev/userio [ 1210.098112][ T5481] misc userio: Invalid payload size [ 1210.108792][ T5482] binder: 5479:5482 got transaction to invalid handle [ 1210.117407][ T5482] binder: 5479:5482 transaction failed 29201/-22, size 0-0 line 2995 [ 1210.162290][ T22] binder: undelivered TRANSACTION_ERROR: 29201 [ 1210.169168][ T5484] misc userio: No port type given on /dev/userio 02:23:41 executing program 5: r0 = open(&(0x7f0000000500)='./bus\x00', 0x141042, 0x0) close(r0) syz_open_dev$loop(&(0x7f0000000540)='/dev/loop#\x00', 0x0, 0x105082) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0x526987c9) read(r1, &(0x7f0000000200)=""/250, 0x1ed000) 02:23:41 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080), 0x111}}, 0x20) r2 = dup2(r1, r0) ioctl$SNDRV_SEQ_IOCTL_SUBSCRIBE_PORT(r2, 0x40505330, &(0x7f0000000100)={{0x6e, 0x1}, {0x20, 0x2}, 0x3f, 0x1, 0x7fffffff}) 02:23:41 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x7400, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:23:41 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x3f00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:23:41 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x7a00, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1210.560892][ T5491] binder: 5490:5491 got transaction to invalid handle [ 1210.600289][ T5491] binder: 5490:5491 transaction failed 29201/-22, size 0-0 line 2995 02:23:41 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x4800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1210.707162][ T22] binder: undelivered TRANSACTION_ERROR: 29201 02:23:41 executing program 1: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000000), 0x2) readv(r0, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r0, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) 02:23:41 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080), 0x111}}, 0x20) dup2(r1, r0) 02:23:41 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x1000000, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1210.818261][ T5607] binder: 5604:5607 got transaction to invalid handle 02:23:41 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r1, 0x0, 0x0) readv(r1, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r1, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) 02:23:41 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x4c00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:23:41 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x2000000, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1210.902276][ T5704] misc userio: No port type given on /dev/userio [ 1210.982443][ T5719] binder: 5715:5719 got transaction to invalid handle [ 1211.004049][ T5721] misc userio: Invalid payload size [ 1211.066100][ T5724] misc userio: No port type given on /dev/userio 02:23:42 executing program 5: r0 = open(&(0x7f0000000500)='./bus\x00', 0x141042, 0x0) close(r0) syz_open_dev$loop(&(0x7f0000000540)='/dev/loop#\x00', 0x0, 0x105082) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0x526987c9) read(r1, &(0x7f0000000200)=""/250, 0x1ee000) 02:23:42 executing program 4: r0 = dup(0xffffffffffffff9c) ioctl$IMDELTIMER(r0, 0x80044941, &(0x7f0000000000)=0x3) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000040)={0xffffffffffffffff}, 0x13f, 0x8}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_ROUTE(r0, &(0x7f0000000180)={0x4, 0x8, 0xfa00, {r3, 0x200}}, 0x10) finit_module(r2, &(0x7f0000000140)='/dev/infiniband/rdma_cm\x00', 0x2) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080), 0x111}}, 0x20) dup2(r2, r1) 02:23:42 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x3000000, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:23:42 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x6000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:23:42 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x4000000, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1211.481783][ T5748] binder: 5728:5748 got transaction to invalid handle 02:23:42 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x6800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1211.613628][ T5842] binder: 5840:5842 got transaction to invalid handle 02:23:42 executing program 1: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000000), 0x2) readv(r0, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r0, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) 02:23:42 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r2 = syz_open_dev$swradio(&(0x7f0000000100)='/dev/swradio#\x00', 0x1, 0x2) syz_mount_image$bfs(&(0x7f0000000040)='bfs\x00', &(0x7f0000000300)='./file0\x00', 0x5a73, 0x8, &(0x7f0000000a00)=[{&(0x7f00000003c0)="4d6903eb5ca36e5ed3874753c1794a0e4dd9573a0cdd38fbfb86ecbcecaa422b67c2f20c69b270f9051617202421c99b3696bb4570cf9a6165c1073ebbf721a108f9f8a6f550132c2ac9e366a69e410d4492929e1505e06782d32fa6b499c2897dfaf27631bfce5ecdc3bc9411262e6d5e6e581402693f897031b3484f1281ed4294224149ffbb47eb560a7e320e36076aee383c3b01c527b1b3fef029dcec8c071f", 0xa2, 0x6}, {&(0x7f0000000480)="ab6eb1314a842a5a41c0c4988b81b20a4bacd042b7f3a6c8436a1755fdca482e3b348fb8623cbd52ed20b2eff538f0e4861672a6be0334b717ee0b547e5eb3f828641a505350cbb6d1911ac681c7fb18a675c23a6aff96ee4f8d54d85f23e91a744eb60ab4c83ed27098", 0x6a}, {&(0x7f0000000500)="5eaa43c400733deddcad07f1a17eba845c7320328a7b2d7c2faaddd4edea97e2cb093e2b6cb12b18d8af9b71744a32f9985c600d43ac58b3ff70e58f3605e24f37f57ec95bf6bba6f9835322afcaae5640b801d6332e127ad39d9bbdcb3c666810d08420c6c8eb451f6071992a70536371e46aa1e807e1a191f0ca3546fe6cbc1872f0f8e6d10edfc91b077b953382228f587c640f90a50d328cc77fc4dfa71ded12f03f5e63ce47a2242e993de42d5cf6cd8a85c5108c26c5a1adee708be630ba93c95699d0be", 0xc7, 0x7ff}, {&(0x7f0000000600)="092608d0fea17979c80a75ad5cbf6cd5d51f75e1664fa0de2ba4fb425d2bd5ae041690f9a089cff57305e726f235fabebfcf1bf9c469e3e27d8ea09b07a4c8000d1b4fcc9fc380097e461ca4e5014991038e45e45cd8391660e84f5167ea04d8ca821132b627c0e06162cdf13fa62a7b765d1c48b091155b9f5b1353", 0x7c, 0xa8}, {&(0x7f0000000680)="a8cf12e105618b1eab519b122c6244029bf105863c4f0bb7d0537e8934f14dbcfc5ea78b8f2f0cfa8f325ba12cdb8c42f000d9488640de6171c84f22be1131052b63a17dde21e8e21806b1c943f23eee8d8a9784644c95dd91a364b2ff391eadbdd2275ba58e6e22ae16e0a446e00c7207a4af680ea068365be2f1afeca1ff5e04bff7c9a0af2b2b65e8046c3303f55d06c0e1b1d30fdcf0c66ada87066af90cc19160a2c4307cf56876827f47cd84a069cd3a0dc802b16e21702f4e783157b7165703956d84d98beb2bdf73b4d9530057da6e15d3c47b57", 0xd8}, {&(0x7f0000000780)="b013aaca312769174c7f917a9a05ed11c9a5764e343ac1f0db5a1b78328011e5878301ae31e09e942c7fd0ead3e6bd6f3c1596acbfe8f70209d82fae0f325fedbf2f1721af63103df64fb31e87c8605effe71437572701a4562d89cab7023a1f389ba4ff492d1576e343c0ff45a1886c28c0d15d25d101d1b2916e4769cb1a266d01075e351f2217d244f9b434371fffe69902f187", 0x95, 0x4}, {&(0x7f0000000840)="c50fe8c81353a9369f3344e766a217fb639fe487d06de38812d11b455ead88775de99712850214f36e7852d3bc97e458ed7746c95ddb083384d15d6d6122c56c5009cc92942d9092dbbab6733d55512ac217cecb2875a3bcb1fb70380f916834067c84d8f47ad0a2788b81213ac4b4ffce213547e550f1d56f2c69c742222e95902bfe8d9b989a", 0x87, 0x4}, {&(0x7f0000000900)="19db474d7ad54f6a667f3cd27ba539f580dd0623b25c32bd1f15f2dc8ddc035369333c5416bcc5f9467809ffb57828fa277da199fa1785c0c776992418414b81a90027d44beab04ef6435b5d81027f6f6d62f8b46b6115f8d3b362865d1f7c042d8074cc101cc15e068e9b842bd9e825c283e92685dbfb45408d81b7d9394811d2b2b4a09b2ab9142df1bce011a5582ff23aba75d1eab2340f616634b9fe5d655e51bb4f2885a0109a9857ba0e306460fc97572696f4862f0263d9123f801b770369b331163f9a39dcf9a07c22ecce1f4600176317", 0xd5, 0x8d4f}], 0x1320489, 0x0) setsockopt$inet6_MRT6_ADD_MFC(r2, 0x29, 0xcc, &(0x7f0000000ac0)={{0xa, 0x4e23, 0x1, @dev={0xfe, 0x80, [], 0x1f}}, {0xa, 0x4e20, 0x7, @remote, 0x4}, 0x6, [0x4, 0xffffffffffffff80, 0x9, 0x401, 0x8, 0x1, 0x1, 0x90a]}, 0x5c) name_to_handle_at(r2, &(0x7f0000000140)='./file0\x00', &(0x7f0000000b40)=ANY=[@ANYBLOB="a700000004000000997ee7b0075d96c031caf23f312251d585f35efdcd88ec474324d0c26871c5d79a0674dae2cb40946d5a71dc598c3a32a3190612258f73be7965b342a43f0e14dfa4ec61636a00d6637a52ab21b9420d1de65e8136959972c19e017e5e399e3793003b778db313befc1698820f9629409d45c1b11b6959de60b8ddadba5a9113ffd4275913e17cdc63da965ea0cebe368938072377934d931111a34b8164ef8967f7abb23cb3d4b9cf4cd87fb6f2acc121299c44494b498585c3107c98b4835c3066d1db89b5eec0d3c65d14771ed256f5e9192e38dc43e1f9aa8491343367056c90cbacc81dd6759586a86fcfb879d2e0745e1431ce77257d8d89218a3018ca1ef72cffc8799bfa2993436f7c2ce564898fe61baa9ffcebe89bb3707f3f79a58449256ff3beff1cf7e4f2a8c9fac95a2409ccfd8bb34c02781d11aa3466f70c0b82f526f5b8a9f044cc87fbae6368c90a2426c1c67f2244cea68f631f"], &(0x7f0000000180), 0x1000) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080), 0x111}}, 0x20) ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f00000001c0)=0x0) syz_open_procfs(r3, &(0x7f0000000000)='net/sctp\x00') dup2(r1, r0) 02:23:42 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x5000000, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:23:42 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r1, &(0x7f0000000000), 0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r1, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) 02:23:42 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x6c00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:23:42 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x6000000, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1211.799163][ T5953] misc userio: No port type given on /dev/userio [ 1211.854117][ T5957] binder: 5954:5957 got transaction to invalid handle [ 1211.941247][ T5963] misc userio: No port type given on /dev/userio 02:23:43 executing program 5: r0 = open(&(0x7f0000000500)='./bus\x00', 0x141042, 0x0) close(r0) syz_open_dev$loop(&(0x7f0000000540)='/dev/loop#\x00', 0x0, 0x105082) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0x526987c9) read(r1, &(0x7f0000000200)=""/250, 0x1ef000) 02:23:43 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000140)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080), 0x111}}, 0x20) dup2(r1, r0) 02:23:43 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x7400, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:23:43 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x7000000, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1212.383240][ T5969] binder: 5968:5969 got transaction to invalid handle 02:23:43 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0xa000000, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:23:43 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) ioctl$EVIOCSFF(r0, 0x40304580, &(0x7f0000000040)={0x57, 0x0, 0x2, {0x6, 0xfff}, {0x9}, @rumble={0x7, 0xfffffffffffffff8}}) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_BIND_IP(r0, &(0x7f0000000000)={0x2, 0x28, 0xfa00, {0x0, {0xa, 0x4e21, 0x100000000, @dev={0xfe, 0x80, [], 0xb}, 0x7}, r2}}, 0x30) dup2(r1, r0) 02:23:43 executing program 1: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r0, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) 02:23:43 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x7a00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:23:43 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x20000000, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:23:43 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r1, &(0x7f0000000000), 0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r1, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) 02:23:43 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x1000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:23:43 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000040)={0x0, 0x18, 0xfa00, {0x4, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f, 0x7}}, 0x20) r2 = fcntl$dupfd(r0, 0x0, r0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f0000000240)={0x0, 0x80000, 0xffffffffffffffff}) r5 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000280)='/dev/sequencer\x00', 0x0, 0x0) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r2, 0xc00c642d, &(0x7f00000002c0)={r3, 0x80000, r5}) write$RDMA_USER_CM_CMD_INIT_QP_ATTR(r0, &(0x7f00000001c0)={0xb, 0x10, 0xfa00, {&(0x7f0000000100), r1, 0x80000000}}, 0x18) write$binfmt_elf32(r4, &(0x7f00000003c0)={{0x7f, 0x45, 0x4c, 0x46, 0x7, 0x100000001, 0x9, 0x1, 0x4, 0x3, 0x6, 0x2, 0x41, 0x38, 0x302, 0x6, 0xffffffffffff0001, 0x20, 0x2, 0x4, 0x400, 0x4}, [{0x6474e553, 0x0, 0x9, 0xfff, 0x1, 0x101, 0x8, 0x3}], "863771d2c2600eabeb523b18d247231ee4c569c64e5726bf97c5db11ee1ba39610d34e44f87e2d23f9fff54efd3f0f734429b616057c564a802c48dcd816314066cb259e3bb7e40b5394a229e88c12513753feb2", [[], [], [], [], []]}, 0x5ac) r6 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080), 0x111}}, 0x20) socket$isdn_base(0x22, 0x3, 0x0) ioctl$EVIOCGSW(r2, 0x8040451b, &(0x7f0000000980)=""/149) ioctl$GIO_FONT(r5, 0x4b60, &(0x7f0000000300)=""/49) dup2(r6, r0) [ 1212.860094][ T6301] misc userio: No port type given on /dev/userio 02:23:44 executing program 5: r0 = open(&(0x7f0000000500)='./bus\x00', 0x141042, 0x0) close(r0) syz_open_dev$loop(&(0x7f0000000540)='/dev/loop#\x00', 0x0, 0x105082) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0x526987c9) read(r1, &(0x7f0000000200)=""/250, 0x1f0000) 02:23:44 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x48000000, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:23:44 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x2000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:23:44 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080)={0xffffffffffffffff}, 0x111}}, 0x20) syz_open_dev$mice(&(0x7f0000000240)='/dev/input/mice\x00', 0x0, 0x22201) r3 = syz_open_dev$cec(&(0x7f0000000100)='/dev/cec#\x00', 0x0, 0x2) epoll_pwait(r3, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}], 0x7, 0x6, &(0x7f00000001c0)={0x8f}, 0x3) r4 = dup2(r1, r0) write$RDMA_USER_CM_CMD_SET_OPTION(r4, &(0x7f0000000040)={0xe, 0x18, 0xfa00, @id_tos={&(0x7f0000000000)=0x200, r2, 0x0, 0x0, 0x1}}, 0x20) [ 1213.288257][ T6316] binder_transaction: 8 callbacks suppressed [ 1213.288278][ T6316] binder: 6305:6316 transaction failed 29201/-22, size 0-0 line 2995 02:23:44 executing program 1: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r0, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) 02:23:44 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080), 0x111}}, 0x20) dup2(r1, r0) 02:23:44 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x4c000000, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:23:44 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x3000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1213.437214][T25568] binder_release_work: 8 callbacks suppressed [ 1213.437223][T25568] binder: undelivered TRANSACTION_ERROR: 29201 02:23:44 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x60000000, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1213.538448][ T6510] binder: 6445:6510 transaction failed 29201/-22, size 0-0 line 2995 02:23:44 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r1, &(0x7f0000000000), 0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r1, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) 02:23:44 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = syz_open_dev$admmidi(&(0x7f0000000040)='/dev/admmidi#\x00', 0x4fc, 0x0) ioctl$PPPIOCSFLAGS1(r1, 0x40047459, &(0x7f0000000100)) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000140)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080), 0x111}}, 0x20) r3 = dup2(r2, r0) ioctl$DRM_IOCTL_WAIT_VBLANK(r3, 0xc018643a, &(0x7f0000000000)={0x20000000, 0x2, 0x26}) 02:23:44 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x4000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1213.598334][T25568] binder: undelivered TRANSACTION_ERROR: 29201 [ 1213.689443][ T6547] binder: 6532:6547 transaction failed 29201/-22, size 0-0 line 2995 [ 1213.758228][T11612] binder: undelivered TRANSACTION_ERROR: 29201 [ 1213.768879][ T6638] misc userio: No port type given on /dev/userio 02:23:44 executing program 5: r0 = open(&(0x7f0000000500)='./bus\x00', 0x141042, 0x0) close(r0) syz_open_dev$loop(&(0x7f0000000540)='/dev/loop#\x00', 0x0, 0x105082) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0x526987c9) read(r1, &(0x7f0000000200)=""/250, 0x1f1000) 02:23:44 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x68000000, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:23:44 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x5000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:23:44 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080), 0x111}}, 0x20) dup2(r1, r0) 02:23:44 executing program 1: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r0, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) [ 1214.251188][ T6657] binder: 6647:6657 transaction failed 29201/-22, size 0-0 line 2995 02:23:45 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080), 0x111}}, 0x20) modify_ldt$read(0x0, &(0x7f0000000100)=""/199, 0xc7) dup2(r1, r0) 02:23:45 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x6c000000, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:23:45 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x6000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1214.389966][ T2988] binder: undelivered TRANSACTION_ERROR: 29201 02:23:45 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x74000000, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1214.435009][ T6847] binder: 6837:6847 transaction failed 29201/-22, size 0-0 line 2995 [ 1214.464167][ T2988] binder: undelivered TRANSACTION_ERROR: 29201 02:23:45 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r1, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r1, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) 02:23:45 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x7000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:23:45 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080), 0x111}}, 0x20) dup2(r1, r0) openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20ncci\x00', 0x10000, 0x0) [ 1214.584405][ T6871] binder: 6868:6871 transaction failed 29201/-22, size 0-0 line 2995 [ 1214.631380][ T22] binder: undelivered TRANSACTION_ERROR: 29201 02:23:45 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x7a000000, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:23:45 executing program 5: r0 = open(&(0x7f0000000500)='./bus\x00', 0x141042, 0x0) close(r0) syz_open_dev$loop(&(0x7f0000000540)='/dev/loop#\x00', 0x0, 0x105082) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0x526987c9) read(r1, &(0x7f0000000200)=""/250, 0x1f2000) 02:23:45 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0xa000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:23:45 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000002480)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) readv(r1, &(0x7f0000000000)=[{&(0x7f0000000100)=""/164, 0xa4}, {&(0x7f00000003c0)=""/4096, 0x1000}, {&(0x7f0000000240)=""/247, 0xf7}, {&(0x7f00000013c0)=""/4096, 0x1000}, {&(0x7f00000023c0)=""/176, 0xb0}], 0x5) socket$inet_udp(0x2, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080), 0x111}}, 0x20) dup2(r1, r0) [ 1215.133038][ T6986] binder_transaction: 8 callbacks suppressed [ 1215.133048][ T6986] binder: 6985:6986 got transaction to invalid handle [ 1215.175233][ T6986] binder: 6985:6986 transaction failed 29201/-22, size 0-0 line 2995 [ 1215.204141][ T2988] binder: undelivered TRANSACTION_ERROR: 29201 02:23:46 executing program 1: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r0, 0x0, 0x0) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r0, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) 02:23:46 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x20000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:23:46 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0xfdfdffff, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:23:46 executing program 4: r0 = dup2(0xffffffffffffffff, 0xffffffffffffffff) r1 = accept$nfc_llcp(0xffffffffffffffff, &(0x7f0000000300), &(0x7f00000003c0)=0x60) r2 = syz_open_dev$ndb(&(0x7f0000000400)='/dev/nbd#\x00', 0x0, 0x101040) pipe2$9p(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80800) r4 = fcntl$dupfd(0xffffffffffffffff, 0x406, 0xffffffffffffffff) r5 = accept$nfc_llcp(0xffffffffffffffff, &(0x7f0000000480), &(0x7f0000000500)=0x60) r6 = syz_open_dev$admmidi(&(0x7f0000000540)='/dev/admmidi#\x00', 0x0, 0x2000) r7 = perf_event_open(&(0x7f00000005c0)={0x2, 0x70, 0xfffffffffffffffc, 0x1, 0x6, 0x3, 0x0, 0x74, 0x400, 0x9, 0x1, 0x3, 0x80000000, 0xef, 0x5, 0x42, 0x2, 0xfffffffffffffffa, 0xfffffffffffffff8, 0x2, 0x3, 0xeb7, 0x0, 0x100000000, 0x9, 0x4, 0x5, 0x8, 0x2, 0xfffffffffffffffa, 0x7, 0x1, 0x80000001, 0x9, 0x80, 0x81, 0x7, 0x802, 0x0, 0x401, 0x5, @perf_bp={&(0x7f0000000580), 0x8}, 0x104, 0xb0, 0x6, 0xb, 0x3ff, 0x401, 0x81}, 0xffffffffffffffff, 0x4, 0xffffffffffffff9c, 0x1) r8 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000640)='/dev/dlm-control\x00', 0x0, 0x0) r9 = accept$netrom(0xffffffffffffff9c, &(0x7f0000000680)={{0x3, @null}, [@netrom, @null, @bcast, @netrom, @remote, @remote, @rose, @bcast]}, &(0x7f0000000700)=0x48) r10 = syz_open_dev$sndpcmc(&(0x7f0000000740)='/dev/snd/pcmC#D#c\x00', 0x40, 0x800) r11 = syz_open_dev$vcsn(&(0x7f0000000780)='/dev/vcs#\x00', 0x1ff, 0x2) r12 = epoll_create1(0x80000) r13 = syz_open_dev$sg(&(0x7f00000007c0)='/dev/sg#\x00', 0x5, 0x80000) r14 = openat$userio(0xffffffffffffff9c, &(0x7f0000000800)='/dev/userio\x00', 0x81, 0x0) r15 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000840)='/dev/vfio/vfio\x00', 0x70800, 0x0) r16 = socket$inet_udplite(0x2, 0x2, 0x88) r17 = accept$ax25(0xffffffffffffff9c, &(0x7f0000000880)={{}, [@netrom, @null, @null, @netrom, @netrom, @default, @netrom]}, &(0x7f0000000900)=0x48) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(0xffffffffffffff9c, 0xc00c642d, &(0x7f0000000940)={0x0, 0x80000, 0xffffffffffffffff}) r19 = socket$netlink(0x10, 0x3, 0xd) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000980)=0x0) stat(&(0x7f00000009c0)='./file0\x00', &(0x7f0000000a00)={0x0, 0x0, 0x0, 0x0, 0x0}) getresgid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)=0x0) r23 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000b40)='/dev/snapshot\x00', 0x1, 0x0) r24 = syz_open_dev$mice(&(0x7f0000000b80)='/dev/input/mice\x00', 0x0, 0x82) r25 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000bc0)='/dev/kvm\x00', 0x0, 0x0) r26 = syz_open_dev$vivid(&(0x7f0000000c00)='/dev/video#\x00', 0x1, 0x2) r27 = socket$inet6_udplite(0xa, 0x2, 0x88) r28 = openat$full(0xffffffffffffff9c, &(0x7f0000000c40)='/dev/full\x00', 0x200, 0x0) r29 = syz_open_dev$admmidi(&(0x7f0000000c80)='/dev/admmidi#\x00', 0x1, 0x400200) r30 = gettid() r31 = getuid() lstat(&(0x7f0000000cc0)='./file0\x00', &(0x7f0000000d00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$unix(r0, &(0x7f0000000e80)={&(0x7f0000000000)=@abs={0x0, 0x0, 0x4e24}, 0x6e, &(0x7f00000002c0)=[{&(0x7f0000000100)="723cf57343624c08db71be12e75bbddc5e961c460ae856191a702f6abf33071354e586d34ae27489136ff9293749ce906a66503a60b2efe590fe0e199a0123e0906e771193fc63a0379c181ef79a3fa5839674846e832962de5a31e6a8e37843d0baeb7351840b398168521460d870b2cde47d0f7a460a778b7257721e065ae6bb53dd52f7c67df8a4b2de0ea4f17cc7ee7227ef", 0x94}, {&(0x7f0000000240)="4a5598b2084aca67c3be282d782bd3412bb0566217e8ba33d89cf2202df1ded14569fbbf1aae52bf3500e3ddc539b92c4a683a242bdf6a5e3628cb02f4918aeba509008bc8d8e2d5c7e787735617341d7f22af239c3336a14dd64c", 0x5b}, {&(0x7f00000001c0)="009cb9f7225ac94f20f1902359aa59452ef55762692021565a728ea63be69b0f5427bb5c5ec09686095339aa4bbbc9c79af83c976086f63fd5b3f1dc7a", 0x3d}], 0x3, &(0x7f0000000d80)=[@rights={0x38, 0x1, 0x1, [r1, r2, r3, r4, r5, r6, r7, r8, r9, r10]}, @rights={0x38, 0x1, 0x1, [r11, r12, r13, r14, r15, r16, r17, r18, r19]}, @cred={0x20, 0x1, 0x2, r20, r21, r22}, @rights={0x18, 0x1, 0x1, [r23]}, @rights={0x20, 0x1, 0x1, [r24, r25, r26, r27]}, @rights={0x18, 0x1, 0x1, [r28, r29]}, @cred={0x20, 0x1, 0x2, r30, r31, r32}], 0x100, 0x8001}, 0x800) r33 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r34 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r33, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080), 0x111}}, 0x20) dup2(r34, r33) 02:23:46 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r1, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r1, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) 02:23:46 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0xfffffdfd, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1215.586639][ T7102] binder: 7098:7102 got transaction to invalid handle [ 1215.622147][ T7102] binder: 7098:7102 transaction failed 29201/-22, size 0-0 line 2995 02:23:46 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x3f000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:23:46 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x54002, 0x0) ioctl$PPPIOCGCHAN(r2, 0x80047437, &(0x7f0000000040)) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080), 0x111}}, 0x20) dup2(r1, r0) [ 1215.700530][ T22] binder: undelivered TRANSACTION_ERROR: 29201 02:23:46 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x100000000000000, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1215.766070][ T7214] binder: 7213:7214 got transaction to invalid handle [ 1215.788765][ T7214] binder: 7213:7214 transaction failed 29201/-22, size 0-0 line 2995 [ 1215.863615][ T22] binder: undelivered TRANSACTION_ERROR: 29201 02:23:46 executing program 5: r0 = open(&(0x7f0000000500)='./bus\x00', 0x141042, 0x0) close(r0) syz_open_dev$loop(&(0x7f0000000540)='/dev/loop#\x00', 0x0, 0x105082) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0x526987c9) read(r1, &(0x7f0000000200)=""/250, 0x1f3000) 02:23:46 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x200000000000000, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:23:46 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x48000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1216.017984][ T7327] binder: 7326:7327 got transaction to invalid handle [ 1216.030712][ T7327] binder: 7326:7327 transaction failed 29201/-22, size 0-0 line 2995 [ 1216.084112][ T2988] binder: undelivered TRANSACTION_ERROR: 29201 02:23:47 executing program 1: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r0, 0x0, 0x0) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r0, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) 02:23:47 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080), 0x111}}, 0x20) r2 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/vsock\x00', 0x4000, 0x0) ioctl$LOOP_SET_DIRECT_IO(r2, 0x4c08, 0x9) ioctl$SNDRV_SEQ_IOCTL_SUBSCRIBE_PORT(r2, 0x40505330, &(0x7f0000000100)={{0x80000000, 0x6}, {0x7fffffff, 0x91}, 0x81, 0x6, 0x200}) dup2(r1, r0) 02:23:47 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x300000000000000, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:23:47 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x4c000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:23:47 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r1, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r1, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) 02:23:47 executing program 5: r0 = open(&(0x7f0000000500)='./bus\x00', 0x141042, 0x0) close(r0) syz_open_dev$loop(&(0x7f0000000540)='/dev/loop#\x00', 0x0, 0x105082) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0x526987c9) read(r1, &(0x7f0000000200)=""/250, 0x1f4000) [ 1216.965901][ T7343] binder: 7340:7343 got transaction to invalid handle 02:23:47 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x400000000000000, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:23:47 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x60000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:23:47 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r2 = syz_open_dev$vcsn(&(0x7f0000000100)='/dev/vcs#\x00', 0x96d, 0x80) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000180)={0x80000000, 0x9, 0x4}, 0xc) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0x2, 0x0) ioctl$CAPI_NCCI_OPENCOUNT(r3, 0x80044326, &(0x7f0000000140)=0x7) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080), 0x111}}, 0x20) dup2(r1, r0) 02:23:47 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x68000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1217.156362][ T7462] binder: 7460:7462 got transaction to invalid handle 02:23:48 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x500000000000000, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:23:48 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x600000000000000, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1217.300710][ T7576] binder: 7515:7576 got transaction to invalid handle 02:23:49 executing program 1: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r0, 0x0, 0x0) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r0, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) 02:23:49 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080), 0x111}}, 0x20) dup2(r1, r0) 02:23:49 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x6c000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:23:49 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x700000000000000, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:23:49 executing program 5: r0 = open(&(0x7f0000000500)='./bus\x00', 0x141042, 0x0) close(r0) syz_open_dev$loop(&(0x7f0000000540)='/dev/loop#\x00', 0x0, 0x105082) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0x526987c9) read(r1, &(0x7f0000000200)=""/250, 0x1f5000) 02:23:49 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r1, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r1, 0x0, 0x0) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r1, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) 02:23:49 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0xa00000000000000, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1218.384240][ T7600] binder: 7595:7600 got transaction to invalid handle [ 1218.412673][ T7600] binder_transaction: 3 callbacks suppressed [ 1218.412691][ T7600] binder: 7595:7600 transaction failed 29201/-22, size 0-0 line 2995 02:23:49 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x80, 0x2) setsockopt$TIPC_CONN_TIMEOUT(r1, 0x10f, 0x82, &(0x7f0000000040)=0xfffffffffffffffa, 0x4) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080), 0x111}}, 0xfffffffffffffe1d) dup2(r2, r0) 02:23:49 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x74000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:23:49 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x2000000000000000, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1218.514286][ T2988] binder_release_work: 3 callbacks suppressed [ 1218.514295][ T2988] binder: undelivered TRANSACTION_ERROR: 29201 02:23:49 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x4800000000000000, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1218.588453][ T7751] binder: 7750:7751 got transaction to invalid handle [ 1218.598951][ T7751] binder: 7750:7751 transaction failed 29201/-22, size 0-0 line 2995 02:23:49 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x7a000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1218.645221][ T22] binder: undelivered TRANSACTION_ERROR: 29201 [ 1218.710057][ T7860] binder: 7859:7860 got transaction to invalid handle [ 1218.720239][ T7860] binder: 7859:7860 transaction failed 29201/-22, size 0-0 line 2995 [ 1218.749955][ T22] binder: undelivered TRANSACTION_ERROR: 29201 02:23:50 executing program 1: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r0, &(0x7f0000000100), 0x0) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r0, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) 02:23:50 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0x0, 0x2) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='vegas\x00', 0x6) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080), 0x111}}, 0x20) tee(r0, r2, 0x3f, 0x0) dup2(r2, r0) 02:23:50 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x4c00000000000000, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:23:50 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0xfdfdffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:23:50 executing program 5: r0 = open(&(0x7f0000000500)='./bus\x00', 0x141042, 0x0) close(r0) syz_open_dev$loop(&(0x7f0000000540)='/dev/loop#\x00', 0x0, 0x105082) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0x526987c9) read(r1, &(0x7f0000000200)=""/250, 0x1f6000) 02:23:50 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r1, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r1, 0x0, 0x0) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r1, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) [ 1219.752028][ T7874] binder: 7872:7874 transaction failed 29201/-22, size 0-0 line 2995 02:23:50 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x6000000000000000, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:23:50 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0xfffffdfd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:23:50 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) dup2(r1, r0) [ 1219.886304][ T22] binder: undelivered TRANSACTION_ERROR: 29201 02:23:50 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x6800000000000000, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1219.978686][ T8007] binder: 7995:8007 transaction failed 29201/-22, size 0-0 line 2995 02:23:50 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x6c00000000000000, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:23:50 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x100000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1220.043153][ T2988] binder: undelivered TRANSACTION_ERROR: 29201 [ 1220.122545][ T8106] binder: 8104:8106 got transaction to context manager from process owning it [ 1220.131745][ T8106] binder: 8104:8106 transaction failed 29201/-22, size 0-0 line 2986 [ 1220.169864][ T2988] binder: undelivered TRANSACTION_ERROR: 29201 02:23:51 executing program 1: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r0, &(0x7f0000000100), 0x0) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r0, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) 02:23:51 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/autofs\x00', 0x140, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080), 0x111}}, 0x20) dup2(r1, r0) 02:23:51 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x7400000000000000, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:23:51 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:23:51 executing program 5: r0 = open(&(0x7f0000000500)='./bus\x00', 0x141042, 0x0) close(r0) syz_open_dev$loop(&(0x7f0000000540)='/dev/loop#\x00', 0x0, 0x105082) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0x526987c9) read(r1, &(0x7f0000000200)=""/250, 0x1f7000) 02:23:51 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r1, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r1, 0x0, 0x0) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r1, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) [ 1221.136772][ T8120] binder: 8115:8120 got transaction to context manager from process owning it [ 1221.165761][ T8120] binder: 8115:8120 transaction failed 29201/-22, size 0-0 line 2986 02:23:51 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x300000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:23:52 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x7a00000000000000, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1221.214511][ T2988] binder: undelivered TRANSACTION_ERROR: 29201 02:23:52 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080), 0x111}}, 0x20) ioctl$EXT4_IOC_MOVE_EXT(r0, 0xc028660f, &(0x7f0000000140)={0x0, r1, 0xec, 0x7f, 0x2, 0x400}) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm_plock\x00', 0x8a042, 0x0) ioctl$sock_inet6_tcp_SIOCOUTQNSD(r2, 0x894b, &(0x7f00000001c0)) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000040)={0x10}) dup2(r1, r0) bind$bt_l2cap(r2, &(0x7f0000000180)={0x1f, 0x101, {0x3f, 0x101, 0xfffffffffffffff7, 0x800, 0x7, 0x4000000000000}, 0x1ff, 0xfffffffffffffff7}, 0xe) [ 1221.293874][ T8236] binder: 8202:8236 got transaction to context manager from process owning it [ 1221.311191][ T8236] binder: 8202:8236 transaction failed 29201/-22, size 0-0 line 2986 02:23:52 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x400000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:23:52 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0xfdfdffff00000000, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1221.367596][ T22] binder: undelivered TRANSACTION_ERROR: 29201 02:23:52 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x630b}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1221.426472][ T8268] binder: 8256:8268 got transaction to context manager from process owning it [ 1221.439192][ T8268] binder: 8256:8268 transaction failed 29201/-22, size 0-0 line 2986 [ 1221.516879][ T22] binder: undelivered TRANSACTION_ERROR: 29201 [ 1221.540449][ T8351] binder: 8350:8351 ERROR: BC_REGISTER_LOOPER called without request [ 1221.551688][ T8351] binder: 8350:8351 unknown command 0 [ 1221.557397][ T8351] binder: 8350:8351 ioctl c0306201 20000240 returned -22 02:23:53 executing program 1: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r0, &(0x7f0000000100), 0x0) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r0, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) 02:23:53 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080), 0x111}}, 0x20) dup2(r0, r1) 02:23:53 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x500000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:23:53 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x630c}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:23:53 executing program 5: r0 = open(&(0x7f0000000500)='./bus\x00', 0x141042, 0x0) close(r0) syz_open_dev$loop(&(0x7f0000000540)='/dev/loop#\x00', 0x0, 0x105082) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0x526987c9) read(r1, &(0x7f0000000200)=""/250, 0x1f8000) 02:23:53 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r1, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r1, &(0x7f0000000100), 0x0) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r1, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) [ 1222.546759][ T8365] binder: 8359:8365 got transaction to context manager from process owning it [ 1222.562641][ T8370] binder: 8362:8370 unknown command 0 [ 1222.576558][ T8365] binder: 8359:8365 transaction failed 29201/-22, size 0-0 line 2986 [ 1222.583882][ T8370] binder: 8362:8370 ioctl c0306201 20000240 returned -22 02:23:53 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x630d}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:23:53 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x600000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:23:53 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000480)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f0000000400)={'nat\x00', 0x0, 0x4, 0xf9, [], 0x4, &(0x7f0000000380)=[{}, {}, {}, {}], &(0x7f00000004c0)=""/249}, &(0x7f00000005c0)=0x78) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vcs\x00', 0x2, 0x0) ioctl$IMADDTIMER(r1, 0x80044940, &(0x7f0000000140)=0x14) fanotify_mark(r1, 0x1, 0x1, r1, &(0x7f0000000040)='./file0\x00') syz_open_dev$ndb(&(0x7f0000000000)='/dev/nbd#\x00', 0x0, 0x100) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(r1, 0x84, 0x71, &(0x7f00000001c0)={0x0, 0x8001}, &(0x7f0000000240)=0x8) getsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r1, 0x84, 0xa, &(0x7f0000000280)={0xc5, 0x401, 0x2, 0x1, 0x80, 0x1, 0x2, 0x4, r3}, &(0x7f00000002c0)=0x20) ioctl$KDSIGACCEPT(r1, 0x4b4e, 0xc) ioctl$SIOCX25GFACILITIES(r1, 0x89e2, &(0x7f0000000300)) ioctl$SG_GET_KEEP_ORPHAN(r1, 0x2288, &(0x7f00000003c0)) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080), 0x111}}, 0x20) setsockopt$llc_int(r1, 0x10c, 0x0, &(0x7f0000000680)=0x40, 0x4) r4 = fcntl$dupfd(r2, 0x406, r0) ioctl$VIDIOC_OVERLAY(r4, 0x4004560e, &(0x7f0000000640)=0x1) epoll_wait(r4, &(0x7f0000000600)=[{}, {}, {}, {}], 0x155555555555580d, 0x2) dup2(r2, r0) getsockopt$TIPC_IMPORTANCE(r1, 0x10f, 0x7f, &(0x7f0000000180), &(0x7f0000000340)=0x4) [ 1222.676733][ T22] binder: undelivered TRANSACTION_ERROR: 29201 02:23:53 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046302}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1222.729349][ T8486] binder: 8480:8486 unknown command 0 [ 1222.737679][ T8486] binder: 8480:8486 ioctl c0306201 20000240 returned -22 [ 1222.739462][ T8484] binder: 8483:8484 got transaction to context manager from process owning it 02:23:53 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x700000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:23:53 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) ioctl$EXT4_IOC_MIGRATE(r1, 0x6609) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080), 0x111}}, 0x20) dup2(r1, r0) [ 1222.864410][ T8599] binder: BC_ACQUIRE_RESULT not supported [ 1222.878332][ T8599] binder: 8596:8599 ioctl c0306201 20000240 returned -22 [ 1222.892699][ T8605] binder: 8601:8605 got transaction to context manager from process owning it 02:23:54 executing program 1: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r0, &(0x7f0000000100)=[{0x0}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r0, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) 02:23:54 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046303}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:23:54 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0xa00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:23:54 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x80) ioctl$SIOCX25GDTEFACILITIES(r1, 0x89ea, &(0x7f0000000040)) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) ioctl$TUNSETVNETLE(r1, 0x400454dc, &(0x7f00000001c0)=0x1) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080), 0x111}}, 0x20) sendto$ax25(r1, &(0x7f0000000100)="903b20fe3a8d33f290a072961d546168159a744433126e4b5abca195352d8a9b80d3b8c9acaf", 0x26, 0x40004, &(0x7f0000000140)={{0x3, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, 0x3}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @null, @default, @bcast, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}]}, 0x48) dup2(r2, r0) 02:23:54 executing program 5: r0 = open(&(0x7f0000000500)='./bus\x00', 0x141042, 0x0) close(r0) syz_open_dev$loop(&(0x7f0000000540)='/dev/loop#\x00', 0x0, 0x105082) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0x526987c9) read(r1, &(0x7f0000000200)=""/250, 0x1f9000) 02:23:54 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r1, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r1, &(0x7f0000000100), 0x0) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r1, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) [ 1223.894087][ T8717] binder: 8715:8717 unknown command 1074029315 [ 1223.926060][ T8724] binder: 8716:8724 got transaction to context manager from process owning it [ 1223.935600][ T8717] binder: 8715:8717 ioctl c0306201 20000240 returned -22 [ 1223.952304][ T8724] binder_transaction: 2 callbacks suppressed [ 1223.952320][ T8724] binder: 8716:8724 transaction failed 29201/-22, size 0-0 line 2986 02:23:54 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:23:54 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x2000000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:23:54 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r2 = syz_open_dev$vcsn(&(0x7f0000000000)='/dev/vcs#\x00', 0xfffffffffffff8e5, 0x101002) getsockopt$inet_sctp_SCTP_NODELAY(r2, 0x84, 0x3, &(0x7f0000000040), &(0x7f0000000100)=0x4) mlockall(0x7) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080), 0x111}}, 0x20) dup2(r1, r0) [ 1224.036798][T11612] binder_release_work: 2 callbacks suppressed [ 1224.036806][T11612] binder: undelivered TRANSACTION_ERROR: 29201 [ 1224.109869][ T8842] binder: 8841:8842 got transaction to context manager from process owning it [ 1224.125888][ T8842] binder: 8841:8842 transaction failed 29201/-22, size 0-0 line 2986 [ 1224.127101][ T8844] binder_alloc: 8841: binder_alloc_buf, no vma [ 1224.142884][ T8844] binder: 8843:8844 transaction failed 29189/-3, size 0-0 line 3148 02:23:54 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046306}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:23:54 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x3f00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1224.174726][T25568] binder: undelivered TRANSACTION_ERROR: 29189 [ 1224.200690][ T2988] binder: undelivered TRANSACTION_ERROR: 29201 [ 1224.252888][ T8852] binder: 8850:8852 Release 1 refcount change on invalid ref 0 ret -22 [ 1224.271189][ T8852] binder_alloc: 8851: binder_alloc_buf, no vma [ 1224.278148][ T8852] binder: 8850:8852 transaction failed 29189/-3, size 0-0 line 3148 [ 1224.287175][ T8853] binder: 8851:8853 got transaction to context manager from process owning it 02:23:55 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046307}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1224.309018][T25568] binder: undelivered TRANSACTION_ERROR: 29189 [ 1224.310703][ T8853] binder: 8851:8853 transaction failed 29201/-22, size 0-0 line 2986 [ 1224.375220][ T8942] binder: 8909:8942 DecRefs 0 refcount change on invalid ref 0 ret -22 [ 1224.384321][T25568] binder: undelivered TRANSACTION_ERROR: 29201 [ 1224.395724][ T8942] binder: 8909:8942 transaction failed 29189/-22, size 0-0 line 2995 [ 1224.445006][T25568] binder: undelivered TRANSACTION_ERROR: 29189 02:23:56 executing program 1: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r0, &(0x7f0000000100)=[{0x0}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r0, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) 02:23:56 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x4800000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:23:56 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x4004630a}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:23:56 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/capi/capi20\x00', 0x4dffffe31ec64679, 0x0) ioctl$UI_ABS_SETUP(r1, 0x401c5504, &(0x7f0000000040)={0x7, {0xffffffffffffffff, 0x4, 0xb81, 0x9, 0x0, 0xda}}) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080), 0x111}}, 0x20) dup2(r1, r0) ioctl$KVM_SET_TSS_ADDR(r1, 0xae47, 0xcffe) 02:23:56 executing program 5: r0 = open(&(0x7f0000000500)='./bus\x00', 0x141042, 0x0) close(r0) syz_open_dev$loop(&(0x7f0000000540)='/dev/loop#\x00', 0x0, 0x105082) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0x526987c9) read(r1, &(0x7f0000000200)=""/250, 0x1fa000) 02:23:56 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r1, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r1, &(0x7f0000000100), 0x0) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r1, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) [ 1225.274955][ T8971] binder: 8969:8971 unknown command 1074029322 [ 1225.308375][ T8982] binder: 8968:8982 got transaction to context manager from process owning it 02:23:56 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046312}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1225.320088][ T8971] binder: 8969:8971 ioctl c0306201 20000240 returned -22 [ 1225.337383][ T8982] binder: 8968:8982 transaction failed 29201/-22, size 0-0 line 2986 02:23:56 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x4c00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:23:56 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ubi_ctrl\x00', 0x800, 0x0) ioctl$TIOCNOTTY(r1, 0x5422) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080), 0x111}}, 0x20) dup2(r2, r0) [ 1225.404769][T11612] binder: undelivered TRANSACTION_ERROR: 29201 [ 1225.457828][ T9090] binder: 9087:9090 unknown command 1074029330 [ 1225.478154][ T9090] binder: 9087:9090 ioctl c0306201 20000240 returned -22 [ 1225.488036][ T9094] binder: 9089:9094 got transaction to context manager from process owning it [ 1225.500204][ T9094] binder: 9089:9094 transaction failed 29201/-22, size 0-0 line 2986 02:23:56 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x4004635a}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:23:56 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x6000000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1225.547910][T11612] binder: undelivered TRANSACTION_ERROR: 29201 [ 1225.578897][ T9199] binder: 9193:9199 unknown command 1074029402 [ 1225.595706][ T9199] binder: 9193:9199 ioctl c0306201 20000240 returned -22 02:23:56 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) statfs(&(0x7f0000000000)='./file0\x00', &(0x7f0000000100)=""/2) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080), 0x111}}, 0x20) r2 = dup2(r1, r0) ioctl$VIDIOC_ENUMINPUT(r2, 0xc050561a, &(0x7f0000000140)={0x2, "8711263c7ff77316a3a8f8a771ed288d433f080de09d0538f888dba4e2676070", 0x2, 0x1, 0x3, 0x40080, 0x20, 0x2}) [ 1225.622109][ T9202] binder: 9201:9202 got transaction to context manager from process owning it [ 1225.649501][ T9202] binder: 9201:9202 transaction failed 29201/-22, size 0-0 line 2986 [ 1225.691755][T11612] binder: undelivered TRANSACTION_ERROR: 29201 02:23:57 executing program 1: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r0, &(0x7f0000000100)=[{0x0}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r0, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) 02:23:57 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x4004635c}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:23:57 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x6800000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:23:57 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x40800, 0x0) ioctl$TCXONC(r1, 0x540a, 0x1) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080), 0x111}}, 0x20) stat(&(0x7f0000000040)='./file0\x00', &(0x7f0000000140)) ioctl$KVM_ASSIGN_SET_MSIX_NR(r1, 0x4008ae73, &(0x7f0000000100)={0x89, 0x47f4}) pipe(&(0x7f00000001c0)) dup2(r2, r0) ioctl$VIDIOC_G_SLICED_VBI_CAP(r1, 0xc0745645, &(0x7f0000000240)={0x3, [0xfffffffffffffff9, 0x6017, 0x8, 0x2e75ff4e, 0x0, 0x9, 0x80000001, 0x80000000, 0x2, 0x2, 0x8001, 0x8, 0x0, 0x7fff, 0x1, 0x81bf, 0xa4, 0x2bde, 0x6, 0xffff, 0x7, 0x100000000, 0xfffffffffffffffc, 0x9, 0x3d314000, 0x6, 0x5, 0x3, 0x1, 0x0, 0x3, 0x0, 0x484e, 0x9, 0x8f, 0x7a0, 0x8001, 0xffffffffffff8000, 0x7fffffff, 0x6, 0xe000, 0x4, 0x80, 0x1, 0xfffffffffffffffa, 0x37, 0x8, 0x6], 0xf}) 02:23:57 executing program 5: r0 = open(&(0x7f0000000500)='./bus\x00', 0x141042, 0x0) close(r0) syz_open_dev$loop(&(0x7f0000000540)='/dev/loop#\x00', 0x0, 0x105082) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0x526987c9) read(r1, &(0x7f0000000200)=""/250, 0x1fb000) 02:23:57 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r1, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r1, &(0x7f0000000100)=[{0x0}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r1, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) [ 1226.693843][ T9331] binder: 9328:9331 unknown command 1074029404 [ 1226.694838][ T9327] binder: 9322:9327 got transaction to context manager from process owning it [ 1226.719388][ T9331] binder: 9328:9331 ioctl c0306201 20000240 returned -22 02:23:57 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40086303}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1226.758022][ T9327] binder: 9322:9327 transaction failed 29201/-22, size 0-0 line 2986 02:23:57 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x6c00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:23:57 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080), 0x111}}, 0x20) openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x101080, 0x0) r2 = dup2(r1, r0) renameat(r2, &(0x7f0000000040)='./file0\x00', r2, &(0x7f0000000100)='./file0\x00') [ 1226.827627][T11612] binder: undelivered TRANSACTION_ERROR: 29201 [ 1226.868927][ T9446] binder: 9444:9446 BC_FREE_BUFFER u4048631100000000 no match [ 1226.891946][ T9446] binder: 9444:9446 unknown command 0 [ 1226.907732][ T9449] binder: 9447:9449 got transaction to context manager from process owning it 02:23:57 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x7400000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1226.907978][ T9446] binder: 9444:9446 ioctl c0306201 20000240 returned -22 02:23:57 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x4008630a}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:23:57 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x1, 0x2) sendmsg$nl_route(r1, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000100)={&(0x7f0000000240)=@ipv6_getroute={0x130, 0x1a, 0x0, 0x70bd2c, 0x25dfdbfc, {0xa, 0x80, 0x94, 0x8, 0xfd, 0x2, 0xfe, 0xf, 0x2c00}, [@RTA_ENCAP={0xec, 0x16, @generic="71ebaf7b7ba31396ce75cc82c0ab87822147eaa3e26ac2d9a7449bea484d12c11e2d29c560c4c0d09009b5fdabc4ac6be63d07513ae528067cb4985cbc7795e25028078929bbe9c482b9708977d6b6226365d8c59d173fcd0ed36fe227f25fc0a197c8a1a6b1025b82423149fdcc528e2222e1d058789159dcbb39d55798bb52909392cfbc733c999f2dcf14eb20e4f26b1fb3b126f0f8610b5fbe0583dd866aa288b347c9557d4ead7518a13347353fd9213b35da5725920e262d16073817514fe8898f6891f40030ef922cdef898512f40e63c3fddc6ede6d2c225d46ce610d854fa756d"}, @RTA_ENCAP_TYPE={0x8, 0x15, 0x3}, @RTA_MARK={0x8, 0x10, 0x4}, @RTA_MARK={0x8, 0x10, 0x67b8f86c}, @RTA_EXPIRES={0x8, 0x17, 0x1}, @RTA_PRIORITY={0x8, 0x6, 0x5}]}, 0x130}, 0x1, 0x0, 0x0, 0x40000}, 0x40) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080), 0x111}}, 0x20) dup2(r2, r0) [ 1227.018224][ T9559] binder: BC_ATTEMPT_ACQUIRE not supported [ 1227.047331][ T9561] binder: 9560:9561 got transaction to context manager from process owning it [ 1227.058499][ T9559] binder: 9539:9559 ioctl c0306201 20000240 returned -22 02:23:58 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x7a00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:23:58 executing program 5: r0 = open(&(0x7f0000000500)='./bus\x00', 0x141042, 0x0) close(r0) syz_open_dev$loop(&(0x7f0000000540)='/dev/loop#\x00', 0x0, 0x105082) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0x526987c9) read(r1, &(0x7f0000000200)=""/250, 0x1fc000) 02:23:58 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080), 0x111}}, 0x20) dup2(r0, r0) 02:23:58 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40086310}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:23:58 executing program 1: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r0, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(0xffffffffffffffff, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) 02:23:58 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r1, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r1, &(0x7f0000000100)=[{0x0}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r1, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) [ 1228.068459][ T9679] binder: 9673:9679 BC_DEAD_BINDER_DONE 4048631100000000 not found [ 1228.079658][ T9685] binder: 9677:9685 got transaction to context manager from process owning it [ 1228.087224][ T9679] binder: 9673:9679 unknown command 0 [ 1228.095672][ T9679] binder: 9673:9679 ioctl c0306201 20000240 returned -22 02:23:58 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0xfdfdffff00000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:23:58 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x400c630e}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:23:59 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080), 0x111}}, 0x20) r1 = syz_open_dev$mice(&(0x7f0000000000)='/dev/input/mice\x00', 0x0, 0x101000) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000400)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write(r0, &(0x7f0000000380)="b3e7bd206ad0ea161b99a1d33ea52e5b1dd88628ba8e6df1e5937ddccb70938f5d7d1c5b76ca63382dc4baef5c4ceb06b5789c6546422602ce47b7425d940fe521a660e6e594045d6fdea4af1cc99d770192d121951d9d47957eb82f0730327e82999cb043382c91a81d369057ff3a8bceba31232bad2c31e6d898", 0x7b) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000140)='IPVS\x00') sendmsg$IPVS_CMD_DEL_DAEMON(r1, &(0x7f0000000280)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x100000040040}, 0x167, &(0x7f0000000240)={&(0x7f0000000180)={0x5c, r3, 0x300, 0x70bd27, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x8000}, @IPVS_CMD_ATTR_DEST={0x2c, 0x2, [@IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x80000001}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x3}, @IPVS_DEST_ATTR_FWD_METHOD={0x8}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x100}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_SERVICE={0xc, 0x1, [@IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}]}]}, 0x5c}, 0x1, 0x0, 0x0, 0x80}, 0x4000) mkdirat$cgroup(r1, &(0x7f0000000340)='syz1\x00', 0x1ff) ioctl$VIDIOC_QUERYCAP(r1, 0x80685600, &(0x7f00000002c0)) dup2(r0, r2) 02:23:59 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1228.235614][ T9791] binder: 9789:9791 got transaction to context manager from process owning it [ 1228.248125][ T9792] binder: 9790:9792 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 1228.273058][ T9792] binder: 9790:9792 unknown command 0 02:23:59 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x400c630f}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1228.314559][ T9792] binder: 9790:9792 ioctl c0306201 20000240 returned -22 [ 1228.353591][ T9835] binder: 9796:9835 got transaction to context manager from process owning it 02:23:59 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:23:59 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/nfsfs\x00') ioctl$EVIOCGBITSND(r2, 0x80404532, &(0x7f0000000100)=""/185) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080), 0x111}}, 0x20) dup2(r1, r0) [ 1228.470801][ T9905] binder: 9902:9905 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 1228.481469][ T9903] binder: 9900:9903 got transaction to context manager from process owning it [ 1228.485655][ T9905] binder: 9902:9905 unknown command 0 [ 1228.518004][ T9905] binder: 9902:9905 ioctl c0306201 20000240 returned -22 02:23:59 executing program 1: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r0, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(0xffffffffffffffff, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) 02:23:59 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:23:59 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080), 0x111}}, 0x20) r2 = dup2(r1, r0) ioctl$TCSBRK(r2, 0x5409, 0x3) 02:23:59 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40106308}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:23:59 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r1, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r1, &(0x7f0000000100)=[{0x0}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r1, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) 02:23:59 executing program 5: r0 = open(&(0x7f0000000500)='./bus\x00', 0x141042, 0x0) close(r0) syz_open_dev$loop(&(0x7f0000000540)='/dev/loop#\x00', 0x0, 0x105082) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0x526987c9) read(r1, &(0x7f0000000200)=""/250, 0x1fd000) 02:23:59 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r1, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(0xffffffffffffffff, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) [ 1228.977563][T10023] binder: 10013:10023 BC_INCREFS_DONE u4048631100000000 no match [ 1228.992661][T10021] binder_transaction: 6 callbacks suppressed [ 1228.992677][T10021] binder: 10012:10021 transaction failed 29201/-22, size 0-0 line 2986 [ 1229.019219][T10023] binder: 10013:10023 unknown command 0 02:23:59 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40106309}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1229.050959][T10023] binder: 10013:10023 ioctl c0306201 20000240 returned -22 02:23:59 executing program 4: r0 = accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev}, &(0x7f0000000040)=0x1c) fcntl$setstatus(r0, 0x4, 0x40000) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080), 0x111}}, 0x20) dup2(r2, r1) 02:23:59 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1229.121551][ T2988] binder_release_work: 6 callbacks suppressed [ 1229.121560][ T2988] binder: undelivered TRANSACTION_ERROR: 29201 02:24:00 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40406300}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1229.180297][T10136] binder: 10133:10136 BC_ACQUIRE_DONE u4048631100000000 no match [ 1229.193578][T10137] binder: 10135:10137 transaction failed 29201/-22, size 0-0 line 2986 [ 1229.198759][T10136] binder: 10133:10136 unknown command 0 [ 1229.211740][T10136] binder: 10133:10136 ioctl c0306201 20000240 returned -22 02:24:00 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x109200, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000140)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080), 0x111}}, 0x20) dup2(r1, r0) write$binfmt_aout(r0, &(0x7f00000003c0)={{0x1cf, 0x4, 0x7, 0x1d3, 0x255, 0x2, 0x2f1, 0x5de0249d}, "7fb8f4584371b47b8e908302a6a0e12d54ceefcb7a255e47893123988b1dd6edf05be52c97493bc50bb51b15185034d848bf1e1da623cd3837f602ae950505b082c61d02bd074011622e1166b7ffef33cdf5990ea4bb67d95fa4a88c1879db6a5eb90833b1e56a0f8a607d46314ac422e9dd83cd77525ab63174cd697a9a5d2046ab8f9d17c62ed20c0b15c129a1a590060b6e5dea71fb6c28d3bf514ca080ac9a83c4340dce18475ff41c43d244f3ee7ed11e7c6077421f34a4058c45814b0724348b419a396db2", [[], [], [], [], []]}, 0x5e8) [ 1229.309495][ T22] binder: undelivered TRANSACTION_ERROR: 29201 [ 1229.334950][T10244] binder: 10237:10244 transaction failed 29189/-22, size 0-0 line 2995 [ 1229.404467][ T22] binder: undelivered TRANSACTION_ERROR: 29189 02:24:00 executing program 1: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r0, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(0xffffffffffffffff, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) 02:24:00 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:00 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40406301}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:00 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080), 0x111}}, 0x20) r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x4040, 0x40) setsockopt$inet_tcp_TCP_CONGESTION(r2, 0x6, 0xd, &(0x7f0000000100)='yeah\x00', 0x5) sync_file_range(r0, 0x2ab, 0x3ff, 0x4) r3 = dup2(r1, r0) bind$isdn(r3, &(0x7f0000000000)={0x22, 0x4, 0x9000, 0x7ff, 0x8}, 0x6) 02:24:00 executing program 5: r0 = open(&(0x7f0000000500)='./bus\x00', 0x141042, 0x0) close(r0) syz_open_dev$loop(&(0x7f0000000540)='/dev/loop#\x00', 0x0, 0x105082) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0x526987c9) read(r1, &(0x7f0000000200)=""/250, 0x1fe000) 02:24:00 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r1, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(0xffffffffffffffff, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) [ 1229.882668][T10353] binder: 10352:10353 transaction failed 29201/-22, size 0-0 line 2986 [ 1229.892896][ T26] audit: type=1800 audit(1554690240.649:58): pid=10356 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed(directio) comm="syz-executor.4" name="file0" dev="sda1" ino=17201 res=0 [ 1229.910667][T10358] binder: 10357:10358 got reply transaction with no transaction stack [ 1229.921640][T10358] binder: 10357:10358 transaction failed 29201/-71, size 0-0 line 2900 02:24:00 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1229.953927][ T22] binder: undelivered TRANSACTION_ERROR: 29201 02:24:00 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40486311}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:00 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) writev(r0, &(0x7f0000000040)=[{&(0x7f0000000540)="640f93653203fb95ced05a7e831c153a44bb6928bea531c68ce27d29efcd8a2a119448072803e5a1398728c0d1268367a03099b90541074ad51281706f6ac5d57d429392d957f9dc1cf5696ce4dedb6ba44072f4f75003edb7e93975cb1937be27674e34a67a957db1ff44d7084b9e11841cd665b3ce1192c59c9bc391c896d29614a8026dd8f26a93130efc5f9016ddf482cb28148bdfa834e803f8ff6c6071b5c32a083faec6e301c58da7088add7e31cba2137c20bed4962810f6df4e4162671fbf05fb703e19809af49900e1d80b3b422192872037da010de0370cf7cfedfcd089cdc8ff8d66612220c3ca04b279d2e53580e146425077e9eb8b4b13f90f6359c5c213c74d71ec8c357d0606fcb84fb0388d9781709d081f6d81142a321b0b62ecaf00166cad42ebfa0def60f5b628dfa8d2cc9509c967a1748392adcf6f653593684754710738aa37e9e326694476da0c4d6373ecd3a2db4a315fa20c9462e5aa578698454e940fc12245acd7460eee25f1d6627a84198dc13c95cf9ff50dd36a7389e7bdef06a7829e5401ae1b6274698473b90ddccb2c566442a12b24615988bce75f9a72bef8d51b28afdd6c4a5a135cae0fb7d225b51428aa85980a5d1ad79bc0766ed326d27da5ef8b158c8f77879459ca8df9afba8561f4b52787597275177976b27a715af9f353d2db50f07401592910dd0c63740c87e466b899f6f9b854cae54db24f3b507f509ab310ed31c9ea8a8afa7bca4854311f0629408800d50c032732b59eaea61b096b60249dd55c8c6ef5cc55dd983c4be3171946e85704155ca79513cb2b922d77b88c1f467b00dcb5e343e29c99d293ef620bcd530a3f3f505e09baa4fd59cd4e75dd514fcb0e69fdb75fd1301139b1f0cfd7e9db56f64df5bc04b30c424e926318373f25a68d6fb4913292028717f20819d72b5df60742dc6d952ad234993a421d0ccf65d34d800deb4c515bf86da034606e04d3988fb9d7448d68d26a8c1c7448961c26337f8a69d1093370c1960e6e865eaca1377af56c4c35210dbeb7e4f10b931b09249b89a2581ee7637452f960b44491141b7d4108f0f4ded1f11c1511c2e4e965990c347489b9e4db60322fcd92fc1b2fad36c45ac9a37a16bfe25513f8116483a9925d2d3b0133c27fe6b312d9595df426a2248bfc5b2d78fe5b07509590ec2b1dd8e55b9ff80dfdb7b6de4171c7f0780b3d14a302542f6ed217d899ec1b5b7d8c97d7c1c1fb11da127e6ef88090e8b43c7b0e7f6965a1bd2b1f2911e586ffc88328c2e3fe866b5581c6e04032889c75b80ed4c426986b3d3a71fb18715e4e056a436ab6c84037051c66f9dd4fb16eb50f2ad4195339e1611c1ab24d0ca77cf2f88a661c51c9a6f693a622ec133da3f090a7097226c10fdbf360ea101ca1c0200abcedae7a29004e6323f9851d30f47492e182e93dcbdde0388f7ba83d208feb28772c51bfc31a94e61ac69aaacc42043c34cdabe25de0b7580521bbe31e8c92b7418f8fe7c353359b20d70b3a7f6ad7f8c10cd3dfb5738dbc723a86ee2a4ad2f680cc356908bfa28485406d092f87e5e371a3cba95148484d360678f481b52142f5c89e9d7e1f78c30437dec32da35b53989bfef3769ac0802d87da59a52dbd10c8e9034cbf433afa7702402b2b6e56cd98856a79125296e8af3e98cc51ce187594c3b7080834040fce615e243fb15945aa94c8bf83e5345feab56ebaa00139c378288c79256af39ace0b8224f582d2e8457f222005d6e944260a3a235362497d005c9aa4b9c497f2e56804e847feb7284d985a43a4fb35e79e651791ed95c7c213ee6e368f26d54dd9c3dc1741f4277be24e71de27968420028e0e30c6f27684c79d9fb416cda24d6674a71990c0c40cacaedcc509d012ed8012e29e55898f72826464f2c719e7e0b5d3efca7f3e654f3788bd2947dab0bf9a960252f39420f217e52c858e2da87b7d0498750fb16258074f92421894de5b19172ff028b04cedb0c5d600273919a634406133b69a54603554e55f7937419601c798d118578b2fb3f424638610094cc6f0af60bdcad9568a38c50c3877071be8684d797fbc3df11c6b55c4d15df7b2cde235fea3553eb5d1f891f11be29512c3dff00924be05fbab297ea98c5a57af25663cc3c0c81b5851c582330ff6fe08eefeda62364d69fb9203619b7baa189ce07bb4c900a2a5f2962d41a717f043f00026cf839334ecb2e1ffa03b851e292b43eea14cd4b7831d8d39c460c3f1c00238779049dab0ca80fa5a2905c5573435e7062f1393ca1c70f56ca12fcfa752765c5e1010596b67dc7c88488044dbc0ca853440cf94f7d054bfc2c88a654585ae9c38e8b701a268a4e7963755954e30ff332551af5bffa90ef984a58c73b5f68ce1ba2e8b7d8990d42c6abded1e1cbcc6d66ed0c758fd3afdd27e9e76abcf5d40533fe43115de0ccf1f29d6432cb13a0b52c72b7b1cda10d68c1b5ecc5e91de253aa83cda2c6165079ed544503456dc0d14030b1c777b8b9e8015a291fb224206edbe338e91d83eb01b09cd8a671406cc694d2219139092138f5bc3e480af0903514f3655ca3a651e1a22a766120b8b11fb834bc505661d32320420a5116e6250357d12f5ae1e34847928dd7e245be4a66a3c5fd84891d91719559ece00fb3fd29afe981ca85b8c305e63a33056a4f52b3a3876520481e6492bed677016c8fcc259946507c20a7b97f25f77df580793ec2244527877c5af1453c35c4126a73bb11115c4a739ea722c725e776da55b96ac5fd084adcae2d9c85de99405c7cfdb575dd9c1c35c79f052e3fe032ca3534adb44ecb4f4e37836141eb16beed80a0c542382b7542c69c7c19b621c8505773812659bdbf37580c19b5c8334be8875ecddd4add4237303aa3f93a57929a1056f09f79d1ef0596b2fc9e8e11606016f30ee35b7c7a1d65181af7ee41f94427862d7e5864dd9aa09ef3716ac14c249a81d4ef1eb8c6f830a62c95bb1aeac00691e87b77141d3bdc9768649fc5bec752363d3a4449e9525b18c6b1a7af019781997204d4fc798bf4e4e235ea00bbb219a94f6520abb0a87f033c848cc28ec8e40f33fb1fbe139bf452809d0b7bf3bd11909cb63b38d2d294246a96f7dc922995adc22b741295772555a6798138e4614f7d2f20a70e0dd1831bf5551a56ad9e1879a618b9ea955bb2cceb015ac8869722902e7142ca4b6964b1d1eaa5607013c08093f7a75321253d577c14541ee903bfc041acc9427597c0655ee05197153da453cc34ca5742d20ae007cbd311b24f8ff45c348dbcf34cf653a4ef2be2442b73c7a83b56132e37ce6270dcaddb07d26209d9d7f22617a3a10108d0c5bfd481826b53252fc0804ea0fa9e3defe43aacf42700b45ea00d3acfc7991901786c3017bf0cd20c65db225b8c51cc7dd5f71c9821ce96f84a492d2246c684605071ec6acab90799dcfc171a42366cd68713a5af09128bdc4f09057f3c9a232ae36e496b6bf7407c28bd6be02595ffe0d4cc91dd82c7720505ed1b3fe86b9cb3b44e5eb0a230c2b80c2e55fff7aeb43b81680a1de4af4f6f0a56b6036c4c00f8c8be1700615242c67a51c7c466070e206972da978b91b553e1c6bfcc601e920bcae94ebd1a863ea5142f13b55ceb3d79a1f3822b59c999d0d69d1a61000e47bc15ebf7843db89affcd0b2ac057a59005eadfd4dc4919d056cb55f4d43a7c370e763b6f55e3303395a15d7fafbab6c11401985be04048adf271f7c07944e3c885727e4af3e4b67a964db593edbc56272a71d883231692584e7683403a7674400e672a2ea2c590270bd5d4f9bc15c83155ac751c6e3fb9c7c050d53ccd36d7e177b1571a37878489aff97ae5acd7a139e8e9bab07fa8963b9a658b1874b6e74d9ef27c5e3b5f97ac6e7e81d200121e45ad7f6667f80007517e78a4ad593c7c3b76ca5a4c1951efcefd72a65b188409578cec75dfa7ad179d7ba94ce5ec2efcfeeab293087869a715c7f968ec1572e9afdae03c38cbdc4b2d4cb2f5b22fbab2059417300c0bd172837466325fd74c01590042ad1e87a2befb654b367fec92425af0760ea0556040b12387e0934c505ed045f779eb2fa78ff9860b492dd50e9b1868293f3cbfac850305455402a08100b6ea37c20e4f40193427898aabf7929b82097e9d4c5adb41e86b7cbe41a2bb53221b16498c288c9d824d237975fac4f69de12a3e0777c154e99840af76275b64c7c5a25e4b41384be329ad244abd45f0a2a25519c26f8c7aa2a16587e6a4d6835523961f147ff9e69fe6b7abb428d6a67e961f5bc132a107913e6a8fbeef8f9942b28a6009552bddbc1df6782587b2b7243aeb35e13b9eed93c639053d0b821eedd3a754609b4febbc1ba51498d4810f9d54293eecdafcaef3397b08e5a9de6efd96fc215df0ab10d18ddb1c35bc235d0a21be59bd7fe9f57565b702fad5e3a062c47340962bf715a492fa47bcf36af25aab2f362705a5e6351da51efe8ab03c14ba5bab6a96794655d9a25fb502aec8ccdcd63f463bf7eb190132b45af39d22917ce943799564bba8b3b161928c2ee251985685af7f68b03333aa932930b1960a9f79862e47b07f576b800128cb0b13ea4a43fd422007a2d230df4101f7036d1b247ad84cd901d4c91934b5b26d191681bc4db4b1da0010e265bbb157d9e107fc2b1b3bba00ec78c7f203974cf5c771110409a4a790d9a58da598ec150d38ec900de59bb589c1da87f9515189f3f2cfbde04ff58fc032fc4a2aad8714aaf2c6bd0cca8126fcd24e1d7bee1862122609e5b7e1384aafd07a0e54342624c9c57ae9e6a78df16a9787711ea2acef29d2e28b25578bc90fc30ced9e0be66d3fdd0add3ad767f20340d322f803574ea94cc5c03bfa67a74c08fcbabc0bf237011407c90f89e4c6f8eaf3506437a290ed45e823177b89a8d9d615df20a444bde2eaff28490241a5470f62463e7cc86827cbc9fe23deb635dadcb3749cbf82b1b9dbc20e220c424c92493bda6bbb7b389492957699c1c733181afa3035d776587db04b31a805d9ed4e77926e05ef31bc2cc07ee9165912a38b55d60118a189cea85a8f46b35244e5dfdcccdf3ad9d3995afdeb8ef527b80b31f4748bfd8147f6507747f353ff646589a6c2e301d661afeb41716cdc688bc3d7f4738c880bacf7f1ab78bc7027ea8d768d9c8804cc59bdd770e9b5c52c88c980582b4daa23dfb86148b0b63279b81718eb7f2882a294caee3f6a5ef679c432feb2441c9df0e9011d183a5cbc6d5858525cda8a85d841be5a6e1e2987593754a0ee605917673288849da8ac966811a59fff7ab8d968513818e5359a578f39475b2d347feb5d7b432863e08459df494cbf11229d26ec64956072989ed461528e347d624d0d10067ec5c734025fdd3b5c97c3b3adf1a76a02775001d3882da549460eaad608a908626db2cb1e62ac875a53faad319129ca54c9cc44d99ab0a474ed72befdae7bdbcaacc8190009dd64811d06bd8db0a343a51f6709044108b14e759a9938aec33e3b90e34d9c7808128cb050cc75902f58a2cf72bc7cc614cf7b671c0b4210f0e156e6c400f7ab60e2029b6ad024aefbadc3ab3106a1062809785a0535a9c619b74fbdb4fc771987a0b1154cdfbffaa662fb2716fdf23df4a7f838cc6b2eceac0d0b73d54804d1154a91ec285f8f0bb4565c5b6728ddf422212178acdd08b4cfc5911513b27071bf814c983e503c73329c248fee241c8ec1768545bbcbeea9191375b96", 0x1000}], 0x1) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000080)) r2 = syz_open_dev$audion(&(0x7f0000000140)='/dev/audio#\x00', 0x1ff, 0x2000) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000), 0x111, 0x9}}, 0xfffffffffffffd18) r3 = dup2(r1, r0) ioctl$BLKREPORTZONE(r2, 0xc0101282, &(0x7f00000003c0)={0x2, 0x5, 0x0, [{0xffffffffffffffff, 0xdd, 0x3, 0x100, 0x7, 0x2, 0x2aa}, {0x100000000, 0xf5f7, 0x7, 0x1, 0x80000000, 0x9, 0x18b}, {0x8000, 0x100, 0x7, 0x9, 0x7f, 0x80000001, 0x8}, {0x6, 0xa3, 0xa2, 0x1, 0x200, 0x4, 0x100}, {0x7fffffff, 0xfff, 0x7, 0xcdae, 0x9, 0xfffffffffffffff8, 0x7}]}) ioctl$KDGKBTYPE(r3, 0x4b33, &(0x7f0000000100)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r3, 0x40485404, &(0x7f0000000240)={{0x3, 0x0, 0x7, 0x2, 0x9}, 0x100000000, 0x6}) syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) [ 1230.025111][ T2988] binder: undelivered TRANSACTION_ERROR: 29201 [ 1230.068020][T10469] binder: 10467:10469 transaction failed 29201/-22, size 0-0 line 2986 [ 1230.097367][T10474] binder_alloc: 10467: binder_alloc_buf, no vma [ 1230.106652][T10474] binder: 10473:10474 transaction failed 29189/-3, size 0-0 line 3148 02:24:00 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:00 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40486312}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1230.134869][ T22] binder: undelivered TRANSACTION_ERROR: 29201 [ 1230.173186][ T2988] binder: undelivered TRANSACTION_ERROR: 29189 02:24:00 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080), 0x111}}, 0x20) r1 = dup2(0xffffffffffffffff, r0) setsockopt$X25_QBITINCL(r1, 0x106, 0x1, &(0x7f0000000000), 0x4) [ 1230.214011][T10580] binder: 10579:10580 transaction failed 29201/-22, size 0-0 line 2986 [ 1230.237801][T10582] binder: 10581:10582 got reply transaction with no transaction stack [ 1230.263496][T10582] binder: 10581:10582 transaction failed 29201/-71, size 0-0 line 2900 [ 1230.267768][ T2988] binder: undelivered TRANSACTION_ERROR: 29201 [ 1230.309114][ T22] binder: undelivered TRANSACTION_ERROR: 29201 02:24:01 executing program 1: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r0, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r0, 0x0, 0x0) 02:24:01 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x48, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:01 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304, 0x2}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:01 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080), 0x111}}, 0x20) r2 = dup2(r1, r0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) sendmsg$nl_generic(r2, &(0x7f00000003c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000340)={&(0x7f0000000240)={0xf0, 0x40, 0x200, 0x70bd25, 0x25dfdbfb, {0x9}, [@generic="5e6f1fe4ae3345aa06a9d832f1ce8477037c992912f11c8dfa55b78b588c957bba7ae64a69fd36e1a28821e85c5547ffb2859e48c6d8b1d3159dedaea1775f9a2db6cb7a51c1d5b47bc493a0ce7c56fbb598ab3c08f72b8fa45f27ffedc4aee3d5c33b93cba3ae089d719d8d2203651b6fac77dd3c791d2f1501dc929d980e53dc73835816d5a80a39f7f1604ad668c5cb37e8e322310efea2f213e298d282046ce1429941ebc0ace3655816359b4962655b93bf6c93aaed8385b31b420766a3acfa87a4791448e8ffd1d98506fb538aacf497301573e20debf6"]}, 0xf0}, 0x1, 0x0, 0x0, 0x80}, 0x40000) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r2, 0xc04064a0, &(0x7f0000000180)={&(0x7f0000000000)=[0x0, 0x0], &(0x7f0000000040)=[0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000100)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000140)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x2, 0x5, 0x7, 0xa}) 02:24:01 executing program 5: r0 = open(&(0x7f0000000500)='./bus\x00', 0x141042, 0x0) close(r0) syz_open_dev$loop(&(0x7f0000000540)='/dev/loop#\x00', 0x0, 0x105082) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0x526987c9) read(r1, &(0x7f0000000200)=""/250, 0x1ff000) [ 1230.804213][T10698] binder: 10690:10698 IncRefs 0 refcount change on invalid ref 2 ret -22 [ 1230.815007][T10710] binder_transaction: 5 callbacks suppressed [ 1230.815259][T10710] binder: 10693:10710 got transaction to context manager from process owning it [ 1230.834373][T10698] binder_alloc: 10693: binder_alloc_buf, no vma [ 1230.835566][T10710] binder: 10693:10710 transaction failed 29201/-22, size 0-0 line 2986 02:24:01 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r1, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(0xffffffffffffffff, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) 02:24:01 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304, 0x3}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1230.879862][ T2988] binder: undelivered TRANSACTION_ERROR: 29189 [ 1230.896894][T10789] misc userio: Invalid payload size 02:24:01 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080), 0x111}}, 0x20) dup2(r1, r0) 02:24:01 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x4c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1230.980840][T10807] binder: 10805:10807 IncRefs 0 refcount change on invalid ref 3 ret -22 02:24:01 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304, 0x4}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:01 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x60, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1231.038365][T10823] binder: 10811:10823 got transaction to context manager from process owning it 02:24:01 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080), 0x111}}, 0x20) ioctl$KVM_ARM_SET_DEVICE_ADDR(0xffffffffffffffff, 0x4010aeab, &(0x7f0000000000)={0x4, 0xd004}) getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(0xffffffffffffffff, 0x84, 0x75, &(0x7f0000000140)={0x0, 0x8}, &(0x7f0000000180)=0x8) getsockopt$inet_sctp_SCTP_MAXSEG(0xffffffffffffffff, 0x84, 0xd, &(0x7f00000001c0)=@assoc_id=r1, &(0x7f0000000240)=0x4) write$binfmt_elf64(r0, &(0x7f00000003c0)=ANY=[@ANYBLOB="7f454c46ff38ff7f00020000000000000300410001000000ea020000000000004000000000000000ff0200000000000001000000793e3800020004000900ff0f0400000000000000050000000000000004000000000000000500000000000000000000000000000002000000000000003b0900000000000053e5746408000000060000000000000009000000000000000010000000000000050000000000000007000000000000000700000000000000b3d3f386dbf49db62a432615357f083d46981f6fb19ebb36d1831ecc258060240460354077f002c26f989b2140ab1bbbce4435a30d259507104beb62b57d2df1c2717d9a916da459f5387b91e212daa5e117f21eac366681c693310841dd410909061b7f2ce6c9ad15c0de5019049517f2b26776d677a096f7a6232c1147ca024823b571573750547bc90d2ebb48d88ec2d25d71349fb28d402fb937499fa27537a1c87d1fbe75eea0b3cf65d9e20e453a0278a11c333053a6770000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001d00"/2666], 0xa6a) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f00000002c0)=""/6) getsockopt$inet_mreqsrc(0xffffffffffffffff, 0x0, 0x25, &(0x7f0000000040)={@rand_addr, @loopback, @multicast2}, &(0x7f0000000100)=0xc) [ 1231.125134][T10908] binder: 10888:10908 IncRefs 0 refcount change on invalid ref 4 ret -22 [ 1231.163948][T10920] binder: 10919:10920 got transaction to context manager from process owning it 02:24:02 executing program 1: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r0, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r0, 0x0, 0x0) 02:24:02 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304, 0x5}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:02 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x68, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:02 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000000)={0x0, 0xc, 0xfa00, {0x0, &(0x7f0000000080), 0x111, 0x8000000000}}, 0xffffffffffffff6d) dup2(r1, r0) 02:24:02 executing program 5: r0 = open(&(0x7f0000000500)='./bus\x00', 0x141042, 0x0) close(r0) syz_open_dev$loop(&(0x7f0000000540)='/dev/loop#\x00', 0x0, 0x105082) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0x526987c9) read(r1, &(0x7f0000000200)=""/250, 0x200000) [ 1231.717823][T11034] binder: 11032:11034 got transaction to context manager from process owning it [ 1231.736224][T11043] binder: 11028:11043 IncRefs 0 refcount change on invalid ref 5 ret -22 [ 1231.760596][T11043] binder_alloc: 11032: binder_alloc_buf, no vma [ 1231.776953][T11115] misc userio: Invalid payload size 02:24:02 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r1, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r1, 0x0, 0x0) 02:24:02 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x6c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:02 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304, 0x6}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:02 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0x2, 0x2) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x7, 0xfa00, {0x4, &(0x7f0000000080), 0x111, 0x2}}, 0xa7) dup2(r1, r0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000040), 0x13f, 0x7}}, 0x20) [ 1231.898589][T11146] binder: 11142:11146 got transaction to context manager from process owning it [ 1231.924128][T11150] binder: 11147:11150 IncRefs 0 refcount change on invalid ref 6 ret -22 02:24:02 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x74, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1231.943244][T11150] binder_alloc: 11142: binder_alloc_buf, no vma [ 1231.965171][T11174] misc userio: Invalid payload size 02:24:02 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304, 0x7}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:02 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) uselib(&(0x7f0000000000)='./file0\x00') r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080), 0x111}}, 0x20) dup2(r1, r0) [ 1232.024870][T11243] binder: 11208:11243 got transaction to context manager from process owning it [ 1232.109340][T11259] binder: 11257:11259 IncRefs 0 refcount change on invalid ref 7 ret -22 02:24:03 executing program 1: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r0, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r0, 0x0, 0x0) 02:24:03 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x7a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:03 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304, 0xa}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:03 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080), 0x111}}, 0x20) r2 = syz_open_dev$mice(&(0x7f0000000000)='/dev/input/mice\x00', 0x0, 0x8000) accept4$ax25(r2, &(0x7f0000000100)={{}, [@rose, @rose, @default, @rose, @default, @rose, @bcast, @bcast]}, &(0x7f0000000040)=0x48, 0x80800) dup2(r1, r0) 02:24:03 executing program 5: r0 = open(&(0x7f0000000500)='./bus\x00', 0x141042, 0x0) close(r0) syz_open_dev$loop(&(0x7f0000000540)='/dev/loop#\x00', 0x0, 0x105082) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0x526987c9) read(r1, &(0x7f0000000200)=""/250, 0x201000) [ 1232.638192][T11368] binder: 11366:11368 got transaction to context manager from process owning it [ 1232.649097][T11373] binder: 11367:11373 IncRefs 0 refcount change on invalid ref 10 ret -22 [ 1232.686460][T11373] binder_alloc: 11366: binder_alloc_buf, no vma 02:24:03 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r1, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r1, 0x0, 0x0) 02:24:03 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x300, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:03 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snapshot\x00', 0x200, 0x0) r2 = ioctl$LOOP_CTL_GET_FREE(r1, 0x4c82) ioctl$LOOP_CTL_ADD(r0, 0x4c80, r2) mount$overlay(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x2000000, &(0x7f00000003c0)=ANY=[@ANYBLOB="72656469726563745f24236469723d2e2f66696c65302c696e6465783d6f66662c78696e6f3d6175746f2c647186096686052e0b065d0ccb656661756c745f7065726d027373696f6e732c5670702e2f66696c65302c726564b792e1f886fbaf69726563745f6469723d2e2f66696c65302c64656661756c745f7065726d697373696f6e732c6673757569643d67326139346766772d7b3537352d003137342d65f6d6d33f2f1b927b00332d64793a3f7734663f2c736563a7ba9c8832f858a82f6fde95876b967fff27a3c8c3a1e5f89da2f8c4d0bf012d13cf5372640ac9874a5d65bd16ad904c5819122aa11df26e4ae9567f488bc5173e0ae872a155ca29914a444e08b85aae2f97b03a6faaf7d0000e8bd559ffd5bc6cb3424f2ad81e401896cf4f44b880eb3679a455579b2936ba42ad1f0d29a795f03f51816f14c98f39f86d16575420b7606db38e08bc2bb2c7f6135c68a5f9b7f0e9de2053678da0e60e459929068111ee392041ec022d34921f2da8"]) ioctl$LOOP_CHANGE_FD(r1, 0x4c06, r0) r3 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) dup2(r3, r0) 02:24:03 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304, 0x48}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1232.782729][T11481] misc userio: Invalid payload size [ 1232.842496][T11487] binder: 11483:11487 got transaction to context manager from process owning it [ 1232.878834][T11491] binder: 11486:11491 IncRefs 0 refcount change on invalid ref 72 ret -22 02:24:03 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x500, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:03 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304, 0x4c}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1232.905095][T11491] binder_alloc: 11483: binder_alloc_buf, no vma [ 1232.938091][T11554] misc userio: Invalid payload size 02:24:03 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r2 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x800, 0x0) getresuid(&(0x7f0000000040), &(0x7f0000000100)=0x0, &(0x7f0000000140)) getresgid(&(0x7f0000000180), &(0x7f00000001c0)=0x0, &(0x7f0000000240)) write$FUSE_ENTRY(r2, &(0x7f0000000280)={0x90, 0x0, 0x1, {0x0, 0x1, 0x9628, 0x80, 0x6037aa0e, 0x92, {0x2, 0x7, 0x7, 0x2, 0x0, 0x2, 0x7fff, 0x0, 0x3, 0x9, 0x7, r3, r4, 0xffffffffffffc7d2, 0x10000}}}, 0x90) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080), 0x111}}, 0x20) dup2(r1, r0) [ 1233.011616][T11595] binder: 11594:11595 got transaction to context manager from process owning it [ 1233.048674][T11598] binder: 11597:11598 IncRefs 0 refcount change on invalid ref 76 ret -22 [ 1233.067309][T11598] binder_alloc: 11594: binder_alloc_buf, no vma 02:24:04 executing program 1: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r0, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r0, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {0x0}}, 0x18) 02:24:04 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x600, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:04 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304, 0x60}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:04 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) dup2(r1, r0) 02:24:04 executing program 5: r0 = open(&(0x7f0000000500)='./bus\x00', 0x141042, 0x0) close(r0) syz_open_dev$loop(&(0x7f0000000540)='/dev/loop#\x00', 0x0, 0x105082) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0x526987c9) read(r1, &(0x7f0000000200)=""/250, 0x202000) [ 1233.586580][T11716] binder: 11707:11716 IncRefs 0 refcount change on invalid ref 96 ret -22 [ 1233.602555][T11721] binder: 11708:11721 got transaction to context manager from process owning it [ 1233.624316][T11716] binder_alloc: 11708: binder_alloc_buf, no vma [ 1233.679191][T11799] misc userio: Invalid payload size 02:24:04 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r1, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r1, 0x0, 0x0) 02:24:04 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304, 0x68}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:04 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x700, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:04 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000140)={0x0, 0x18, 0xfa00, {0x0, &(0x7f00000001c0), 0x111}}, 0x20) r2 = syz_open_dev$dspn(&(0x7f0000000080)='/dev/dsp#\x00', 0x0, 0x200000) r3 = dup3(r0, 0xffffffffffffffff, 0x80000) finit_module(r2, &(0x7f00000000c0)='/dev/dsp#\x00', 0x1) ioctl$TIOCCONS(r3, 0x541d) r4 = dup2(r1, r0) ioctl$sock_proto_private(r2, 0x89ee, &(0x7f0000000000)="b82b1d2d2d328814ebde838f0e17e997236dad31e4b8a5c8dd4a5e8bdf4d5364ec34347bcb210e558a7ff6690bc0529591709af27b9d09f9631e95b03d56e48ad428382513c4c66601216436169b5c54809cd4a5f2b53c3d5160540e11e5350c3e74a4ff945b4e18bc074e3c1abe22cd020d73c54248b3") accept4$netrom(r4, &(0x7f0000000240)={{0x3, @bcast}, [@default, @null, @netrom, @remote, @null, @default, @netrom, @netrom]}, &(0x7f0000000180)=0xfffffffffffffdb7, 0x80000) [ 1233.782590][T11827] binder_alloc: 11822: binder_alloc_buf, no vma 02:24:04 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0xa00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:04 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304, 0x6c}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1233.869996][T11870] misc userio: Invalid payload size 02:24:04 executing program 4: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080), 0x111}}, 0x20) dup2(0xffffffffffffffff, 0xffffffffffffffff) [ 1233.941446][T11937] binder_alloc: 11906: binder_alloc_buf, no vma 02:24:05 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304, 0x74}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:05 executing program 1: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r0, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r0, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {0x0}}, 0x18) 02:24:05 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:05 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080), 0x111}}, 0x20) r2 = dup2(r1, r0) socket$inet_dccp(0x2, 0x6, 0x0) ioctl$IOC_PR_REGISTER(r2, 0x401870c8, &(0x7f0000000000)={0x8, 0xa5cf}) syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) 02:24:05 executing program 5: r0 = open(&(0x7f0000000500)='./bus\x00', 0x141042, 0x0) close(r0) syz_open_dev$loop(&(0x7f0000000540)='/dev/loop#\x00', 0x0, 0x105082) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0x526987c9) read(r1, &(0x7f0000000200)=""/250, 0x203000) [ 1234.494195][T12048] binder_transaction: 23 callbacks suppressed [ 1234.494212][T12048] binder: 12045:12048 transaction failed 29201/-22, size 0-0 line 2986 [ 1234.497768][T12049] binder: 12047:12049 transaction failed 29189/-3, size 0-0 line 3148 [ 1234.583287][ T2988] binder_release_work: 23 callbacks suppressed [ 1234.583296][ T2988] binder: undelivered TRANSACTION_ERROR: 29201 [ 1234.599272][T12124] misc userio: Invalid payload size 02:24:05 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x3f00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:05 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304, 0x7a}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:05 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r1, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r1, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {0x0}}, 0x18) [ 1234.648366][ T22] binder: undelivered TRANSACTION_ERROR: 29189 02:24:05 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) fcntl$getownex(r0, 0x10, &(0x7f0000000000)) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080), 0x111}}, 0x20) pipe2(&(0x7f0000000040)={0xffffffffffffffff}, 0x80000) ioctl$KVM_GET_DEVICE_ATTR(r2, 0x4018aee2, &(0x7f0000000140)={0x0, 0x3ff, 0x7, &(0x7f0000000100)=0x9}) dup2(r1, r0) [ 1234.703708][T12161] binder: 12160:12161 transaction failed 29201/-22, size 0-0 line 2986 02:24:05 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x4800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1234.761573][T12168] binder: 12163:12168 transaction failed 29189/-3, size 0-0 line 3148 [ 1234.788518][ T22] binder: undelivered TRANSACTION_ERROR: 29201 02:24:05 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304, 0x300}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1234.816235][T12259] misc userio: Invalid payload size [ 1234.816720][ T2988] binder: undelivered TRANSACTION_ERROR: 29189 02:24:05 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r2 = syz_open_dev$sndctrl(&(0x7f0000000000)='/dev/snd/controlC#\x00', 0x1, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(r2, 0xc4c85513, &(0x7f0000000880)={{0x7, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff], {0x0, 0x989680}}) r3 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x204000, 0x4c) sendmsg$kcm(r3, &(0x7f0000000780)={&(0x7f0000000240)=@nfc={0x27, 0x0, 0x2, 0x7}, 0x80, &(0x7f00000006c0)=[{&(0x7f00000002c0)="72cc89ce3d56ac4b1fe35482af6059a387b2d8baf67c86af7475863f2778bc62451b228800c4d7ba3e0020116568886e8923081aedaa3150315e7eaf5d5fdf12d05fb251dad3b801d3a7c8005c9234844ddcec6c2ce823c8076b8b6ac29ced808d94ac1027", 0x65}, {&(0x7f00000003c0)="f8863bd45229f0c77c96c9507a5d1dee067fe0127e6456449c8d7926f50c51464c7e507e05d6dea16d56091d44dfc6cc3063625711ef244ba3469d50ac5c9a6756287b8eaa167e9589b046950fd521360adc5a8d2b2e1c8c290358fe77c574cdcb4e8ae748de14ccbd3a8c4108c11f2bad7e6e55968c06338754f608b4a5e5e29d2000dcdc752eb3a4f964ad4342c1d3200b5550ed16caa61d84467c75cf6760e9980beaa174308242bd2a15ad8ba910375418d04ed06eaf2d07a841c6b6cf1b41e41078bbc481b6c5", 0xc9}, {&(0x7f00000004c0)="c556a9618e673945242a2fee70ab883e31890785d1ce3224a2139b1d6431b3c163c009c43f474cc894b7e04d40542b2887eb0af0cb15de51ac0b4f3809164874d0af0d06ed87702244c84a0948b080c768ba9d9e98c4358f8a97d336a548355a22e3447350d01663a40fe5bc977845baa9837d13e9f40783b44ba1253d1d8d6b239017b72bcfcd149ee9cc41b8160b1c92c0d17970606d02cb04325e8df904e61f9e6d7b5d8cd7f3cf0387164e54c1dfaaf04e1f5ba983e00b0fe3af1d7dbd8e1d39ae33686ab47e865ddcd894c361a5fe45", 0xd2}, {&(0x7f00000005c0)="cd694a356065ef97f6ea2a2e1f93e1d7db67d521100f091e081daefcad9ffd318d3d7337e8080ae06cdd900df4f40ca4fa330fbdc890af080050048f21bd8999b1271d87b65bd4b25d1240bcfa4f32e3898beeaf5b780ee9eefff1180f0b29a894cafb28ee5a68ff180f21a50d9a7f66515506c9696e95542c9e4839a8694b060d99d68bcc37d32d50cb6d", 0x8b}, {&(0x7f00000001c0)="cefc177392ef69a9a49558", 0xb}, {&(0x7f0000000680)="dae4171b18d072f6d993329884e472a2cc4c857e745eca1fa2cb2fb9e92db50d9759103e67a41f3e8eb149d88166", 0x2e}], 0x6}, 0x20004000) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080), 0x111}}, 0x20) dup2(r1, r0) socketpair(0x1, 0x2000000001, 0x0, &(0x7f0000000740)={0xffffffffffffffff}) close(r4) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg(r5, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="18004037000300"/24], 0x18}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) recvmsg$kcm(r4, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)=""/153, 0x99}, 0x0) r7 = msgget(0x1, 0x100) msgctl$MSG_INFO(r7, 0xc, &(0x7f0000000100)=""/88) [ 1234.869840][T12273] binder: 12271:12273 transaction failed 29201/-22, size 0-0 line 2986 02:24:05 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x4c00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1234.913317][T12275] binder: 12274:12275 transaction failed 29189/-3, size 0-0 line 3148 [ 1234.940629][ T2988] binder: undelivered TRANSACTION_ERROR: 29201 02:24:05 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304, 0x500}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1234.986680][ T2988] binder: undelivered TRANSACTION_ERROR: 29189 [ 1234.997583][T12280] binder: 12279:12280 transaction failed 29201/-22, size 0-0 line 2986 [ 1235.042235][T12314] binder: 12310:12314 transaction failed 29189/-3, size 0-0 line 3148 [ 1235.071550][ T2988] binder: undelivered TRANSACTION_ERROR: 29201 [ 1235.124687][ T2988] binder: undelivered TRANSACTION_ERROR: 29189 02:24:06 executing program 1: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r0, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r0, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {0x0}}, 0x18) 02:24:06 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x6000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:06 executing program 5: r0 = open(&(0x7f0000000500)='./bus\x00', 0x141042, 0x0) close(r0) syz_open_dev$loop(&(0x7f0000000540)='/dev/loop#\x00', 0x0, 0x105082) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0x526987c9) read(r1, &(0x7f0000000200)=""/250, 0x204000) 02:24:06 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080), 0x111}}, 0x20) r2 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x10000, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000240)={0x0, 0xfffffffffffffffb, 0x1000, 0x2, @buffer={0x0, 0x94, &(0x7f0000000100)=""/148}, &(0x7f00000003c0)="89db58707b1f7c2ff6e65a947951ed8ef3eff461f0a2ed5e2f62c2afb436ddcc44aa4a256f1bd94c7b9fe2d3ff3d1c8f5ed6759236f3d7922da4d60f84eb7b35a86cad944751f5dd94ef021534525d7859f9da8810245a38cbee732c62dfddbbcb1403ad7cc220437dc06419cb979d886fa85ad5d77429db6477ca11cb4a1f34f906fe649fe20af8b24052bd00babba77eb68ffcf7791edc9d2f3b16a68a870ed5491afdd0379f245f67e1652ad726d387c3ac6c5dadbd179b5dc50bd56fdbd546025efe641b9d4698af8ae8e78898f9f95849cf40174d489b2de0fd833a58ee17216242dd37e4358b0f11afecaf6a3c6cb2121b893c84a6738a41b5e1725598a38426f1fa026fcdd429f897486146aa7c94f7ea314c99ec9064e82698acb07b88f8d614ff5e1d4bea075692b23b4c2b20058af416be3b34f6ff7feee3e3ed390d1c6492cbe4263ffce2225d6c61c40ff90a12acda6c6b80abfe3a37769942f46e432408a8a305321433c4953d71e9fcc4e9c2ff5b1bbf51d1bb349b02d4a27ef54d3968c9cb80cdd6978688d95cfa2834490a8e865c6ca4a9d95dda745b8f6d0591f74bf646ac0266281deb711f9970fcd53a320ddc6147b829620953843f26ec96e45279f82c2469f0648f7544042f01e54b97a6ce66a454318515b41e5bc649c4c6bb684ce64a5f0fc0cf672ddfee47b132901cc24eff4e5b82088880e103c05124b4e8d5c2031ad2546158ada10f82d13934885312ad3478483726f9aa1e2ce31a719ae023913d034f4f47e17b9c82a8f2c985e41916f9f5e420405730b982920a4965d33dbef3f795501e3e69e3f4db864f4a6ce98224f540b7615fc74eeb517b8dcb569c62670692b389632835e463a515aa95023594d6e378cb1a3d2da70f0f321b34673bf1b38e34d81e6400546adf6f5ba05eae72ada70b735491a395e2dd52e07b3a0193acef922cd2d4e866df190770517f78f1da5580ca4fdb6584ff82b7f42d1fde081c422ea0f10daece476bbcc6a3d4909b34012fd99578fe350049ea7ab1c618e4a7ef85d06fc6da7cd8c1bd35872983799b25665aee3bb43761ae02c8bce6ad672fc1acdfaf5368c66dbd8262a5ed5d60e0de2ad03382e711e0cf9d4f269aab5cbf6030bfbef3a37775b25b89e829bebf1e00d28aa0d092bee4ead000691aa4260aa5d1cfab939d6b94ad9386ea79b04834ad76c274d60c671acc8151ba3abdab1c8d8919a70944e3e23cacd965432dc64f2c2b5f39deb02dba77a473c8e0ec3dea6995b318465e32310425f057695d3b71a27117c657711db9fdab5482e05a90940a146d38648bada78eb7bf4cfce5ffcde3652c6fc6422c8ae7c1ab768393abb57092f2b44c9f4e46ffddd3b47ff0993cb74403426f02fc07af35884771aa2822bcda8bd3bdac47408fcf47e7556ff2428263e15fddcb6b7324b704e1898fac97869786f35e37897294bcdf29039ed7ca3815311ed540feabbf377a8ec9574ec56f536ed56384cc5d78766bb5caeedce2d5154f1b853d683e311ba76f3388cd7fee68ff698e1744f07506924f696800a8122e51b0ae54ee9049956948ed94839d950523648358dda14e54d464686e35f353b382c3c63528fd54d78dfcf68130169e730cdbd561582084fc898ddfd9e2220aa9ede3d1c8f13c7b69f92e155c55d0c1c1b080a94c4da40848183d040450d14c6b7334864fdd28345a0e5cae63ec91816dc854a4aba6d1a09256adac186a8e2e3cad30e1f3af5e791b123af070a4287090636743c46ddb770bd6e6f5e358cf2d302f1d76528f25926f4b82e8e81ce1d5ae35b54844aa847b950983597a6a011751e76159e3370c2a88e9fe080cbb1af8d9063fcda4876a6786db4e1f648b4ff449e8e7d398851647f32731ceaf96cb67a58515f6011629fc66a2d0f3ac24f3e648563b1ec679f2f33dc378fdd097c155f2dda51975c1ac12ac3b56a54e7561c86539a64b9539ad3f9d7b6f0fc52e9623137276673daadb59dec0b6bbb59f31e92814dd6e934642f18466a33205e487f3d95480803c5d9ed0015472df5e9002478335868c116619255a0352faaf21de5a65137c7969321ad50ebf518975b218bde1a6a705d2661d76135a3799e902d324e254f38e1325b3846a727b982be1479a8856bbd9617d6a87cb8db641867862e49a6893a824f91ddd52bb4768e8b60047011dfcf875cf9246260b8c17052fda9409053301a82a36e9fd3d69efa148725ffb1c7641c9ab37a0f0cd4cf94886472a801da5941bd914e68fda7ca1c1f2182f480562e161753be100482b609f43ab8a6d3cb472a7390dafd266c717d49ad0d68710b3e5182080e48c3a04aef313e5b4373b9c2b18f2b223aa53455eeca703ac732ef7b3cf7cdcf6004df33f89358d9ae992a2f4b283bc4983d4d00c32aef7b6458a03d56fcca7343949410762fc26086be7b9df6ab2b56efabe6bc130a37592dd29d9b2a16786f1630bb6d2ba8b518cc9bc7b095df3ea1affa13a107c0b0d7d11c625bc7f50a01d7d9888d8edfca3084a080007260685b39f0892bb9157c4ce57cfefe2854d2e77ebae6aab5479376d0f56c2a79e466f249cd4b7a481945e174239e627b006a352fb382dda93cab903c263603aaea5234276d6c32f5117b477599d94f823406c843111c365bea2c7c765fe4ea68be6f1d0ea84a2a5cba15bfd71ce9598aab3639699d06ed3d2ee93aaddc6de576d838806bfdb5a693943082e9c1f0e34b02f3aa54bdc22f5f4b80fa9318824f9c9f8784398d1419f647c1cd6f024b0696ea577f90cfcd1a0a4f404e994eaa478961cde537090ef907cc3c58b4112334e1917f152e969ce31efc7c788045390175d7dc165b11ac66c72ec757aa0a72a0f50a0e46f81a3d33ff504ffe7d19247621a1e20a271f077e769f044263ed195116d402be0b6f10342dd70b22ae1d44959159f233c363d37df5e6c361813b75b950dbcbd837fd46da1a755b8406b35c8fa4d638a0dc477d059bcda6441597d3cc2b8192ceed02d174aa7b4fc4ee0ed46b8f1401ebe407979ab1bbeeac9e561f6c3751e2c17db769ca7d5a6356502a5cf3dc2e09d60d302bf101b454e8ec75407a803a42378d40bd4a2f0806e884b42b3290ec416c980c77ee3e70de758ae9369866f05d9798bc432e0e310078912a59757a27b544960d314a63b74cb8bfa47d0bc9917006b8e753ee3a36277fdc7dd3d4c41cb3b9ca62fc7bbd8f2733ab6fc075f933973c2b3a45a4fa100865e0c429cdd930cea684351af06eeedba4472d567b62fc1535aecb2f7d9e38ff8b00ef8b000c422af269f22b233e552028f53bb87eac19c918647ed10f26baff800d48fc1b989f7d7bd24b9e5eaadb5d2ca0691f2484aed8007a54d4fbe565fe3ae4a5a8463c83eccccf662e9a9a16c82541ecfd0cc0520b80a6cab25cd25522bf91fa809950ae442c9eb931b1d3c33bd789fe9cd7f436533989801dc53dad54810f1288eb64e26e7994f973b26baa4f8c825e03ad66a7a4948db442d3c86afd44d56fc3af56d60d5c4fd2d69fe823f0d7857a73d410b0611ed1acfa7e795cf1fa952d99f3d3f221ec046e8de7826ab90141cd512ed7b7b718679c824bb73e89ca4c3dbf6d1580c7d0c94f444bfccbed67682bcac0a830a06f76515f254faf2d74e2e164efdd20e15c3ebdc42749ca91b3ac24147ca17b675988f6e53a2faacda07e2e3d2e467820142a10e5983dee02998a8ff9e11596e665860f7f9daeeac9da45d4ef30c676b90f1f81d34b8ae9a862280e06bf2a3f31e83bdfaa4c619549664296728e56b295def48a48a83395c6a3eb17a3d1651c767c19d5934c273f57428ad67e41ae3ce73f80f695b992e3f17a28e2eea47cf7b15b7c766e1e3dbb6f3d8b56c982c17893889c154f048fb7078baae4cc0b0139978b13a99d53fa4b7a4101e27e5ff22a866e5f0dae0c32ce35ee7fd5a81a3e2629bf2cc1b8bcff89533dc56cfff20b29145f24ef8ab0cc95b404a382c6266d6328508d0c6d528cfd347e91c19144e85d75366cb79bb2ec9c67ed196ffd2e715d379a33829bfe6d614a6e218ff8e889553521cc756292c956ee79104ea43661ddb44b4e7fc5efa83643f36db44dd321e44d6aaa910fee7c8a9f10f79c40423cebac67ca4f0f61847a74b941a30e030155219bda5702d8a181ce3e920b052e981fcb0a4dc5897f632325d3fce7333c70e28848c7b8244e27845bf7bbaa0b02e0763d619455f27b1f812ee61fc1391b2859c470c1ab00f834f5e0b11a785389e4ccf93a534e722159b266a9862b7e2ca945663644456b71172613043f9eba729655541ffe6cd2dbb9875f3500f8c10cfcac9fcea8a07424674f15d59bc91a56a9afbd920367b3431bb9da896477222cfc7abf682363ac45767dc4c9f91595a205496c56d36726150fde86fd0ab363c120a3393c08c17a1e5926729c2b72aed0a0307d9cce4ec129d143112aa6cfbbb9b729ae7d8a82cbb2ab95adbc1f2874e603c243b3bbf9b64f8da9ff72025c7c2d731e37eb158e76493c162e10dd661faf8e68aeba92bf9122837f324c6cdf394ba6b823f51b335dc75d75cca053f6d848d357580e484745d328e15ea1cc9adad179a9855ce367917d64c7e346e41680535a6a3200506bf7629d7e6c23479d06ba3c7a9bedb4abf6a5b7106651b12a0ce3391fc1801be79192a06e78adeaadd058af7d84d516941665bfab017827ef9d3e04adf81c3516ceb1dfd67c913c555bdbcf3d3859b7426c430a1335757e3082236683f5c311c0c79690f0bec6ac776597dc9bb7bb54716358e335bcf6d2a2cd91e74a52560dc18e69a7bc6448091b74b9f9c48f927c490f8dbf9547c4ad7ce6191cef7a3b89f7e548bfd0143f7db07d6d338908a06b57ac92dbf58718e1ff8afd8abab87b6db18cd3ba86745f90d64ea904b39a7b3005525a7961e8428b01159b295af37274e11305fda1692a6491c9fa2d10b202af5825b25db7f2463e1ced07bd16015f9be2d925f7d97124f9f22981a88c061c575344a8f46bbd0e2e4cbb9eca0784e9a34e1b69d8dcf45338e4667dd5c15889383025b9170c662447e5b0c0deecef192b191f35e6de911149510ab587d92ec9c7361f03a7b08797199fdf40a8c8678ba82963c5f560bcbba0ec5d2b78ccca3a187d31deccb3f4ee6566e9fbed20abb628275d1ce0327abdef93bfca3e8708fb0671f5e5a8cd82001113721e69b766830a3f9c2b379a2eac3bdf99e283dc47adaf364d5bc674aa0d45136272a6afdfec17917cbc7162e291cc45b0ab90b3f6b14cd7dfe60a3d129fd24fa6fed9725058c9f12f239d9a9c8f1246badcc4d7d88df54093be9bab6d8852d977cdcc70c47dfc55a7b36c5d39f4a2ba4a5025f4f126ee123c153c25fa4e9b1991a7fa573698cbe885d81826a819dd57985256fe0c902d010578ef958d484a013d39c52ddfa0c08e134eaa65ae32bf22b72a7a6449c280cc8683fdda257537c9b4552fc9d97f25bea8ac7213e3cf24104a1bcb44a62c37aedf2ae65bc27de5addf964b4a5cd611ba0fe24d4551df9c45bf997961f5c24a4e9d1cc7e1baa2ad8cd1b47836a34e11c523d5bc256ebe556cff415ba2111dd57682964e7d1f9cecce030076899f596e66ccde4c854b5684baab3f0e6e6b346d7aea5ff22e69c53489d7a7f5f319f482cb4187926e751bbb4709a0b36914dc91c97eeeb8e55f49fc085fd7bc4f036275ea99439eafeaeb48c046bb46c5213fd5a8f883a8e3661be43db7c51ad", &(0x7f00000013c0)=""/4096, 0xebe8, 0x20, 0xffffffffffffffff, &(0x7f0000000040)}) dup2(r1, r1) 02:24:06 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304, 0x600}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1235.378967][T12389] binder: 12387:12389 transaction failed 29201/-22, size 0-0 line 2986 [ 1235.466267][ T2988] binder: undelivered TRANSACTION_ERROR: 29201 [ 1235.466422][T12397] binder: 12395:12397 transaction failed 29189/-22, size 0-0 line 2995 [ 1235.473204][T12398] misc userio: Invalid payload size 02:24:06 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r1, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r1, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {0x0}}, 0x18) 02:24:06 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x6800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:06 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r2 = syz_open_dev$vcsn(&(0x7f0000000040)='/dev/vcs#\x00', 0x1, 0x400000) perf_event_open(&(0x7f0000000100)={0x0, 0x70, 0x9, 0x3, 0x1, 0x7, 0x0, 0x33f1, 0x421, 0xe, 0x7, 0x80, 0x6, 0x7fffffff, 0x0, 0x400, 0xfffffffffffffff8, 0x0, 0x3, 0x5, 0x4, 0x6, 0x67, 0x100000001, 0xfffffffffffffffb, 0x8fe, 0xffff, 0x8, 0x40, 0x101, 0x4, 0x800, 0x5, 0x0, 0x8, 0x5, 0x9, 0x6, 0x0, 0x1ff, 0x2, @perf_bp={&(0x7f0000000000), 0x2}, 0x8040, 0x3, 0xa04, 0x6, 0x3, 0x8, 0x401}, 0xffffffffffffffff, 0x9, r2, 0x1) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080), 0x111}}, 0x20) dup2(r1, r0) 02:24:06 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304, 0x700}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1235.576409][ T22] binder: undelivered TRANSACTION_ERROR: 29189 02:24:06 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x6c00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1235.666040][T12509] binder_alloc_new_buf_locked: 4 callbacks suppressed [ 1235.667779][T12509] binder_alloc: 12504: binder_alloc_buf, no vma 02:24:06 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304, 0xa00}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:06 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x40, 0x0) ioctl$sock_bt_cmtp_CMTPGETCONNINFO(r1, 0x800443d3, &(0x7f0000000040)={{0x5, 0x1, 0x6, 0x6, 0x7f, 0x8}, 0x0, 0x4, 0x6}) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080), 0x111}}, 0x20) dup2(r2, r0) [ 1235.738576][T12613] misc userio: Invalid payload size [ 1235.817205][T12621] binder_thread_write: 8 callbacks suppressed [ 1235.817250][T12621] binder: 12618:12621 IncRefs 0 refcount change on invalid ref 2560 ret -22 02:24:07 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304, 0x2000}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:07 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x7400, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1236.266186][T12728] binder: 12727:12728 IncRefs 0 refcount change on invalid ref 8192 ret -22 [ 1236.276202][T12726] binder_transaction: 9 callbacks suppressed [ 1236.276213][T12726] binder: 12725:12726 got transaction to context manager from process owning it [ 1236.279311][T12728] binder_alloc: 12725: binder_alloc_buf, no vma 02:24:07 executing program 5: r0 = open(&(0x7f0000000500)='./bus\x00', 0x141042, 0x0) close(r0) syz_open_dev$loop(&(0x7f0000000540)='/dev/loop#\x00', 0x0, 0x105082) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0x526987c9) read(r1, &(0x7f0000000200)=""/250, 0x205000) 02:24:07 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) lseek(r0, 0x0, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080), 0x111}}, 0x20) dup2(r1, r0) 02:24:07 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000240)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000080)) 02:24:07 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r1, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r1, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {0x0}}, 0x18) 02:24:07 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304, 0x4800}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:07 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x7a00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:07 executing program 1: unshare(0x40000000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0adc1f123c123f3188b070") r1 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$IPT_SO_GET_INFO(r1, 0x203000000000000, 0x40, &(0x7f0000000000)={'security\x00'}, &(0x7f0000000080)=0x54) getsockopt$IPT_SO_GET_INFO(r1, 0x0, 0x40, &(0x7f0000000140)={'raw\x00'}, &(0x7f00000000c0)=0x54) [ 1236.528137][T12844] binder: 12838:12844 got transaction to context manager from process owning it [ 1236.540547][T12847] binder: 12839:12847 IncRefs 0 refcount change on invalid ref 18432 ret -22 [ 1236.563111][T12846] IPVS: ftp: loaded support on port[0] = 21 02:24:07 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080), 0x111}}, 0x20) dup2(r1, r0) [ 1236.567860][T12847] binder_alloc: 12838: binder_alloc_buf, no vma 02:24:07 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x1000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1236.650127][T12875] misc userio: Invalid payload size 02:24:07 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080), 0x111}}, 0x20) r2 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x100, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x20, &(0x7f0000000040)={@initdev={0xfe, 0x88, [], 0x0, 0x0}, 0x1, 0x2, 0x0, 0x3, 0x7ff, 0x4}, 0x20) ioctl$SIOCSIFMTU(r2, 0x8922, &(0x7f0000000100)={'nr0\x00', 0x7}) dup2(r1, r0) 02:24:07 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304, 0x4c00}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1236.780027][T12958] binder: 12957:12958 got transaction to context manager from process owning it [ 1236.802665][T12961] binder: 12959:12961 IncRefs 0 refcount change on invalid ref 19456 ret -22 02:24:07 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x2000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1236.825923][T12961] binder_alloc: 12957: binder_alloc_buf, no vma [ 1236.968400][T13066] binder: 13045:13066 got transaction to context manager from process owning it [ 1237.085132][T12846] IPVS: ftp: loaded support on port[0] = 21 02:24:08 executing program 5: r0 = open(&(0x7f0000000500)='./bus\x00', 0x141042, 0x0) close(r0) syz_open_dev$loop(&(0x7f0000000540)='/dev/loop#\x00', 0x0, 0x105082) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0x526987c9) read(r1, &(0x7f0000000200)=""/250, 0x206000) 02:24:08 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304, 0x6000}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:08 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) fstat(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0}) ioprio_get$uid(0x3, r1) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080), 0x111}}, 0x20) dup2(r2, r0) [ 1237.312865][T13076] binder: 13072:13076 IncRefs 0 refcount change on invalid ref 24576 ret -22 02:24:08 executing program 4: r0 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x9, 0x200000) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_CLIENT(r0, 0xc0bc5351, &(0x7f0000000100)={0x800, 0x1, 'client1\x00', 0x2, "35ea8ca0b9ed46c8", "88f65e6bbfab5e9108b93c9ad7c069cf84e405b689d42897329d3021d289d0c6", 0xff, 0x6}) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000300)={r0, 0xc0, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)=0xfff, 0x0, 0x0, 0x0, &(0x7f00000001c0)={0xaae8, 0x1}, 0x0, 0x0, &(0x7f0000000240)={0x58c, 0x1, 0x1, 0x7f}, &(0x7f0000000280)=0x7fffffff, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=0x10001}}, 0x10) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080), 0x111}}, 0x20) dup2(r2, r1) 02:24:08 executing program 1: unshare(0x40000000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0adc1f123c123f3188b070") r1 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$IPT_SO_GET_INFO(r1, 0x203000000000000, 0x40, &(0x7f0000000000)={'security\x00'}, &(0x7f0000000080)=0x54) getsockopt$IPT_SO_GET_INFO(r1, 0x0, 0x40, &(0x7f0000000140)={'raw\x00'}, &(0x7f00000000c0)=0x54) 02:24:08 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x3000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:08 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304, 0x6800}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:08 executing program 0: r0 = syz_open_procfs(0x0, &(0x7f0000000300)='ns\x00') getdents64(r0, &(0x7f0000000000)=""/33, 0x1c) getdents64(r0, &(0x7f0000000140)=""/150, 0x96) [ 1237.474587][T13182] binder: 13181:13182 got transaction to context manager from process owning it [ 1237.486997][T13188] binder: 13183:13188 IncRefs 0 refcount change on invalid ref 26624 ret -22 [ 1237.504028][T13189] IPVS: ftp: loaded support on port[0] = 21 [ 1237.526561][T13188] binder_alloc: 13181: binder_alloc_buf, no vma 02:24:08 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x4000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:08 executing program 0: r0 = syz_open_procfs$namespace(0x0, &(0x7f00000002c0)='ns/net\x00') capset(&(0x7f0000b3e000)={0x19980330}, &(0x7f0000f21fe8)) setns(r0, 0x0) 02:24:08 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304, 0x6c00}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:08 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl$SIOCX25GSUBSCRIP(r1, 0x89e0, &(0x7f0000000480)={'bridge_slave_0\x00', 0x9, 0xce9a}) open_by_handle_at(r0, &(0x7f0000000240)={0xfc, 0xfff, "1032218a446634d3cc120ae75e4a0dc2c3108b0c6787443328f1ab206cb4e6c68fdb842b8639220fb340b5eff03c448b44ca0913259fb6059b6d94b9624c474b9b9ae104f7bee39b37c9b19827507cd3ef9390447c495f14c84bd5a9d44d247743a117ebd417ff34f80f176bb30d60fb961d515ff784f4e35301d2b373addf546ae2a75a6e818ce76f7335dde0bb92f81adae5c67c810d832e629f24d0142ffc84d39a233ef8528d8838689f4016e2210324eeedff50f5d207b0e23e058dd4bb73fdfc1674a19bf58adb1c4fea482af07694eb58ed8f646abb150c2e08d85c2f115d3125dbeb3a97643a97468fbf0f09bd19af06"}, 0x10080) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r3 = syz_open_dev$cec(&(0x7f00000000c0)='/dev/cec#\x00', 0x2, 0x2) r4 = syz_open_dev$swradio(&(0x7f0000000100)='/dev/swradio#\x00', 0x1, 0x2) ioctl$KVM_CREATE_DEVICE(r3, 0xc00caee0, &(0x7f0000000140)={0x1, r4}) ioctl$SNDRV_CTL_IOCTL_ELEM_LIST(r3, 0xc0505510, &(0x7f0000000180)={0x7ff, 0x5, 0x3c79, 0x6, &(0x7f0000000340)=[{}, {}, {}, {}, {}]}) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000000)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080), 0x111}}, 0x20) dup2(r2, r0) [ 1237.735062][T13299] binder: 13297:13299 got transaction to context manager from process owning it [ 1237.829179][T13399] binder: 13332:13399 IncRefs 0 refcount change on invalid ref 27648 ret -22 02:24:09 executing program 5: r0 = open(&(0x7f0000000500)='./bus\x00', 0x141042, 0x0) close(r0) syz_open_dev$loop(&(0x7f0000000540)='/dev/loop#\x00', 0x0, 0x105082) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0x526987c9) read(r1, &(0x7f0000000200)=""/250, 0x207000) 02:24:09 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x80180, 0x0) setsockopt$IP_VS_SO_SET_ZERO(r2, 0x0, 0x48f, &(0x7f0000000040)={0x3b, @local, 0x4e22, 0x2, 'none\x00', 0x7, 0x9f69, 0x77}, 0x2c) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080), 0x111}}, 0x20) getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000180)={0x0, 0x68, &(0x7f0000000100)=[@in={0x2, 0x4e21, @initdev={0xac, 0x1e, 0x0, 0x0}}, @in={0x2, 0x4e24, @local}, @in6={0xa, 0x4e21, 0x3, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0xffff}, @in={0x2, 0x4e20, @multicast2}, @in6={0xa, 0x4e20, 0x1f, @rand_addr="84f50ba6926e3823901be21750b01a50", 0x2}]}, &(0x7f00000001c0)=0x10) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r2, 0x84, 0xf, &(0x7f0000000240)={r3, @in={{0x2, 0x4e20, @remote}}, 0x9, 0xfffffffffffffff8, 0x3, 0x64}, &(0x7f0000000300)=0x98) dup2(r1, r0) 02:24:09 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x5000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:09 executing program 0: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) getsockopt$bt_hci(r0, 0x0, 0x3, &(0x7f0000000040)=""/117, &(0x7f00000000c0)=0x75) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x41, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getpgid(0xffffffffffffffff) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000044ff8)={0xffffffffffffffff, 0xffffffffffffffff}) bind$unix(r1, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) connect$unix(r1, &(0x7f00000bc000)=@abs, 0x8) setsockopt$sock_timeval(r2, 0x1, 0x15, &(0x7f0000000000)={0x0, 0x2710}, 0x10) sendmmsg$unix(r2, &(0x7f00000bd000), 0x80, 0x0) connect$unix(r1, &(0x7f00003de000)=@file={0x1, './file0\x00'}, 0xa) connect$unix(r1, &(0x7f0000681000)=@abs, 0x8) r3 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r3) r4 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) write$binfmt_aout(r4, &(0x7f0000000580)=ANY=[@ANYBLOB="0000000000000000000008000000000000000000001c3adde6863809aa0000004e2311a4a1027777bf4059f358dc1ab73301ad9a85afe827389338a0ddbe9f63e90900000000000000d94fcadcb572c54f42bb8c0d7de02d9bf774a2d8fa246a1f22796dbb1ceeb7bd4300"/116], 0x74) perf_event_open(&(0x7f0000000800)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r4, r4, &(0x7f0000000000), 0x8080fffffffe) ioctl$RTC_PIE_OFF(r3, 0x7006) mkdir(&(0x7f0000001540)='./file0\x00', 0x0) getsockname$inet(r4, &(0x7f0000000240)={0x2, 0x0, @multicast1}, &(0x7f0000000300)=0x10) 02:24:09 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304, 0x7400}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:09 executing program 1: unshare(0x40000000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0adc1f123c123f3188b070") r1 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$IPT_SO_GET_INFO(r1, 0x203000000000000, 0x40, &(0x7f0000000000)={'security\x00'}, &(0x7f0000000080)=0x54) getsockopt$IPT_SO_GET_INFO(r1, 0x0, 0x40, &(0x7f0000000140)={'raw\x00'}, &(0x7f00000000c0)=0x54) [ 1238.290463][T13419] IPVS: ftp: loaded support on port[0] = 21 [ 1238.326338][T13424] binder: 13415:13424 IncRefs 0 refcount change on invalid ref 29696 ret -22 [ 1238.346134][T13429] binder: 13417:13429 got transaction to context manager from process owning it [ 1238.375068][T13424] binder_alloc: 13417: binder_alloc_buf, no vma 02:24:09 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304, 0x7a00}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:09 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x6000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:09 executing program 4: r0 = socket$kcm(0x29, 0x0, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000)={0x0, 0x0}, &(0x7f0000000040)=0xc) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r3 = socket$inet6_udp(0xa, 0x2, 0x0) accept4$packet(0xffffffffffffffff, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f00000001c0)=0x14, 0x800) setsockopt$inet6_IPV6_XFRM_POLICY(r3, 0x29, 0x23, &(0x7f0000000240)={{{@in6=@initdev={0xfe, 0x88, [], 0x1, 0x0}, @in=@empty, 0x4e22, 0x0, 0x4e21, 0x10f, 0x2, 0xa0, 0x20, 0x1d, r4, r1}, {0x2, 0x0, 0x7, 0x3, 0x2e, 0xfffffffffffffff7, 0xaf, 0x7}, {0x8bf, 0x5, 0xeb5, 0x7ff}, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1}, {{@in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x4d3, 0x33}, 0x2, @in=@local, 0x3500, 0x2, 0x2, 0x8001, 0x0, 0x0, 0x69}}, 0xe8) r5 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000100)={0x0, 0xffffffffffffffaf, 0xfa00, {0x0, &(0x7f0000000340), 0x117, 0x4}}, 0x20) r6 = dup2(r5, r2) ioctl$DRM_IOCTL_AGP_ENABLE(r6, 0x40086432, &(0x7f0000000080)=0x81) [ 1238.688038][T13594] binder: 13536:13594 got transaction to context manager from process owning it 02:24:09 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304, 0x1000000}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:09 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x7000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:09 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080), 0x111}}, 0x20) r2 = dup2(r1, r0) getsockopt$inet_dccp_int(r2, 0x21, 0x1b, &(0x7f0000000000), &(0x7f0000000040)=0x4) [ 1238.864559][T13740] binder: 13739:13740 IncRefs 0 refcount change on invalid ref 16777216 ret -22 [ 1238.979971][T13743] binder: 13742:13743 got transaction to context manager from process owning it 02:24:10 executing program 5: r0 = open(&(0x7f0000000500)='./bus\x00', 0x141042, 0x0) close(r0) syz_open_dev$loop(&(0x7f0000000540)='/dev/loop#\x00', 0x0, 0x105082) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0x526987c9) read(r1, &(0x7f0000000200)=""/250, 0x208000) 02:24:10 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304, 0x2000000}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:10 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0xa000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1239.309723][T13859] binder: 13856:13859 IncRefs 0 refcount change on invalid ref 33554432 ret -22 [ 1239.336879][T13860] binder: 13857:13860 got transaction to context manager from process owning it [ 1239.355079][T13859] binder_alloc: 13857: binder_alloc_buf, no vma 02:24:10 executing program 0: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) getsockopt$bt_hci(r0, 0x0, 0x3, &(0x7f0000000040)=""/117, &(0x7f00000000c0)=0x75) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x41, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getpgid(0xffffffffffffffff) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000044ff8)={0xffffffffffffffff, 0xffffffffffffffff}) bind$unix(r1, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) connect$unix(r1, &(0x7f00000bc000)=@abs, 0x8) setsockopt$sock_timeval(r2, 0x1, 0x15, &(0x7f0000000000)={0x0, 0x2710}, 0x10) sendmmsg$unix(r2, &(0x7f00000bd000), 0x80, 0x0) connect$unix(r1, &(0x7f00003de000)=@file={0x1, './file0\x00'}, 0xa) connect$unix(r1, &(0x7f0000681000)=@abs, 0x8) r3 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r3) r4 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) write$binfmt_aout(r4, &(0x7f0000000580)=ANY=[@ANYBLOB="0000000000000000000008000000000000000000001c3adde6863809aa0000004e2311a4a1027777bf4059f358dc1ab73301ad9a85afe827389338a0ddbe9f63e90900000000000000d94fcadcb572c54f42bb8c0d7de02d9bf774a2d8fa246a1f22796dbb1ceeb7bd4300"/116], 0x74) perf_event_open(&(0x7f0000000800)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r4, r4, &(0x7f0000000000), 0x8080fffffffe) ioctl$RTC_PIE_OFF(r3, 0x7006) mkdir(&(0x7f0000001540)='./file0\x00', 0x0) getsockname$inet(r4, &(0x7f0000000240)={0x2, 0x0, @multicast1}, &(0x7f0000000300)=0x10) 02:24:10 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080)={0xffffffffffffffff}, 0x111}}, 0x20) r3 = dup2(r1, r0) write$RDMA_USER_CM_CMD_RESOLVE_IP(r3, &(0x7f0000000000)={0x3, 0x40, 0xfa00, {{0xa, 0x4e22, 0xffffffff, @dev={0xfe, 0x80, [], 0xf}, 0x6d}, {0xa, 0x4e21, 0x9, @remote, 0x4}, r2, 0x80}}, 0x48) 02:24:10 executing program 1: unshare(0x40000000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0adc1f123c123f3188b070") r1 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$IPT_SO_GET_INFO(r1, 0x203000000000000, 0x40, &(0x7f0000000000)={'security\x00'}, &(0x7f0000000080)=0x54) getsockopt$IPT_SO_GET_INFO(r1, 0x0, 0x40, &(0x7f0000000140)={'raw\x00'}, &(0x7f00000000c0)=0x54) 02:24:10 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304, 0x3000000}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:10 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x20000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:10 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080), 0x111}}, 0x20) dup2(r1, r0) syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x7, 0x101001) fremovexattr(r1, &(0x7f0000000000)=@known='trusted.overlay.origin\x00') [ 1239.719873][T13978] binder_transaction: 23 callbacks suppressed [ 1239.719890][T13978] binder: 13974:13978 transaction failed 29189/-22, size 0-0 line 2995 [ 1239.746296][T13977] binder: 13975:13977 transaction failed 29201/-22, size 0-0 line 2986 [ 1239.820938][T14006] IPVS: ftp: loaded support on port[0] = 21 02:24:10 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304, 0x4000000}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:10 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x3f000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1239.866225][ T22] binder_release_work: 23 callbacks suppressed [ 1239.866234][ T22] binder: undelivered TRANSACTION_ERROR: 29201 [ 1239.882654][ T22] binder: undelivered TRANSACTION_ERROR: 29189 02:24:10 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) getuid() write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080), 0x111}}, 0x20) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x240, 0x0) ioctl$BLKRRPART(r1, 0x125f, 0x0) [ 1240.007259][T14088] binder: 14084:14088 transaction failed 29201/-22, size 0-0 line 2986 [ 1240.010527][T14089] binder_alloc: 14084: binder_alloc_buf, no vma [ 1240.056730][T14089] binder: 14086:14089 transaction failed 29189/-3, size 0-0 line 3148 [ 1240.157375][ T22] binder: undelivered TRANSACTION_ERROR: 29201 [ 1240.190869][T11612] binder: undelivered TRANSACTION_ERROR: 29189 02:24:11 executing program 5: r0 = open(&(0x7f0000000500)='./bus\x00', 0x141042, 0x0) close(r0) syz_open_dev$loop(&(0x7f0000000540)='/dev/loop#\x00', 0x0, 0x105082) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0x526987c9) read(r1, &(0x7f0000000200)=""/250, 0x209000) 02:24:11 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x48000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:11 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000000)={0x0, 0xfffffffffffffe68, 0xfa00, {0x0, &(0x7f0000000080), 0x111}}, 0x20) dup2(r1, r0) [ 1240.412667][T14233] binder: 14196:14233 transaction failed 29201/-22, size 0-0 line 2986 [ 1240.497865][ T22] binder: undelivered TRANSACTION_ERROR: 29201 02:24:11 executing program 0: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) getsockopt$bt_hci(r0, 0x0, 0x3, &(0x7f0000000040)=""/117, &(0x7f00000000c0)=0x75) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x41, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getpgid(0xffffffffffffffff) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000044ff8)={0xffffffffffffffff, 0xffffffffffffffff}) bind$unix(r1, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) connect$unix(r1, &(0x7f00000bc000)=@abs, 0x8) setsockopt$sock_timeval(r2, 0x1, 0x15, &(0x7f0000000000)={0x0, 0x2710}, 0x10) sendmmsg$unix(r2, &(0x7f00000bd000), 0x80, 0x0) connect$unix(r1, &(0x7f00003de000)=@file={0x1, './file0\x00'}, 0xa) connect$unix(r1, &(0x7f0000681000)=@abs, 0x8) r3 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r3) r4 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) write$binfmt_aout(r4, &(0x7f0000000580)=ANY=[@ANYBLOB="0000000000000000000008000000000000000000001c3adde6863809aa0000004e2311a4a1027777bf4059f358dc1ab73301ad9a85afe827389338a0ddbe9f63e90900000000000000d94fcadcb572c54f42bb8c0d7de02d9bf774a2d8fa246a1f22796dbb1ceeb7bd4300"/116], 0x74) perf_event_open(&(0x7f0000000800)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r4, r4, &(0x7f0000000000), 0x8080fffffffe) ioctl$RTC_PIE_OFF(r3, 0x7006) mkdir(&(0x7f0000001540)='./file0\x00', 0x0) getsockname$inet(r4, &(0x7f0000000240)={0x2, 0x0, @multicast1}, &(0x7f0000000300)=0x10) 02:24:11 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304, 0x5000000}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1240.760585][T14308] binder: 14306:14308 transaction failed 29189/-22, size 0-0 line 2995 [ 1240.868415][T11612] binder: undelivered TRANSACTION_ERROR: 29189 02:24:11 executing program 1: unshare(0x40000000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0adc1f123c123f3188b070") r1 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$IPT_SO_GET_INFO(r1, 0x0, 0x40, &(0x7f0000000140)={'raw\x00'}, &(0x7f00000000c0)=0x54) 02:24:11 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x4c000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:11 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0x40, 0xb0b3, 0xfffffffffffffffd, 0xfffffffffffffffa, 0x0, 0xf799, 0x0, 0x4, 0x40, 0x7f, 0x5, 0x8000, 0x8, 0x7ff, 0x600000, 0x16bb, 0x400, 0x5, 0x4, 0x7fff, 0x40, 0x0, 0x4, 0x7ff, 0x81, 0x20, 0x3f3, 0x7, 0x7, 0x8, 0x3, 0x7ff, 0xab46, 0x7, 0x4, 0x200, 0x0, 0x2, 0x2, @perf_bp={&(0x7f0000000000), 0x4}, 0x1000, 0x20, 0x1, 0x7, 0x148, 0x3, 0x3ce6}, 0xffffffffffffffff, 0xc, 0xffffffffffffffff, 0xa) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080), 0x111}}, 0x20) dup2(r1, r0) 02:24:11 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304, 0x6000000}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1240.989728][T14320] binder_thread_write: 3 callbacks suppressed [ 1240.989745][T14320] binder: 14314:14320 IncRefs 0 refcount change on invalid ref 100663296 ret -22 [ 1241.042681][T14328] binder: 14313:14328 transaction failed 29201/-22, size 0-0 line 2986 [ 1241.043124][T14320] binder_alloc: 14313: binder_alloc_buf, no vma [ 1241.078231][T14340] IPVS: ftp: loaded support on port[0] = 21 [ 1241.084723][T14320] binder: 14314:14320 transaction failed 29189/-3, size 0-0 line 3148 02:24:11 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304, 0x7000000}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1241.165264][T11612] binder: undelivered TRANSACTION_ERROR: 29189 02:24:12 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:12 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r2 = creat(&(0x7f0000000000)='./file0\x00', 0x20) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000100)='IPVS\x00') socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$SNDRV_CTL_IOCTL_TLV_WRITE(r2, 0xc008551b, &(0x7f0000000280)=ANY=[@ANYBLOB="010000f803000000210f0000"]) sendmsg$IPVS_CMD_NEW_DEST(r2, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r3, @ANYBLOB="6fe628bd7000fbdbdf25050000000800050000000000"], 0x1c}, 0x1, 0x0, 0x0, 0x20004004}, 0x10) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080), 0x111}}, 0x20) dup2(r1, r0) r4 = semget$private(0x0, 0x0, 0x10) semctl$SETVAL(r4, 0x0, 0x10, &(0x7f00000002c0)=0x9) ioctl$FS_IOC_GETFLAGS(r1, 0x80086601, &(0x7f0000000240)) [ 1241.246407][T11612] binder: undelivered TRANSACTION_ERROR: 29201 02:24:12 executing program 5: r0 = open(&(0x7f0000000500)='./bus\x00', 0x141042, 0x0) close(r0) syz_open_dev$loop(&(0x7f0000000540)='/dev/loop#\x00', 0x0, 0x105082) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0x526987c9) read(r1, &(0x7f0000000200)=""/250, 0x20a000) [ 1241.414648][T14492] binder_transaction: 4 callbacks suppressed [ 1241.414659][T14492] binder: 14459:14492 got transaction to context manager from process owning it 02:24:12 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304, 0xa000000}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1241.473176][T14492] binder: 14459:14492 transaction failed 29201/-22, size 0-0 line 2986 02:24:12 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x68000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1241.601559][T11612] binder: undelivered TRANSACTION_ERROR: 29201 [ 1241.644700][T14640] binder: 14638:14640 IncRefs 0 refcount change on invalid ref 167772160 ret -22 [ 1241.737336][T14640] binder_alloc: 14642: binder_alloc_buf, no vma [ 1241.741209][T14643] binder: 14642:14643 got transaction to context manager from process owning it [ 1241.770127][T14640] binder: 14638:14640 transaction failed 29189/-3, size 0-0 line 3148 [ 1241.839847][T11612] binder: undelivered TRANSACTION_ERROR: 29201 02:24:12 executing program 0: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) getsockopt$bt_hci(r0, 0x0, 0x3, &(0x7f0000000040)=""/117, &(0x7f00000000c0)=0x75) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x41, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getpgid(0xffffffffffffffff) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000044ff8)={0xffffffffffffffff, 0xffffffffffffffff}) bind$unix(r1, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) connect$unix(r1, &(0x7f00000bc000)=@abs, 0x8) setsockopt$sock_timeval(r2, 0x1, 0x15, &(0x7f0000000000)={0x0, 0x2710}, 0x10) sendmmsg$unix(r2, &(0x7f00000bd000), 0x80, 0x0) connect$unix(r1, &(0x7f00003de000)=@file={0x1, './file0\x00'}, 0xa) connect$unix(r1, &(0x7f0000681000)=@abs, 0x8) r3 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r3) r4 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) write$binfmt_aout(r4, &(0x7f0000000580)=ANY=[@ANYBLOB="0000000000000000000008000000000000000000001c3adde6863809aa0000004e2311a4a1027777bf4059f358dc1ab73301ad9a85afe827389338a0ddbe9f63e90900000000000000d94fcadcb572c54f42bb8c0d7de02d9bf774a2d8fa246a1f22796dbb1ceeb7bd4300"/116], 0x74) perf_event_open(&(0x7f0000000800)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r4, r4, &(0x7f0000000000), 0x8080fffffffe) ioctl$RTC_PIE_OFF(r3, 0x7006) mkdir(&(0x7f0000001540)='./file0\x00', 0x0) getsockname$inet(r4, &(0x7f0000000240)={0x2, 0x0, @multicast1}, &(0x7f0000000300)=0x10) 02:24:12 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000140)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080), 0x111}}, 0x20) r2 = dup2(r1, r0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000000)={0x4, 0x1, 0x5000, 0x1000, &(0x7f0000fff000/0x1000)=nil}) 02:24:12 executing program 1: unshare(0x40000000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0adc1f123c123f3188b070") r1 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$IPT_SO_GET_INFO(r1, 0x0, 0x40, &(0x7f0000000140)={'raw\x00'}, &(0x7f00000000c0)=0x54) 02:24:12 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x6c000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:12 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304, 0x20000000}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:12 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080), 0x111}}, 0x20) dup2(r1, r0) [ 1242.258998][T14756] binder: 14754:14756 got transaction to context manager from process owning it [ 1242.290251][T14759] binder: 14757:14759 IncRefs 0 refcount change on invalid ref 536870912 ret -22 [ 1242.314978][T14759] binder_alloc: 14754: binder_alloc_buf, no vma [ 1242.332257][T14763] IPVS: ftp: loaded support on port[0] = 21 02:24:13 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x74000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:13 executing program 5: r0 = open(&(0x7f0000000500)='./bus\x00', 0x141042, 0x0) close(r0) syz_open_dev$loop(&(0x7f0000000540)='/dev/loop#\x00', 0x0, 0x105082) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0x526987c9) read(r1, &(0x7f0000000200)=""/250, 0x20b000) 02:24:13 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r2 = syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0xbcc, 0x2000) ioctl$IMGETDEVINFO(r2, 0x80044944, &(0x7f0000000240)={0x9}) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080), 0x111}}, 0x20) r3 = dup2(r1, r0) recvfrom$rose(r3, &(0x7f0000000100)=""/252, 0xfc, 0x102, &(0x7f0000000000)=@full={0xb, @dev={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, 0x4, [@null, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}]}, 0x40) 02:24:13 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304, 0x48000000}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1242.583440][T14869] binder: 14868:14869 got transaction to context manager from process owning it [ 1242.628983][T14875] binder: 14872:14875 IncRefs 0 refcount change on invalid ref 1207959552 ret -22 02:24:13 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x7a000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1242.708337][T14875] binder_alloc: 14868: binder_alloc_buf, no vma 02:24:13 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) getsockname(0xffffffffffffff9c, &(0x7f0000000140)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @initdev}}}, &(0x7f00000001c0)=0x80) setsockopt$bt_BT_DEFER_SETUP(r2, 0x112, 0x7, &(0x7f0000000240), 0x4) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080), 0x111}}, 0x20) dup2(r1, r0) [ 1242.873289][T14980] binder: 14979:14980 got transaction to context manager from process owning it 02:24:13 executing program 0: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) getsockopt$bt_hci(r0, 0x0, 0x3, &(0x7f0000000040)=""/117, &(0x7f00000000c0)=0x75) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x41, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getpgid(0xffffffffffffffff) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000044ff8)={0xffffffffffffffff, 0xffffffffffffffff}) bind$unix(r1, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) connect$unix(r1, &(0x7f00000bc000)=@abs, 0x8) setsockopt$sock_timeval(r2, 0x1, 0x15, &(0x7f0000000000)={0x0, 0x2710}, 0x10) sendmmsg$unix(r2, &(0x7f00000bd000), 0x80, 0x0) connect$unix(r1, &(0x7f00003de000)=@file={0x1, './file0\x00'}, 0xa) connect$unix(r1, &(0x7f0000681000)=@abs, 0x8) r3 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r3) r4 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) write$binfmt_aout(r4, &(0x7f0000000580)=ANY=[@ANYBLOB="0000000000000000000008000000000000000000001c3adde6863809aa0000004e2311a4a1027777bf4059f358dc1ab73301ad9a85afe827389338a0ddbe9f63e90900000000000000d94fcadcb572c54f42bb8c0d7de02d9bf774a2d8fa246a1f22796dbb1ceeb7bd4300"/116], 0x74) perf_event_open(&(0x7f0000000800)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r4, r4, &(0x7f0000000000), 0x8080fffffffe) ioctl$RTC_PIE_OFF(r3, 0x7006) mkdir(&(0x7f0000001540)='./file0\x00', 0x0) 02:24:13 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304, 0x4c000000}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1243.165053][T15087] binder: 15085:15087 IncRefs 0 refcount change on invalid ref 1275068416 ret -22 02:24:14 executing program 1: unshare(0x40000000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0adc1f123c123f3188b070") r1 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$IPT_SO_GET_INFO(r1, 0x0, 0x40, &(0x7f0000000140)={'raw\x00'}, &(0x7f00000000c0)=0x54) 02:24:14 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304, 0x60000000}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:14 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0xfdfdffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:14 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffff9c, 0x0, 0x1a, &(0x7f0000000140)='security.SMACK64TRANSMUTE\x00', 0xffffffffffffffff}, 0x30) sched_setparam(r2, &(0x7f00000001c0)=0x100000001) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080), 0x111}}, 0x20) dup2(r1, r0) setxattr$security_smack_transmute(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000100)='TRUE', 0x4, 0x1) [ 1243.418538][T15100] binder: 15095:15100 IncRefs 0 refcount change on invalid ref 1610612736 ret -22 [ 1243.460154][T15101] binder: 15099:15101 Acquire 1 refcount change on invalid ref 0 ret -22 [ 1243.466236][T15104] IPVS: ftp: loaded support on port[0] = 21 02:24:14 executing program 5: r0 = open(&(0x7f0000000500)='./bus\x00', 0x141042, 0x0) close(r0) syz_open_dev$loop(&(0x7f0000000540)='/dev/loop#\x00', 0x0, 0x105082) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0x526987c9) read(r1, &(0x7f0000000200)=""/250, 0x20c000) [ 1243.503267][T15101] binder: 15099:15101 Acquire 1 refcount change on invalid ref 0 ret -22 02:24:14 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304, 0x68000000}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:14 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080), 0x111}}, 0x20) dup2(r1, r0) 02:24:14 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0xfffffdfd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1243.699997][T15214] binder: 15202:15214 IncRefs 0 refcount change on invalid ref 1744830464 ret -22 02:24:14 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304, 0x6c000000}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:14 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080), 0x111}}, 0x20) tee(r1, r0, 0x6, 0x8) dup2(r1, r0) [ 1243.876307][T15321] binder: 15219:15321 got transaction to context manager from process owning it [ 1243.918940][T15322] binder: 15303:15322 IncRefs 0 refcount change on invalid ref 1811939328 ret -22 [ 1243.944826][T15322] binder_alloc: 15219: binder_alloc_buf, no vma 02:24:14 executing program 0: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) getsockopt$bt_hci(r0, 0x0, 0x3, &(0x7f0000000040)=""/117, &(0x7f00000000c0)=0x75) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x41, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getpgid(0xffffffffffffffff) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000044ff8)={0xffffffffffffffff, 0xffffffffffffffff}) bind$unix(r1, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) connect$unix(r1, &(0x7f00000bc000)=@abs, 0x8) setsockopt$sock_timeval(r2, 0x1, 0x15, &(0x7f0000000000)={0x0, 0x2710}, 0x10) sendmmsg$unix(r2, &(0x7f00000bd000), 0x80, 0x0) connect$unix(r1, &(0x7f00003de000)=@file={0x1, './file0\x00'}, 0xa) connect$unix(r1, &(0x7f0000681000)=@abs, 0x8) r3 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r3) r4 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) write$binfmt_aout(r4, &(0x7f0000000580)=ANY=[@ANYBLOB="0000000000000000000008000000000000000000001c3adde6863809aa0000004e2311a4a1027777bf4059f358dc1ab73301ad9a85afe827389338a0ddbe9f63e90900000000000000d94fcadcb572c54f42bb8c0d7de02d9bf774a2d8fa246a1f22796dbb1ceeb7bd4300"/116], 0x74) perf_event_open(&(0x7f0000000800)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r4, r4, &(0x7f0000000000), 0x8080fffffffe) ioctl$RTC_PIE_OFF(r3, 0x7006) 02:24:14 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x100000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1244.234906][T15428] binder: 15427:15428 got transaction to context manager from process owning it 02:24:15 executing program 1: unshare(0x40000000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0adc1f123c123f3188b070") getsockopt$IPT_SO_GET_INFO(0xffffffffffffffff, 0x203000000000000, 0x40, &(0x7f0000000000)={'security\x00'}, &(0x7f0000000080)=0x54) getsockopt$IPT_SO_GET_INFO(0xffffffffffffffff, 0x0, 0x40, &(0x7f0000000140)={'raw\x00'}, &(0x7f00000000c0)=0x54) 02:24:15 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304, 0x74000000}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:15 executing program 4: r0 = syz_open_dev$sndseq(&(0x7f0000000240)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r0, 0x40605346, &(0x7f0000000000)={0x0, 0x2}) 02:24:15 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:15 executing program 5: r0 = open(&(0x7f0000000500)='./bus\x00', 0x141042, 0x0) close(r0) syz_open_dev$loop(&(0x7f0000000540)='/dev/loop#\x00', 0x0, 0x105082) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0x526987c9) read(r1, &(0x7f0000000200)=""/250, 0x20d000) [ 1244.545740][T15443] binder: 15441:15443 got transaction to context manager from process owning it [ 1244.545907][T15442] binder_alloc: 15441: binder_alloc_buf, no vma 02:24:15 executing program 4: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(0xffffffffffffffff, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r0, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r0, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) [ 1244.605557][T15447] IPVS: ftp: loaded support on port[0] = 21 02:24:15 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x300000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:15 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304, 0x7a000000}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:15 executing program 4: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(0xffffffffffffffff, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r0, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r0, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) [ 1244.840977][T15457] binder: 15454:15457 got transaction to context manager from process owning it [ 1244.867031][T15457] binder_transaction: 15 callbacks suppressed [ 1244.867046][T15457] binder: 15454:15457 transaction failed 29201/-22, size 0-0 line 2986 02:24:15 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304, 0xfdfdffff}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1245.041423][T11612] binder_release_work: 15 callbacks suppressed [ 1245.041432][T11612] binder: undelivered TRANSACTION_ERROR: 29201 [ 1245.150457][T15567] binder: 15566:15567 transaction failed 29189/-22, size 0-0 line 2995 [ 1245.224944][T11612] binder: undelivered TRANSACTION_ERROR: 29189 02:24:16 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x400000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:16 executing program 4: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(0xffffffffffffffff, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r0, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r0, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) [ 1245.396522][T15573] binder: 15570:15573 got transaction to context manager from process owning it [ 1245.426270][T15573] binder: 15570:15573 transaction failed 29201/-22, size 0-0 line 2986 [ 1245.487154][T11612] binder: undelivered TRANSACTION_ERROR: 29201 02:24:16 executing program 1: unshare(0x40000000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0adc1f123c123f3188b070") getsockopt$IPT_SO_GET_INFO(0xffffffffffffffff, 0x203000000000000, 0x40, &(0x7f0000000000)={'security\x00'}, &(0x7f0000000080)=0x54) getsockopt$IPT_SO_GET_INFO(0xffffffffffffffff, 0x0, 0x40, &(0x7f0000000140)={'raw\x00'}, &(0x7f00000000c0)=0x54) 02:24:16 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304, 0xfffffdfd}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:16 executing program 0: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) getsockopt$bt_hci(r0, 0x0, 0x3, &(0x7f0000000040)=""/117, &(0x7f00000000c0)=0x75) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x41, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getpgid(0xffffffffffffffff) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000044ff8)={0xffffffffffffffff, 0xffffffffffffffff}) bind$unix(r1, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) connect$unix(r1, &(0x7f00000bc000)=@abs, 0x8) setsockopt$sock_timeval(r2, 0x1, 0x15, &(0x7f0000000000)={0x0, 0x2710}, 0x10) sendmmsg$unix(r2, &(0x7f00000bd000), 0x80, 0x0) connect$unix(r1, &(0x7f00003de000)=@file={0x1, './file0\x00'}, 0xa) connect$unix(r1, &(0x7f0000681000)=@abs, 0x8) r3 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r3) r4 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) write$binfmt_aout(r4, &(0x7f0000000580)=ANY=[@ANYBLOB="0000000000000000000008000000000000000000001c3adde6863809aa0000004e2311a4a1027777bf4059f358dc1ab73301ad9a85afe827389338a0ddbe9f63e90900000000000000d94fcadcb572c54f42bb8c0d7de02d9bf774a2d8fa246a1f22796dbb1ceeb7bd4300"/116], 0x74) perf_event_open(&(0x7f0000000800)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r4, r4, &(0x7f0000000000), 0x8080fffffffe) 02:24:16 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:16 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x500000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:16 executing program 5: r0 = open(&(0x7f0000000500)='./bus\x00', 0x141042, 0x0) close(r0) syz_open_dev$loop(&(0x7f0000000540)='/dev/loop#\x00', 0x0, 0x105082) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0x526987c9) read(r1, &(0x7f0000000200)=""/250, 0x20e000) [ 1245.727068][T15586] binder: 15580:15586 transaction failed 29189/-22, size 0-0 line 2995 [ 1245.737814][T15588] binder: 15584:15588 transaction failed 29201/-22, size 0-0 line 2986 [ 1245.767190][T15592] IPVS: ftp: loaded support on port[0] = 21 02:24:16 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:16 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x600000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:16 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304, 0x100000000000000}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1245.905024][T11447] binder: undelivered TRANSACTION_ERROR: 29201 [ 1245.938655][T11447] binder: undelivered TRANSACTION_ERROR: 29189 02:24:16 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1246.055488][T15601] binder: 15599:15601 transaction failed 29201/-22, size 0-0 line 2986 02:24:17 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x700000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1246.239646][T11447] binder: undelivered TRANSACTION_ERROR: 29201 02:24:17 executing program 4 (fault-call:4 fault-nth:0): r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r1, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r1, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) [ 1246.404809][T15709] binder: 15706:15709 transaction failed 29201/-22, size 0-0 line 2986 [ 1246.555251][T11612] binder: undelivered TRANSACTION_ERROR: 29201 02:24:17 executing program 1: unshare(0x40000000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0adc1f123c123f3188b070") getsockopt$IPT_SO_GET_INFO(0xffffffffffffffff, 0x203000000000000, 0x40, &(0x7f0000000000)={'security\x00'}, &(0x7f0000000080)=0x54) getsockopt$IPT_SO_GET_INFO(0xffffffffffffffff, 0x0, 0x40, &(0x7f0000000140)={'raw\x00'}, &(0x7f00000000c0)=0x54) 02:24:17 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304, 0x200000000000000}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:17 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r1, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r1, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) 02:24:17 executing program 0: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) getsockopt$bt_hci(r0, 0x0, 0x3, &(0x7f0000000040)=""/117, &(0x7f00000000c0)=0x75) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x41, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getpgid(0xffffffffffffffff) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000044ff8)={0xffffffffffffffff, 0xffffffffffffffff}) bind$unix(r1, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) connect$unix(r1, &(0x7f00000bc000)=@abs, 0x8) setsockopt$sock_timeval(r2, 0x1, 0x15, &(0x7f0000000000)={0x0, 0x2710}, 0x10) sendmmsg$unix(r2, &(0x7f00000bd000), 0x80, 0x0) connect$unix(r1, &(0x7f00003de000)=@file={0x1, './file0\x00'}, 0xa) connect$unix(r1, &(0x7f0000681000)=@abs, 0x8) r3 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r3) r4 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) write$binfmt_aout(r4, &(0x7f0000000580)=ANY=[@ANYBLOB="0000000000000000000008000000000000000000001c3adde6863809aa0000004e2311a4a1027777bf4059f358dc1ab73301ad9a85afe827389338a0ddbe9f63e90900000000000000d94fcadcb572c54f42bb8c0d7de02d9bf774a2d8fa246a1f22796dbb1ceeb7bd4300"/116], 0x74) perf_event_open(&(0x7f0000000800)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 02:24:17 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0xa00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:17 executing program 5: r0 = open(&(0x7f0000000500)='./bus\x00', 0x141042, 0x0) close(r0) syz_open_dev$loop(&(0x7f0000000540)='/dev/loop#\x00', 0x0, 0x105082) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0x526987c9) read(r1, &(0x7f0000000200)=""/250, 0x20f000) [ 1246.851565][T15724] binder_thread_write: 3 callbacks suppressed [ 1246.851582][T15724] binder: 15718:15724 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1246.878610][T15719] binder_transaction: 3 callbacks suppressed [ 1246.878619][T15719] binder: 15717:15719 got transaction to context manager from process owning it 02:24:17 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./file0\x00', 0xb0000, 0x4) fcntl$addseals(r0, 0x409, 0x2) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000280)="0adc1f123c123f3188b070") r2 = openat$userio(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/userio\x00', 0x8082, 0x0) r3 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000040)='/proc/capi/capi20ncci\x00', 0x400000, 0x0) ioctl$KDSETKEYCODE(r3, 0x4b4d, &(0x7f0000000080)={0x3, 0x9}) r4 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) setsockopt$IPT_SO_SET_ADD_COUNTERS(r1, 0x0, 0x41, &(0x7f0000000300)={'mangle\x00', 0x4, [{}, {}, {}, {}]}, 0x68) write$RDMA_USER_CM_CMD_CREATE_ID(r4, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080)={0xffffffffffffffff}, 0x2}}, 0x20) r6 = fcntl$dupfd(r4, 0x0, r4) write$RDMA_USER_CM_CMD_SET_OPTION(r6, &(0x7f0000000040)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f0000000000)=0x1, r5, 0x0, 0x1, 0x4}}, 0x20) write$USERIO_CMD_SET_PORT_TYPE(r2, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r2, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x0) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r2, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) [ 1246.931514][T15724] binder_alloc: 15717: binder_alloc_buf, no vma [ 1246.950726][T15719] binder: 15717:15719 transaction failed 29201/-22, size 0-0 line 2986 [ 1246.952762][T15730] IPVS: ftp: loaded support on port[0] = 21 [ 1246.999568][T15724] binder: 15718:15724 transaction failed 29189/-3, size 0-0 line 3148 02:24:17 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x2000000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1247.076202][T11612] binder: undelivered TRANSACTION_ERROR: 29201 02:24:17 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304, 0x300000000000000}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:17 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r1, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) r2 = accept(r0, 0x0, &(0x7f0000000080)) setsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX(r2, 0x84, 0x6e, &(0x7f0000000280)=[@in6={0xa, 0x36, 0xbc21, @rand_addr="280013f1237bebb3cf6a07458b0e2296", 0x9}], 0x1c) syz_genetlink_get_family_id$tipc(&(0x7f0000000040)='TIPC\x00') write$RDMA_USER_CM_CMD_LEAVE_MCAST(r1, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) [ 1247.124948][T11447] binder: undelivered TRANSACTION_ERROR: 29189 02:24:17 executing program 0: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) getsockopt$bt_hci(r0, 0x0, 0x3, &(0x7f0000000040)=""/117, &(0x7f00000000c0)=0x75) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x41, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getpgid(0xffffffffffffffff) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000044ff8)={0xffffffffffffffff, 0xffffffffffffffff}) bind$unix(r1, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) connect$unix(r1, &(0x7f00000bc000)=@abs, 0x8) setsockopt$sock_timeval(r2, 0x1, 0x15, &(0x7f0000000000)={0x0, 0x2710}, 0x10) sendmmsg$unix(r2, &(0x7f00000bd000), 0x80, 0x0) connect$unix(r1, &(0x7f00003de000)=@file={0x1, './file0\x00'}, 0xa) connect$unix(r1, &(0x7f0000681000)=@abs, 0x8) r3 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r3) r4 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) write$binfmt_aout(r4, &(0x7f0000000580)=ANY=[@ANYBLOB="0000000000000000000008000000000000000000001c3adde6863809aa0000004e2311a4a1027777bf4059f358dc1ab73301ad9a85afe827389338a0ddbe9f63e90900000000000000d94fcadcb572c54f42bb8c0d7de02d9bf774a2d8fa246a1f22796dbb1ceeb7bd4300"/116], 0x74) [ 1247.223668][T15837] binder: 15835:15837 got transaction to context manager from process owning it [ 1247.269532][T15843] binder_alloc: 15835: binder_alloc_buf, no vma [ 1247.270104][T15837] binder: 15835:15837 transaction failed 29201/-22, size 0-0 line 2986 02:24:18 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304, 0x400000000000000}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1247.358482][T11447] binder: undelivered TRANSACTION_ERROR: 29189 [ 1247.478865][T15950] binder: 15938:15950 IncRefs 0 refcount change on invalid ref 0 ret -22 02:24:18 executing program 1: unshare(0x40000000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) r0 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$IPT_SO_GET_INFO(r0, 0x203000000000000, 0x40, &(0x7f0000000000)={'security\x00'}, &(0x7f0000000080)=0x54) getsockopt$IPT_SO_GET_INFO(r0, 0x0, 0x40, &(0x7f0000000140)={'raw\x00'}, &(0x7f00000000c0)=0x54) 02:24:18 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:18 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0a0000000000000004b070") r1 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r1, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r1, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) 02:24:18 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304, 0x500000000000000}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:18 executing program 0: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) getsockopt$bt_hci(r0, 0x0, 0x3, &(0x7f0000000040)=""/117, &(0x7f00000000c0)=0x75) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x41, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getpgid(0xffffffffffffffff) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000044ff8)={0xffffffffffffffff, 0xffffffffffffffff}) bind$unix(r1, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) connect$unix(r1, &(0x7f00000bc000)=@abs, 0x8) setsockopt$sock_timeval(r2, 0x1, 0x15, &(0x7f0000000000)={0x0, 0x2710}, 0x10) sendmmsg$unix(r2, &(0x7f00000bd000), 0x80, 0x0) connect$unix(r1, &(0x7f00003de000)=@file={0x1, './file0\x00'}, 0xa) connect$unix(r1, &(0x7f0000681000)=@abs, 0x8) r3 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r3) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) 02:24:18 executing program 5: r0 = open(&(0x7f0000000500)='./bus\x00', 0x141042, 0x0) close(r0) syz_open_dev$loop(&(0x7f0000000540)='/dev/loop#\x00', 0x0, 0x105082) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0x526987c9) read(r1, &(0x7f0000000200)=""/250, 0x210000) [ 1247.864330][T15958] binder: 15957:15958 got transaction to context manager from process owning it [ 1247.907616][T15967] binder_alloc: 15957: binder_alloc_buf, no vma 02:24:18 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x4800000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1247.964007][T15988] IPVS: ftp: loaded support on port[0] = 21 02:24:18 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304, 0x600000000000000}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:18 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r1, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r1, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) r2 = syz_open_dev$dspn(&(0x7f0000000040)='/dev/dsp#\x00', 0x8, 0x226080) ioctl$UFFDIO_ZEROPAGE(r2, 0xc020aa04, &(0x7f0000000080)={{&(0x7f0000ffd000/0x3000)=nil, 0x3000}, 0x1}) [ 1248.062694][T16074] binder: 16073:16074 got transaction to context manager from process owning it 02:24:18 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x4c00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:18 executing program 0: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) getsockopt$bt_hci(r0, 0x0, 0x3, &(0x7f0000000040)=""/117, &(0x7f00000000c0)=0x75) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x41, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getpgid(0xffffffffffffffff) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000044ff8)={0xffffffffffffffff, 0xffffffffffffffff}) bind$unix(r1, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) connect$unix(r1, &(0x7f00000bc000)=@abs, 0x8) setsockopt$sock_timeval(r2, 0x1, 0x15, &(0x7f0000000000)={0x0, 0x2710}, 0x10) sendmmsg$unix(r2, &(0x7f00000bd000), 0x80, 0x0) connect$unix(r1, &(0x7f00003de000)=@file={0x1, './file0\x00'}, 0xa) connect$unix(r1, &(0x7f0000681000)=@abs, 0x8) r3 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r3) [ 1248.172785][T16078] binder_alloc: 16073: binder_alloc_buf, no vma 02:24:19 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304, 0x700000000000000}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1248.279392][T16149] binder: 16108:16149 got transaction to context manager from process owning it [ 1248.427871][T16189] binder: 16188:16189 IncRefs 0 refcount change on invalid ref 0 ret -22 02:24:19 executing program 1: unshare(0x40000000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) r0 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$IPT_SO_GET_INFO(r0, 0x203000000000000, 0x40, &(0x7f0000000000)={'security\x00'}, &(0x7f0000000080)=0x54) getsockopt$IPT_SO_GET_INFO(r0, 0x0, 0x40, &(0x7f0000000140)={'raw\x00'}, &(0x7f00000000c0)=0x54) 02:24:19 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = openat$userio(0xffffffffffffff9c, &(0x7f0000000280)='/dev/userio\x00', 0x8089, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r1, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r1, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) 02:24:19 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x6000000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:19 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304, 0xa00000000000000}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:19 executing program 0: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) getsockopt$bt_hci(r0, 0x0, 0x3, &(0x7f0000000040)=""/117, &(0x7f00000000c0)=0x75) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x41, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getpgid(0xffffffffffffffff) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000044ff8)={0xffffffffffffffff, 0xffffffffffffffff}) bind$unix(r1, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) connect$unix(r1, &(0x7f00000bc000)=@abs, 0x8) setsockopt$sock_timeval(r2, 0x1, 0x15, &(0x7f0000000000)={0x0, 0x2710}, 0x10) sendmmsg$unix(r2, &(0x7f00000bd000), 0x80, 0x0) connect$unix(r1, &(0x7f00003de000)=@file={0x1, './file0\x00'}, 0xa) connect$unix(r1, &(0x7f0000681000)=@abs, 0x8) open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) 02:24:19 executing program 5: r0 = open(&(0x7f0000000500)='./bus\x00', 0x141042, 0x0) close(r0) syz_open_dev$loop(&(0x7f0000000540)='/dev/loop#\x00', 0x0, 0x105082) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0x526987c9) read(r1, &(0x7f0000000200)=""/250, 0x211000) [ 1248.843316][T16206] binder: 16199:16206 got transaction to context manager from process owning it [ 1248.856591][T16207] binder_alloc: 16199: binder_alloc_buf, no vma 02:24:19 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x6800000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1248.950353][T16274] IPVS: ftp: loaded support on port[0] = 21 02:24:19 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304, 0x2000000000000000}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:19 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r1, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r1, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) r2 = syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0xffff, 0x4800) getsockopt$IP6T_SO_GET_ENTRIES(r2, 0x29, 0x41, &(0x7f0000000280)={'raw\x00', 0xa7, "4c18856a4134ac5fb93ae45ecd5a8ba55804faf4c25620121d05ecc25f10d3e594007d3ad14e626df1cf7b1428bbd8a7d0564d6486ecd7e86d56406df53ad5eebef0a057027e93c16454fc3df4380a7824aa2672bda2bf2238b910b7cbcec7e34dd742ea1cb59df5645ef12e2a180aea1049dea0d8dcb56354ed7aaef66fa45e6163c79837d6bf6d320e5a5082089bca07568644d75945c05c759c30574c79f90b2c137db15d0c"}, &(0x7f0000000080)=0xcb) 02:24:19 executing program 0: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) getsockopt$bt_hci(r0, 0x0, 0x3, &(0x7f0000000040)=""/117, &(0x7f00000000c0)=0x75) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x41, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getpgid(0xffffffffffffffff) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000044ff8)={0xffffffffffffffff, 0xffffffffffffffff}) bind$unix(r1, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) connect$unix(r1, &(0x7f00000bc000)=@abs, 0x8) setsockopt$sock_timeval(r2, 0x1, 0x15, &(0x7f0000000000)={0x0, 0x2710}, 0x10) sendmmsg$unix(r2, &(0x7f00000bd000), 0x80, 0x0) connect$unix(r1, &(0x7f00003de000)=@file={0x1, './file0\x00'}, 0xa) connect$unix(r1, &(0x7f0000681000)=@abs, 0x8) [ 1249.125666][T16317] binder: 16314:16317 got transaction to context manager from process owning it [ 1249.179957][T16332] binder_alloc: 16314: binder_alloc_buf, no vma 02:24:20 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x6c00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:20 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) openat$userio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/userio\x00', 0x200000, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r1, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r1, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) [ 1249.333030][T16427] binder: 16425:16427 got transaction to context manager from process owning it 02:24:20 executing program 1: unshare(0x40000000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) r0 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$IPT_SO_GET_INFO(r0, 0x203000000000000, 0x40, &(0x7f0000000000)={'security\x00'}, &(0x7f0000000080)=0x54) getsockopt$IPT_SO_GET_INFO(r0, 0x0, 0x40, &(0x7f0000000140)={'raw\x00'}, &(0x7f00000000c0)=0x54) 02:24:20 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304, 0x4800000000000000}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:20 executing program 0: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) getsockopt$bt_hci(r0, 0x0, 0x3, &(0x7f0000000040)=""/117, &(0x7f00000000c0)=0x75) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x41, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getpgid(0xffffffffffffffff) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000044ff8)={0xffffffffffffffff, 0xffffffffffffffff}) bind$unix(r1, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) connect$unix(r1, &(0x7f00000bc000)=@abs, 0x8) setsockopt$sock_timeval(r2, 0x1, 0x15, &(0x7f0000000000)={0x0, 0x2710}, 0x10) sendmmsg$unix(r2, &(0x7f00000bd000), 0x80, 0x0) connect$unix(r1, &(0x7f0000681000)=@abs, 0x8) 02:24:20 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x7400000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:20 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = openat$null(0xffffffffffffff9c, &(0x7f0000000480)='/dev/null\x00', 0xa0040, 0x0) getsockopt$inet_sctp_SCTP_RESET_STREAMS(r1, 0x84, 0x77, &(0x7f0000000400)={0x0, 0x1, 0x1, [0x4]}, &(0x7f0000000440)=0xa) getsockopt$inet_sctp6_SCTP_RTOINFO(r1, 0x84, 0x0, &(0x7f0000000680)={0x0, 0x2, 0x8f2, 0x4}, &(0x7f00000006c0)=0x10) getsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r1, 0x84, 0x72, &(0x7f0000000700)={0x0, 0x5, 0x30}, &(0x7f0000000780)=0xc) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(r1, 0x84, 0x77, &(0x7f00000007c0)={0x0, 0x401, 0x6, [0x7ff, 0x40, 0x81, 0xfffffffffffffff5, 0x2, 0x7]}, &(0x7f0000000800)=0x14) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r1, 0x84, 0x6, &(0x7f00000004c0)={r2, @in={{0x2, 0x4e21, @loopback}}}, &(0x7f0000000640)=0x84) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(r1, 0x84, 0x77, &(0x7f00000005c0)=ANY=[@ANYRES32=r3, @ANYBLOB="03000300f9a505000500"], &(0x7f0000000600)=0xe) r4 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/qat_adf_ctl\x00', 0x8000, 0x0) ioctl$EVIOCGSW(r4, 0x8040451b, &(0x7f0000000340)=""/89) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r5 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r5, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r5, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) chroot(&(0x7f00000003c0)='./file0\x00') write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffff9c, &(0x7f0000000280)={0x16, 0x98, 0xfa00, {&(0x7f0000000040)={0xffffffffffffffff}, 0x3, 0xffffffffffffffff, 0x10, 0x1, @in6={0xa, 0x4e20, 0x2b6, @ipv4={[], [], @rand_addr=0x7fff}, 0xfff}}}, 0xa0) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r5, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0), r6}}, 0x1ee) 02:24:20 executing program 5: r0 = open(&(0x7f0000000500)='./bus\x00', 0x141042, 0x0) close(r0) syz_open_dev$loop(&(0x7f0000000540)='/dev/loop#\x00', 0x0, 0x105082) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0x526987c9) read(r1, &(0x7f0000000200)=""/250, 0x212000) [ 1249.815852][T16543] binder: 16540:16543 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1249.859914][T16556] binder: 16541:16556 got transaction to context manager from process owning it [ 1249.861506][T16543] binder_alloc: 16541: binder_alloc_buf, no vma [ 1249.889175][T16556] binder_transaction: 13 callbacks suppressed [ 1249.889193][T16556] binder: 16541:16556 transaction failed 29201/-22, size 0-0 line 2986 [ 1249.920804][T16569] IPVS: ftp: loaded support on port[0] = 21 [ 1249.945379][T16543] binder: 16540:16543 transaction failed 29189/-3, size 0-0 line 3148 02:24:20 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) fcntl$setlease(r0, 0x400, 0x1) write$USERIO_CMD_SET_PORT_TYPE(r1, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r1, &(0x7f0000000040)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x18) 02:24:20 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x7a00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:20 executing program 0: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) getsockopt$bt_hci(r0, 0x0, 0x3, &(0x7f0000000040)=""/117, &(0x7f00000000c0)=0x75) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x41, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getpgid(0xffffffffffffffff) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000044ff8)={0xffffffffffffffff, 0xffffffffffffffff}) bind$unix(r1, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) connect$unix(r1, &(0x7f00000bc000)=@abs, 0x8) setsockopt$sock_timeval(r2, 0x1, 0x15, &(0x7f0000000000)={0x0, 0x2710}, 0x10) sendmmsg$unix(r2, &(0x7f00000bd000), 0x80, 0x0) connect$unix(r1, &(0x7f0000681000)=@abs, 0x8) 02:24:20 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304, 0x4c00000000000000}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1250.065523][T11612] binder_release_work: 14 callbacks suppressed [ 1250.065534][T11612] binder: undelivered TRANSACTION_ERROR: 29189 [ 1250.173691][T16695] binder: 16659:16695 got transaction to context manager from process owning it [ 1250.201432][T16695] binder: 16659:16695 transaction failed 29201/-22, size 0-0 line 2986 02:24:21 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0xfdfdffff00000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:21 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r1, &(0x7f0000000000)={0x1, 0x1}, 0x2) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000bc0)='/dev/zero\x00', 0x220000, 0x0) ioctl$PPPIOCGFLAGS(r2, 0x8004745a, &(0x7f0000000c00)) readv(r1, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r1, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) openat$autofs(0xffffffffffffff9c, &(0x7f0000000380)='/dev/autofs\x00', 0x40, 0x0) r3 = open(&(0x7f0000000040)='./file0\x00', 0x1, 0xfedfe8abb362eac7) setsockopt$inet_sctp6_SCTP_MAX_BURST(r3, 0x84, 0x14, &(0x7f0000000080)=@int=0x4, 0x4) sendto$unix(r3, &(0x7f0000000c40)="81a42f83f3234d24e815ad1e8de41d3f1dbf1cb2d66be8a69e2e094ba63cf97fce36360b0038424c0405bd678029e5f11fd34cbe808a8e29be52b59a3136cdd3b7e84825ed2cd5c72eb6e1902d22db23493cc6afdf26e696f2229c600e08341b66722c01d3cbafb3367d04b4d102f2d9a1db4344e330aac59ba75b3aa7166e4ad96f138a6b1acc1ee3b9ae94c76ad95791b3c3a0814b0a02ca0428ebc7f537ae665591e77509ff4c19c6cfc6bb331cc72f02a0a2150601113825ac38897a10072b9d65f7462199d95cad0e9e4f4f8020cf404a09cfa4b9f7fbc78ff520690b793e56eecf918920852be18c6d402126cddfe6892c1324bab62968b745beb92d8bf769778d7bf22837858da6d9de813e8b926bb05a1db0b99417a971ef3419bf35dc7f7b7f931cce6c50d65a4d67056502106e91cfdf41148405fe1d0a2d69e5c32e058a50568b04ba0a4051ee52a83dc30ccb380d10ad4d523d7583587a5ee54bbef47767902e3ed0c7e48318fd18393bfa24f96a38f3bd37c041f14315806264b674c4c6fe3eda78685f35934a74e208e104c09ace70d01f90ce401c22e753c65a4d758cb1b92b2d2f97c4e6da6b4689f66aedfd0d7802503ce2b4e65913752932815ebda3cf1f253942924af4ad7e2fc02f1b9a3e5cbb6a13c50db9f915df11d12f67fa96c781e0008c8d2b56bb1ef8d5683013b3e1525ff928904285c35cd20905a426e34c2775840d00a422c08c9400d0e0b95bc878b02a3dae56e2caa52278b68f9173765eef340bea61f2b0fa978a6d18405b980d5761b7b147b4bb1d9ec36cddb44c015833b0daadd44d57b194d095034c3effdf5d87c49f05895e0cbf673c4e2b315ed23567eb93103d989e030bdba74dd279d4dcfed0302955f69708723130faa27b3fc23d7da9716cfb728138033244508d6798cb1efa67c917489af0292aaec7a438fed5725f6d3efe0b9d0220fd54b3984f1d50ccf7d2ee0f87adfb236bc1c9bd2c39ce409785e94bec160575c541ed4d95bacd957c3a6063f7589fd3b987b40a7a9e24c25ad524d26c70c595cfe946a0c94be5297755218e6a854e674fa61db32e6b26c9ef4c76a28b8cd4a9a7ba2de45d609a31468a1e33c7b83165c727dbf4a2d45d39dbfda663eb7462c3bf5e362d6e5ab7c3010bcafe2938ed793caaca7b1d3838ee25f169da89fc854d99f0d907b8829c68206c8d7ae3a9fd47237f3e673664eb2d9d7d87c8ea9e2a18966bdceaf2e9dfd9dbc829fdcd7a82865a3a69a1e525b2591e972fbaf9a77703010f3bb7ff45c05a88d6db52bea087c25389cf554872d91d0c4d0f07da556529373a5c14f6757458cbd9cc2449c99279888d83f1681602d3e5f4ea274a81d2f58ea4b486f5ec7bc084ac064bb0a38ac93cc47fc7c6fd1a0228c7ae436bd95c606e88f7852a0b6d64de7dbc7899c6be3a2180a271cef9e2a90f52c1681760ef3c645d1e1f046a4ddab0495febcbbd0d32674a8a4d0a97a22d7c3b379d6388e74c000683965fb69a6af3d5138575bda3cabd5526b70d6ee644ee58c6e9f7fea11e8cf08b1cdb1761c931aab4c5ad93022a747c3d007c3c909d0c432c1a0fe379de007e48b61761a2998480482cea6355b9a909e13bd927f5c93ace79249458e79ac6b6d376f847dc64a0d2534d59bc1454b84d1194ebb0206e2fd52e8de78f368a0f9289afb3d036792296ac1cc74291b35568982e4a5e61086908726a2754a439c65b0758ce66e732fd3aeb8130bcb202f0311ff44932692432f1a879cde8a7bd0e8c52e760921c1469f2def7de5c03860e352c2f84ff7dccd21d7bc8159be7bb8fd519f18f1ec5da7bfd62481513845bfd2e1a4a59d2abe46099954c01d133d37454981f08d72c1f67dd9e2ff5025ba1d4b511fd358378f53f17a780f63a5273b304f6f002f2985e9a0fe6306e4566f0c4aaa3ba8701e05015a74c3f51813daae4a2619a61176ed6272a76f4d240484105dc73eb8b759b7d972be434a14d261418df374f9590eaf7d405cca25d82d124459131f0af3035025509addc4ade0aae459154c917881840dabd501136e5d6590a4ef9bf149ffed4f7aa5e97baf15a281f31528b1729373cd193053fe4a9daff7430fcec7d81bf05ca2cf5e429a7c0b3122be81f39098df1fb0d44671954abfa47dee29a593aaf286279f9b94d44853ac16a4a23a5f95848a69e41c492a815704913c7810891f2abcf6625adcae7081200b1b51036d493309167e545f08c9a6f98f31c5e1d22da55e6162009085263c92acc3a3b09a2e75772fc904147b47574f45675c4e9e59ba7b05c78fe915e82cb4ee2c9a725d5db9199759218fd5fb3a4f46eef6b320344ea115fc8d97cba8d48488872d2a226e08e52abb059f24517e46a3f9744be7bd5d84f9beec4a1fea05e14d0ad0d0810fa66ac0acf5a6f4c097e2a8292d106a725248307d75ff5b0c3d7d753041021b638825440d749fa0fab0432016c2cb20cf3720a4ab79a97cc44a1b647a7f4345ae560d81e7a4ea13dfb790123c0d4cf5978bcc62a9b2bf64fdfba8dd08d966a8fb3d1be0e95c0fbdff7daa25a9895810702c2511809681937e1dbcb506b95e8f0c4efe5bae8556a7de9f8431fa6fe42a0f9c52239e0b32e9749a9fceada7cf039374347c50eff650bd971ff57fbbe3b866fba74eec5a6dc2f70044a0d4804e3afc017a512a48d1115b97ff9692c237ad0ba3c2b2ec294e9303327f98d8ef7435f23acc7af8ebddcd85b61fd5986a8551b1b20a6fa2ba79445b8cbe8602f993757d970e836cb5d0a08ef6408b78b350ee861100ef94a21dbacf6ed218b1df3e8747e4d4ff9fca99f3df2c8b34a3e9086bc33d0ae397478962024c4e3695102bc9d03c877d7ed151c69f18933e73756256a5c3b6a85fac42dabeb400a56edd85de89a5379163cd211cca9ea088690a1356863aa7c1da550b25507170cf5e6b0bfb944d3555758ee12f437550cc83de917a8f68f1cdb9f11fc2a31fb242c3fe008d091f4d367a0fa07d9929187df8433b7a06299bc417e5b43ea459bdb4a7aa1b894cf1559b6b2574ef19fb917118e5196d55a8f7dcabf6f741a28b931ae7963f70d014ca31074b32084a0cb1b15ebab1a1db40ac2e8b996103fa1852d38958f4b3d728d1c363b725c09b9ac215d25197ed3fe8acc60345cbb8cd33d47d25eb00bea7afa86a01247818f51eb5c10f74ff72d5e8fac17d379632d863a51261de0b6664b867b5f9366bdae048f037aae107d92765363659c8e13bdc8055ae1f43f6720d1094539e06a10362a16c29c28f47f830c1e5a51763182d4a3813d0d97b1576eebb8ea53679f5f5e593918782199bdb22b4f1e0df1f0ba5696ed9cb4bc7144fd08cead962a404ff8a4321fe5010e39808c581f6e92964ae79420611475efc36a7221a75201793a3bc5e8f674dffca9ba56212e621ecc8f2fcd6b0a83a776415ac4404a651f29ec5e136bd9d7adbc03f1d2238684c4a24b6a2d9cb6f692dce55161fccfd1e71ea2e9b0a1dd29f7d116baf7e77be2dc18a1cc0e03b9696208c83eeba49c71ee4572740ccda674f5d981c526a5294935fc78b4b74a78ea083aae1ad9253f3bd5af51bf8e8494d8ce72fbd186f281a60628ab7679edef3314e56757025e892ec3a6960221d0bde5160328c830df03905bbb1707244ba2df901168fdd05c1757fb156f759d56cb7c9e1d6e8b3e99f15fcbfec084223da2697bde37c17aa2270b220e59abdfc9d5d40be2dba1397254a85a58eb3b38ae890dbd5ef7d4d3066f5b40a463f3d19da6f1b5ab572615ee3e4da2b3cf4252d1dedc249eb6ed8dac79865030c0c685da33476dbe1e38e9e11be9771c541d5a389818b7b58c94e6a68a267ecc7bdefbb47b3a29497c47ea1d3d4e2c2b09e7848ceb57cbaf65e6d0519d2e3a2b094086261548bbf9de23ce686e5ce063609a2e3d7c20d7ede68312cab69dfc5581197fd25f6496225762249c0ef9d2e5eef345bcbd296719af6e5fa329bc19623165239b4b154c93b966e1cfbfbd8b7e336a4068a31c9622eda3c3b78016d7dc4b68f2815c9a2f873ec78d7d74ebd05f43f6afef7de95c5584b911baf885c689acc51326b85179f871ad14de08c39a36cb22b13aaaca147202acaa7fac34126b8f1651fb4bb1013de104f22e57e58dc37806740faa3ea30d1942de0041a6ec0112297c6b4a0076e251e13cacb96b770b8756b4218ef0b8b1bc270797774629c614f850791e9927f13618ed05141dbdc8b30ffe5dc8f12aecb4ee6992703ec86766ced07a01ca547469bc08feb4bcfbc95ad7ac90a9bcbffc53a26318ce8e86ccc17306081529dcdadeb9a6984e7a4048c0aeb635c8f2407c74b95ef46df51874cf9f9422e6b4fa7ed4a755db8505d5ba2e3f69dc04ad1e14d2a40a7e40ae03fef33f37e7dc99f517e81448ed00b512509002b36b6c65d4dda218edcdb9499a221ed27a43c74b5b58270aab9261fead72ff26b20359cd37e150740c9e0ccc693138edf26e1fc1cd3d3b338bae0f08f02a73b362f4dbdbc26a3bb2600a8552fbfc38165d408b495c119858dcd0600da4ad8634671fd4c5deada3cc8463b8dc79d0b7671f89f699d29352f59a5c3fd29e15014da7d987dcf71fc6091f5c6155c120bc85aca44f7e9c8213cadca7df12f297aab9a0ae5725690a62f768818505edbb90dfb1dfd7167bde353d847f0145aadbea1bac9e21cddf686fc55f31bfcc47bb26bc633170f23bbdc45fd79c429a20215c532c807ab2646065a4f9f30abf31dffbb4657e25bfa6fc37a00d78db21116398227cb307b487db9afadeff8bfc0a936910d512cf03882c40c7b5fbc68b2f8915638e386c2e650bc787aed44f7a61dfd822c1fd18a560f0473143cb5b984a9d9b7956968bb5e3bae0ffea0bc4e6e53c936634be8e0a630132c92fd4f556b13ef2e705da29e89ee0cbaa12d45626965073995a20704ebd505ab7aa8d27521245f268a1ca530a0cd440fd744790523d2d2b5349f38b8919d823b8377741ee183a27309457e3f28bb5c5f1ca1e4dcc1404c12624eaafce07baec9fa422ecfc107411450140cf8fc837053cd4fbc52a0cbfd43a95ca3749bf15815dca734f7c95facb24192c239bdff0ab2df247db0a0287f02cce2d4acf27ce1c6da3adaf05898bb6a7440f3be4bcfa9f9bb8dc0761eed2d79f2a92dde48f669541922c7acb44cb421f469e050f7ffce59fbb23f1defffe29aa8675ec67ad39b21d6233da2434901e41ffc6ab36ba329551b084795f963edcd361332f80cdcbcf29edeac0d737753e46d1a12463e705191f96e91d9078d0106d2bcc268541c5eb773d73d303989677259cb4eda72f0dc46655b75990834b32e5d7c18b21474807cbab834f817db1e18e4724cf4ef4558a83c3bdca3deb515085711fa13f04240ea1c22a2bf27a9a392845f9af8e7bab8671025cfe65cdc7db31cff7daa1231a2d9f9814cd633f0e0d7c141ca62e68851ea1b92bc8119d518078c968aabf1df2ba88d5d259cea2ac4190db2653b4d989c585ee29b29cc11a6b68861c26b6c2f238231bba22b23dd8ee843d4b5fbc4dfe2bf47351f9c1876b87a551b69041cd445cbc3bfebd12005b52552a012750c712deac106df30c04304584c025865233f2d3a3ca8ba68bc32f60598769e7b75c67c6ad2878e7cb6ba1861459a0a4ac8f27cccf1b5d744d198d349fa598fb8b90084c994c8dee34e270b93823b5594d98763f0832b14fa42e1fc4897c62766edc2748f1d7706a34bd101715", 0x1000, 0xd0, &(0x7f00000003c0)=@file={0x0, './file0\x00'}, 0x6e) getrandom(&(0x7f0000000280)=""/220, 0xdc, 0x2) openat$vcs(0xffffffffffffff9c, &(0x7f0000000440)='/dev/vcs\x00', 0x840, 0x0) [ 1250.254663][T11612] binder: undelivered TRANSACTION_ERROR: 29201 [ 1250.405295][T16843] binder: 16820:16843 transaction failed 29201/-22, size 0-0 line 2986 [ 1250.471444][T11447] binder: undelivered TRANSACTION_ERROR: 29201 02:24:21 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304, 0x6000000000000000}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:21 executing program 0: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) getsockopt$bt_hci(r0, 0x0, 0x3, &(0x7f0000000040)=""/117, &(0x7f00000000c0)=0x75) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x41, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getpgid(0xffffffffffffffff) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000044ff8)={0xffffffffffffffff, 0xffffffffffffffff}) bind$unix(r1, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) connect$unix(r1, &(0x7f00000bc000)=@abs, 0x8) setsockopt$sock_timeval(r2, 0x1, 0x15, &(0x7f0000000000)={0x0, 0x2710}, 0x10) sendmmsg$unix(r2, &(0x7f00000bd000), 0x80, 0x0) connect$unix(r1, &(0x7f0000681000)=@abs, 0x8) 02:24:21 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:21 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r1, &(0x7f0000000000)={0x1, 0x5}, 0xfffffffffffffe3c) readv(r1, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r1, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) 02:24:21 executing program 5: r0 = open(&(0x7f0000000500)='./bus\x00', 0x141042, 0x0) close(r0) syz_open_dev$loop(&(0x7f0000000540)='/dev/loop#\x00', 0x0, 0x105082) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0x526987c9) read(r1, &(0x7f0000000200)=""/250, 0x213000) 02:24:21 executing program 1: unshare(0x40000000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000100)="0adc1f123c123f3188b070") r0 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$IPT_SO_GET_INFO(r0, 0x203000000000000, 0x40, &(0x7f0000000000)={'security\x00'}, &(0x7f0000000080)=0x54) getsockopt$IPT_SO_GET_INFO(r0, 0x0, 0x40, &(0x7f0000000140)={'raw\x00'}, &(0x7f00000000c0)=0x54) [ 1250.783551][T16981] binder: 16980:16981 transaction failed 29201/-22, size 0-0 line 2986 [ 1250.823539][T16989] binder_alloc: 16980: binder_alloc_buf, no vma [ 1250.861793][T16989] binder: 16982:16989 transaction failed 29189/-3, size 0-0 line 3148 02:24:21 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1250.915390][T17035] IPVS: ftp: loaded support on port[0] = 21 [ 1250.939911][T11612] binder: undelivered TRANSACTION_ERROR: 29201 02:24:21 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304, 0x6800000000000000}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:21 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = syz_open_dev$vbi(&(0x7f0000000040)='/dev/vbi#\x00', 0x3, 0x2) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000fff000/0x1000)=nil, 0x1000}, 0x3}) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r2 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r2, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r2, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r2, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) [ 1250.978739][T11447] binder: undelivered TRANSACTION_ERROR: 29189 02:24:21 executing program 0: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) getsockopt$bt_hci(r0, 0x0, 0x3, &(0x7f0000000040)=""/117, &(0x7f00000000c0)=0x75) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x41, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getpgid(0xffffffffffffffff) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000044ff8)={0xffffffffffffffff, 0xffffffffffffffff}) bind$unix(r1, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) connect$unix(r1, &(0x7f00000bc000)=@abs, 0x8) setsockopt$sock_timeval(r2, 0x1, 0x15, &(0x7f0000000000)={0x0, 0x2710}, 0x10) connect$unix(r1, &(0x7f00003de000)=@file={0x1, './file0\x00'}, 0xa) connect$unix(r1, &(0x7f0000681000)=@abs, 0x8) [ 1251.081426][T17103] binder: 17096:17103 transaction failed 29201/-22, size 0-0 line 2986 02:24:21 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1251.209975][T11612] binder: undelivered TRANSACTION_ERROR: 29201 02:24:22 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") ioctl$FIBMAP(r0, 0x1, &(0x7f0000000080)=0x9) r1 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) syz_open_dev$swradio(&(0x7f0000000280)='/dev/swradio#\x00', 0x1, 0x2) write$USERIO_CMD_SET_PORT_TYPE(r1, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r1, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) 02:24:22 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304, 0x6c00000000000000}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1251.329862][T17309] binder: 17308:17309 transaction failed 29201/-22, size 0-0 line 2986 02:24:22 executing program 0: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) getsockopt$bt_hci(r0, 0x0, 0x3, &(0x7f0000000040)=""/117, &(0x7f00000000c0)=0x75) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x41, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getpgid(0xffffffffffffffff) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000044ff8)={0xffffffffffffffff, 0xffffffffffffffff}) bind$unix(r1, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) connect$unix(r1, &(0x7f00000bc000)=@abs, 0x8) setsockopt$sock_timeval(r2, 0x1, 0x15, &(0x7f0000000000)={0x0, 0x2710}, 0x10) connect$unix(r1, &(0x7f00003de000)=@file={0x1, './file0\x00'}, 0xa) connect$unix(r1, &(0x7f0000681000)=@abs, 0x8) 02:24:22 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1251.458353][T11447] binder: undelivered TRANSACTION_ERROR: 29201 [ 1251.473511][T17376] binder: 17325:17376 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1251.526840][T17376] binder: 17325:17376 transaction failed 29189/-22, size 0-0 line 2995 02:24:22 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) openat$userio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/userio\x00', 0x101400, 0x0) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r1, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r1, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) r2 = socket(0x5, 0x5, 0x9) accept4$vsock_stream(r2, &(0x7f0000000080)={0x28, 0x0, 0x2711}, 0x10, 0x80800) finit_module(r2, &(0x7f0000000280)='/dev/userio\x00', 0x2) [ 1251.583101][T17421] binder: 17418:17421 transaction failed 29201/-22, size 0-0 line 2986 [ 1251.652227][T11447] binder: undelivered TRANSACTION_ERROR: 29189 [ 1251.710347][T11612] binder: undelivered TRANSACTION_ERROR: 29201 02:24:22 executing program 5: r0 = open(&(0x7f0000000500)='./bus\x00', 0x141042, 0x0) close(r0) syz_open_dev$loop(&(0x7f0000000540)='/dev/loop#\x00', 0x0, 0x105082) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0x526987c9) read(r1, &(0x7f0000000200)=""/250, 0x214000) 02:24:22 executing program 1: unshare(0x40000000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000100)="0adc1f123c123f3188b070") r0 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$IPT_SO_GET_INFO(r0, 0x203000000000000, 0x40, &(0x7f0000000000)={'security\x00'}, &(0x7f0000000080)=0x54) getsockopt$IPT_SO_GET_INFO(r0, 0x0, 0x40, &(0x7f0000000140)={'raw\x00'}, &(0x7f00000000c0)=0x54) 02:24:22 executing program 4: socket$inet_udplite(0x2, 0x2, 0x88) r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000000)={0x1, 0x3}, 0x2) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000040)='/proc/capi/capi20\x00', 0x200000042, 0x0) ioctl$TIOCGETD(r1, 0x5424, &(0x7f0000000080)) setsockopt$bt_hci_HCI_TIME_STAMP(r1, 0x0, 0x3, &(0x7f00000002c0)=0x7, 0xffffffffffffffb6) pipe2(&(0x7f0000000580), 0x80000) readv(r0, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) getsockopt$rose(r1, 0x104, 0x7, &(0x7f0000000340), &(0x7f0000000380)=0x4) ioctl$TIOCSLCKTRMIOS(r1, 0x5457, &(0x7f00000003c0)) getsockopt$bt_l2cap_L2CAP_OPTIONS(r1, 0x6, 0x1, &(0x7f0000000280), &(0x7f0000000880)=0xcddf7fb85db89e58) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000440)='TIPCv2\x00') sendmsg$TIPC_NL_MON_GET(r1, &(0x7f0000000540)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x8200}, 0xc, &(0x7f0000000500)={&(0x7f0000000480)={0x6c, r2, 0x100, 0x70bd27, 0x25dfdbff, {}, [@TIPC_NLA_NET={0x2c, 0x7, [@TIPC_NLA_NET_ID={0x8, 0x1, 0x3fee}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x6}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x6}, @TIPC_NLA_NET_NODEID_W1={0xc}]}, @TIPC_NLA_NODE={0x1c, 0x6, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x6}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_NET={0x10, 0x7, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0xfff}]}]}, 0x6c}, 0x1, 0x0, 0x0, 0x40000}, 0x20008054) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r0, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) sendmsg$TIPC_NL_NODE_GET(r1, &(0x7f00000007c0)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000780)={&(0x7f0000000600)={0x124, r2, 0x21, 0x70bd2a, 0x25dfdbfe, {}, [@TIPC_NLA_BEARER={0x90, 0x1, [@TIPC_NLA_BEARER_NAME={0x18, 0x1, @l2={'eth', 0x3a, 'veth0_to_bond\x00'}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0xffff}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x14}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x2}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0x6, @dev={0xfe, 0x80, [], 0x19}, 0x7}}, {0x14, 0x2, @in={0x2, 0x4e23, @loopback}}}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0xffffffffffff0000}]}, @TIPC_NLA_SOCK={0x30, 0x2, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x9}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x5}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x9}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x6}]}, @TIPC_NLA_LINK={0x34, 0x4, [@TIPC_NLA_LINK_NAME={0x14, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_PROP={0x1c, 0x7, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x11}]}]}, @TIPC_NLA_NODE={0x1c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x1ff}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x4}]}]}, 0x124}, 0x1, 0x0, 0x0, 0x40}, 0x0) 02:24:22 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:22 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304, 0x7400000000000000}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:22 executing program 0: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) getsockopt$bt_hci(r0, 0x0, 0x3, &(0x7f0000000040)=""/117, &(0x7f00000000c0)=0x75) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x41, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getpgid(0xffffffffffffffff) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000044ff8)={0xffffffffffffffff, 0xffffffffffffffff}) bind$unix(r1, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) connect$unix(r1, &(0x7f00000bc000)=@abs, 0x8) setsockopt$sock_timeval(r2, 0x1, 0x15, &(0x7f0000000000)={0x0, 0x2710}, 0x10) connect$unix(r1, &(0x7f00003de000)=@file={0x1, './file0\x00'}, 0xa) connect$unix(r1, &(0x7f0000681000)=@abs, 0x8) [ 1252.024223][T17590] binder_transaction: 5 callbacks suppressed [ 1252.024236][T17590] binder: 17536:17590 got transaction to context manager from process owning it 02:24:22 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1252.129736][T11447] binder: undelivered TRANSACTION_ERROR: 29201 02:24:22 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304, 0x7a00000000000000}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:23 executing program 0: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) getsockopt$bt_hci(r0, 0x0, 0x3, &(0x7f0000000040)=""/117, &(0x7f00000000c0)=0x75) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x41, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getpgid(0xffffffffffffffff) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000044ff8)={0xffffffffffffffff, 0xffffffffffffffff}) bind$unix(r1, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) connect$unix(r1, &(0x7f00000bc000)=@abs, 0x8) sendmmsg$unix(r2, &(0x7f00000bd000), 0x80, 0x0) connect$unix(r1, &(0x7f00003de000)=@file={0x1, './file0\x00'}, 0xa) connect$unix(r1, &(0x7f0000681000)=@abs, 0x8) 02:24:23 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$FS_IOC_GETVERSION(r0, 0x80087601, &(0x7f0000000280)) r1 = syz_open_dev$vbi(&(0x7f00000004c0)='/dev/vbi#\x00', 0x0, 0x2) ioctl$KVM_SET_LAPIC(r1, 0x4400ae8f, &(0x7f0000000780)={"b0bb05f1013664e715aad05550c4d6ce94893ad521b4fef3e73c26f5e89335e28deea39aff788fc91872030780bf861ab5178105afb8e6cb700813da8c8b5bab3eb4f77c67c4817be2ac1f33ee01f84d8680ab772792bb58f54a256a534d322156bed6c6318fa530243b5b0f042f774675fb469ad68302aedf68fc09a165cc2b6b20cd31435ed708be0ccebbc1db46010550928a8e1f0ccc44f28b468bfaf934317c2e5d7cb620105c691874ef056189d0d1c7ffadf2a2ff8a009e81c9fe23b0b127e3c3bcfef638d3ceb0210ed7de0c65712246befef1a1b5de848b6e767717c30c783ab91b53d3794a1d3df9a3e0ac4cc770b91acff1f22964f89a91d717a3ae86832f5667965f2d9f8b335cb54c19d3ada940239aa6663726f3a126bdcbce3f603e8c7ec1496286fbc551c6decfb5b3fc6f0e05f1e2610766537c69a0dfaddadc9f57b980aec01fa620a34945b9b369598b84076a70bca02ba1af72b97224e1a1ef943f95844e3847af8e31e9bc15efa69cb3e0b2c1fb8957574ffe00917b43380a80199cc1083a0ad64a95b00b1d67aaa3caf71b514e0a31c7196104db53cef65605409342c3777b0e05636bed3e7b544a7d57ac81e1bda80994a8046bac460f8a81c25799a9e87adea133743e5181c659914972176e6e0c118c0cfceaf7184e7c4c64d19774c2c46d95328240d1db6c930ee95207b5b85dcfbaaaafeb6bf4a003259be50c89d683cf42dad79693f8359275f565966a4f4d190b0b2e79e96e73d4b1eb5b294e954cde7d658217d7f513b0ebac307c468e3afc93a1d4539a5e2560947714d4bd4866e60861abfdca2ca47f5c9cd03da6e193391de024d8696e6e4b8dba6c5185677181f273498806ad1b7610493e896b8a5e3c972166cc4a0492409c2b707bda6e8d5ed70e851b4793c53db938ff6832104ee463d5f05c49d15f270b8e799734fb2965b61a5a5262d4796e7d98fbeb380e9de66253958c44fd521b7c0cfddda61c19b70ec41f4ae1a88caa6004c4057911e5838007ff9fa9714ef89cef217bd57a3cc8d26853fdef47abd90b6c719edc674e0bf98f2cb7714e09c910c40a62631ed1d2bec00b39bc3dbc9fb1183de5968a75049941fd8847bbdbf94f73eb9e6939ff6f28e2e93bdf5a91b993afddfddf2d19d84cf3dd99dae36e4e6906ff04f590ac78f6378181a061cedf7a636806fe21410078e0794fac51afd4d6c332306a466cc796d32d3dab1618af6f2861d388ac5a12a7b03f18c767eca7f4d192a00f6750b00376f11c804674a1458e0ed18241c10ac877ee32f623321cf73ae7c088d931f12ea88fa3c5a35de32e75ff3638609cd8d7708c7e3304c40dad121c492480bd2b184c0fab7bea9a06fc2fcdf867fe7368b50f559b8e19b30dc3fdc6cc3f83e82f1930121d07541518efb8416f850742562ad744a6cb"}) getsockopt$sock_buf(r0, 0x1, 0x1f, &(0x7f0000000040)=""/43, &(0x7f0000000080)=0x2b) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r2 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) stat(&(0x7f0000000300)='./file0\x00', &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, 0x0}) quotactl(0x4, &(0x7f00000002c0)='./file0\x00', r3, &(0x7f00000003c0)="3e068c2a6e4e8c0ea5513b3f83fdc5d7f3760172bb4aa543000dccf10572b50423b7aa371c7a1ddff3444723ce4ef930cbc1ad4ba07b3315654bbc3fb8b9c3a9a706e9f0de03b2aa402ed01431ae85b61878353943dcebed12190ce90b2a1e129983210f8f11a713ca59c3a88795af99ec62e4e3849c6cb5488a47533cb5e1cb3d98e45a6b4a4045be7c54860cf1c50e2ed4ef20797fd8d1c49c559f2707ab388ea82e15b78ac45b590b26d44fac20b2bbfc2cb401ce4f0e75caa8726324680fe2dbe75f7fb5") write$USERIO_CMD_SET_PORT_TYPE(r2, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r2, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r2, &(0x7f0000000500)={0x7ffffffff000, 0xfffffe87, 0xfa00, {&(0x7f00000000c0)}}, 0x18) [ 1252.326306][T17755] binder: 17749:17755 got transaction to context manager from process owning it [ 1252.368419][T17769] IPVS: ftp: loaded support on port[0] = 21 02:24:23 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:23 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304, 0xfdfdffff00000000}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1252.577206][T17968] binder: 17918:17968 got transaction to context manager from process owning it [ 1252.618803][T17967] binder_alloc: 17918: binder_alloc_buf, no vma 02:24:23 executing program 5: r0 = open(&(0x7f0000000500)='./bus\x00', 0x141042, 0x0) close(r0) syz_open_dev$loop(&(0x7f0000000540)='/dev/loop#\x00', 0x0, 0x105082) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0x526987c9) read(r1, &(0x7f0000000200)=""/250, 0x215000) 02:24:23 executing program 1: unshare(0x40000000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000100)="0adc1f123c123f3188b070") r0 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$IPT_SO_GET_INFO(r0, 0x203000000000000, 0x40, &(0x7f0000000000)={'security\x00'}, &(0x7f0000000080)=0x54) getsockopt$IPT_SO_GET_INFO(r0, 0x0, 0x40, &(0x7f0000000140)={'raw\x00'}, &(0x7f00000000c0)=0x54) 02:24:23 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000300)='/proc/self/net/pfkey\x00', 0x400000, 0x0) sendmsg$nl_netfilter(r1, &(0x7f00000003c0)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000380)={&(0x7f0000000780)={0x106c, 0x0, 0x7, 0x322, 0x70bd28, 0x25dfdbfe, {0x2, 0x0, 0x4}, [@generic="5a9d80b86077d2c44c16ac1febc99bcb51b068d58ad7782ac7170edb17d854254ed82f4a64e451d8ca8b7ba6a608185a63cc1ae927ca6c7375b85e9b", @typed={0x14, 0x3d, @ipv6=@remote}, @generic="eeeb9e9bc7859da9e28f4c21f8932c4f7ad457eb9b88d482bd554d7e195aaf0e2b36316caaa866f55d4b773b2b9d2e53576d45c266f8dd8d684b05098c5bef667b21a7684f766aaf6cf8708429a67b45541a48158ae743b23ed9a704f1c26885e115931e9aed0839c3362a9a0d0c5f0d752841260d2bf8b395e91d38ad29c15705b15c633d60d4493e1df4cf22bc28ff07e24a8f0223ba0eaf943e3786a5fd7f118742421e72d38e251f272de0df2a31e0160cb745077c52878ac5d9d7bec822db3398b4dac3d68028885abc002b713ed87e7878c830de81add7cb55c3a2fa7c2a80de54294469dcc25a1cd3596aed4a85206c816161ee5bea9faae5c321090e6f7952eaf8e2d40de3a822ff912c0e2ae45d13ff6e4f31f7bc8a3f8c39c0fa19f76fa6e98cabf02533c0cb3e9b99a023b071c4403e2de928ff25c2656d21c0616f4ea72d83eed10e7f97f394ad52ff4c49aa96a79f87d607874468fd035caa3f53022d655eae6701dd5625b7b06dad028bdd44611601eb7ca279457f359b25131a382508f34cafe0e2ae193056b57ed770f5699ed3c368169f69f43876eea2c6b02181f9c5187b30621ef9bca2b96b96063244882e3e7efbf39fe253e460abf26f421ebe9e1319e569c0984529e0ccdc8f1df5230ee639210ca4ad279d5459481cf6e3c0cb88d47930b8a6ff0538e971f9633ced09e697ca43e4013fc0ceab523eff80dc733ee4dfe0c5ee21f20a03ed3338b5ac87789b3585b56d6e163e4bf9f47f2964b0d625bbcf34b406a3479c11f14b94f5c2bcf5540a849895ca173f472bc9cb270d581610f26b99381eccbc63f027161ebb240ae45d51ea748cc087ed38e7455d2c3c30b996d465619030ac2514aaedc9ee333124562bd53e11607cd839bd49ef097df648c719b4711d64ee7d8060fb8b00d0da182ce8b8a58c451bfaf8185eb8153d72d40f10ed1ddff134f7e1f9360ce109cab9090923ea7e0b3e4cab9950de75377841321e39ef5f446e211ab0682bea96c6afce87f8466feb38d28eec813384e230783e0174d0e4c654602b6786e5e38597830e6ff02da402b7faf93ba55b5fdc74bce96a11e11fea008c684bb7c5e4f0916b6aa59fc6dfba2dde20ccec90705ef9c3bde0726d9a877c24786cf8f1958e58d3939a8a77a99ec3c692d0a0be392c98b7af2657f100b761c568984a2c89fbb401af9d505c5a28db2cdd43120f019032ed8c7f517ba19bea6b4b4be7b4ad5e33ed43d6609f218a49a394bb947a74de5864e5226a71d8b1832c49fdfd881cf2a5f66d8a7e2292ddc55ecb278d7f7ad2df5aaf207d66f88b9265a48fbffd40ec45fa19770df17a8a3187f90f5f94ba480aa80f2fc0d3582b0dca2af0fa67e061b31abb789d6e8b8557885a40b95c789a76a95de7b74efbeec2a9c8f78a54f6ecf8cfe1323aeabe878c0481ad604cfe5eb6f9a1082b93e61099bd2c3dc4d499ded8685bcbbdf642cadc6fce860a55d9fdd5fa2b02ebc8a7ac97bdfc16effa77aa7f05686b070fc1f3d0981b5b2cc37a6907888c399990b09210bd29cfbda9a5d0f6dc9cb06617c0ac0a9fc5e974be6b6ddb95c69dbe42675d150e6492f09a889cc5b7a3faee67b9ec95deeb74af978ad3190321f7dd04e6bd9c3aef29b05637693262e97db8348817f9aff515250be13302986107c29dee4f41b685e24649a384b73dac99940a267f79ca4deaedeb3971a5dcce7fd89d2127af4631e7d84dc8ec6d61d3e56ed133d404478773df03e5d7a97b336fe9bbd27902d7e956ccba2c53b2a292168d439417e8bbc126b09f9268c108dfcf501adcf27e6dfeb7b94255c818bf03c4f3aa9e255c44577d1c3a0b121f0b8695bb1d3bb0ebf72037b2f4ec9faca38124495bb3df7e25a97d4974dda722bd07dc3becd51654fb00a241104911ec16f87c673e92688c09f9cf2a1d861a8cdf46ae928501c03872ea7cae59affcd8453a66649efd943c36da512360f8815f8397156789ee36110d4be3664425e3a7ad9dac6f86a2aa842f0b8fe7e983cf21e189406fb9ece9dc61474041ae069634b135b2631cc5ca7b1ff998f147d9d57243bcfd1535a611ebc515349e9a496d5ee8b22f1efa286aca4401c6614d2b215152843e564683b7004d4485fcfbf58acd1705b2927b9898d7ceff76d5468c0cad61c30f7c86ce267c8c4b8024f18bd762db7fedc1cba40d7a777d5d4c738b5f7128efc3984bd6acf0863451e4fc9bbf2cda83240446a293384637d9932b8f63490a8b387245497688461d33d24061d67604f041c7fa73611ad6a861ee3f6fff0a8e1e230f4d4e2b26b946bea4c4fb5f83e8ab04a4d450de2f07f9f4d2885684f70448262f0b4a9451394cca4c9a0b7787c8ee9f25297dbece2c6978a7e0ae2d6c33e6373c1f18b268adfec8388dba79abbd92ef572f65f789a14abcffac1ce12bfb4ff3f5cb7adad8e0b1e9327ae49f8d153eab64cf223bf0d639c5cc296e637080df8f3405b7c4a5b96db21d98b65d833ad03c72de5d7d67f6636a90dd2ff8222f1ec85081cbda4e5db045c078cb434959fb571aa30547f0c977386b5e6230b3315a588ae2f25454ac5e55aa1560f8c1450d5d95cb1fdaf377fa1455c9d4453a604a6cdfd6c0a56b219c0393c07e4105db21197c065c31324a6dcdd364a822de56d4415ba3edf2cf198e61a3430887bf0e5311ceae73ab707d3662f8afd61b6a097d6621e0843cd54f3face9be27032878289181e2eac8b9fab6963e29412e358ea42a8cfa3fd1bacfceaa88f1f19b4464b04d76cf88a5bb627d28e6bfa74659f26b247459ef9e69731ef915aea9f5266561b392f25fb711b332d54a2afb4422252ba535530533493bbaa00af20c15100e2c4e16d6af3cf3b048559ba068d83f0d7a3ff55fc73adeae36a419977363aa57e282e4154b47f948f6a28d9a4e3d870656108dc0b4f10d06fe15d3b5cbc01966617853b34dbd985572c0a3d536b14b458363a31982202838fdf6104b54a25c4013dce8786f98746a98714a20cc2ca3c8eb9e9f4b2dd8be7dca91bf5f3c0bfd5e43950c00b167694d76dbd52ea379b0aed2eb5da45a6331a5cf1a5f946f02f6ed2e81acc473bd820c29d2d77821710eb3b19bd6cb59730fd62e89d69f00b73225d06b24005c5aa86330bceaf8f0fc296288bf9bc4fbae5e022021ece11e2a2e04f710f8c5381fa66368f1826c32a0fa6f8c90bedc86b1f05d7d7e6f55a2820c11c550cfb212d460b2b46280b81f7848f745696e2e8918e9f27981e255191495d1fcd26e5b5650dc296b365135789e5ff94bd74d5fef2328ab32281d7139dc53c5b2bbdfb0fba4c747cbca3e41183b41f8f6957e0b78f37606078f595a33baec1b81f6420196e9178ba28ed43f4377d27a09635db453bdf624b059ea156416869e200541a5931da135b535ef2190ef3c58b6ce78ff550514c8a221f0362764bebe0b67b77d7e4ddb2cb925e434d9aa63405a0e586c6adfdf1e10bc9356ba274d2fcd2ea232fc8bbd7ca402ed7fc2de0e07662c0f12f22c7336c5d300f27faf0a7d74566d0f6f6b2c946519d1c2fd8834ab6b19f07c010d6fe50f52afaa705b1922000e73a9a540aca7f4bca8b083d711b03b514b0e83cca32e5c3d53725363ddf845bb38f6d3457a671a5f40899c730601f5712c5efac0c4fb2380e4fb2b9f04c0adddc9ad1601d65a807c5318b55c017e6be70ee4e444e082e7d5bc4b5629496d470c6b2d476ba4bf5ba32fc13273c7665a77550a3c75984e30bb2547a2edceb4fded78a8fb4d06ecc73ef33853eb1cddafaec5f696a0249f4a88ebbae2a9569ed10a81c5bcee5b868845f726e772aa4122af813a9da786d923c97038d636eb771d4386c705de49788f5adc5f825df038cd6c79cf0bbb09870e6361298ac03d519c732cc07a5c79ea119b01a36b305ddd68d1fac872a111fcafc5ae40c5f376622c18de643a831a98b7e7cad11b7f0fcbbdd7d9cd1db516db30cb5ca868b6fde11c6051a7692b30d3ea4635436f7dc665b8e18033a531479a8807415eb4ca78fe11ee36647da0242deca5ed179c250e91516cba505e065f54d8efd2f59bc16ec6cf3a9921b844f794e4688edcc49f208fd7b53af445305d1d403df949d5c744c339c9d2ac5b189f038482f19ee602e71a8c4a4d68cc23f83814e4b02d14a6b1ce988e5ec19b5ee7ef6a89ca04f623a14c334f15f9b933f46216e19f2ae0d38e2b3764b01823b4322867f708b3afa8b1f4da7bf7da85fb03fad17970407508fc113d0f110cedacf0bfbdfd85f119c718f41f157381c68e241c0b01d1290829ee69441f4f79164ececa2194f987eb2934d0708485484319a22b554b3d85f868aedcf96009d659da31bbdd1e4a1e8776bd640d2b7243d4dd62f5a6ea39b5f37afa3bbb26f0f09fd1c6adb359ca3ee7e876e317026b3772ec85347f9b505d72b5470f9fc41660900aad531180a056cdad72aa171a491cee5c7254d238dbe240a198664b10ab0e3abf97787d81c795bddcc93a346527cc6d1f14c384687d1c3eeac295f856f76369a37d79b567fd668a15251db5a77343067be0cec526d5202d4091e8589e7c5c655df34f0646a3d29da73ae9a38d6eec8dbc0362e48d3faba17e5caee25324f3278be7cb38c4b2c32c92e5abbf0305a8ac114c3b47a9b8679a6f65e9fea0db306f2114ad620228b99bb26a1018c659ec209c27f19491cdd0bed6a05213f74c8a278d91328631aac0e3e9a07c49722f159162623f1f3f47d5dec4c85ad73aecec9f4dc77391a88ea4e55057630db6ee6391b0cd7673619a90325d4aa3fbf567a5bb8d853d1b4a6d6bdd818105e679923315a7e5de1e6d29080dca8f8e0a69c2b2481e2f5d9b077c4a6007065047cb435040825a2080bfdf7b6035dbda286bcaa46c924d0069727f19424c7c1402b3a6566ac8f85669885d9928f8dcf5574ec82c87fd10c536540299c04ed0689d9293c28dc37b338dff90799ae26b74b2753ac9052dc087e4d52c26ad8999e9f82fbcf01720c3fbb0e8f2c66ade607e391ec5a0069301b6c512adaf8a3cbc9938139a946364842b8f012d088d2adea275c9de7da152c58fe99d457d786fca7bcd0bd1d1852a8762acf67220c8dffade8c5b7f1cc18221203da431619df7b8e76f4bbcb27ac469d37562d196ced4b99c835c2f05b1607bee0a6ce986b9662ebb28813eabbe5eb8da8859cf65d48b5d7a65f04feb0e4763c3fc698cb17fcb2e9cb97dac968faa14d648d4bc6fc45b42c27738bbe322062f0e7a4afec663d719f2dd93a33c91f2c6cc9cb9d0f1cf895c1bd918133760171c09d709de2a469aa3f40fa06bb688f951e2fd1136433a58b41c7849a1cd82253bf9b554954d56631da0d9da42a7e919f045ef62f26a11701e923ff093269494997963ad4f7cdc90fb1625ad61cb1ce662c6dd9a32daf01b251437b56ffff156b38b7132d4cbb0c814812fe3b56c3aa4b5a91c2948e7fcd51dadcff1fef95d6cf6c0275eba9fb3ae8abae292032b2e0ebd69c9f60ccbd103e1b6884b7b2cd48f71cbd69d1c6d4839e4d262dc4950a2d9510f80d73ca75c5ab842b3740b65384f903e0c3319b24f7408a6ed9505e14d71878202443f6b76472606d7a6694ce3571ea57fd678a2c01cbe4f78659b4d94ef7ca27015da3024ae7a15e844395fca1630e1170924ad73508f42946b4b28de46f53b760112ecf4d529ad5dd153b4d5b857ecea7a5c974a41a8fce7bc9ae14fdc45bbb894cff682313d460ba37faf3a371a59", @typed={0x8, 0x4, @str='\x00'}]}, 0x106c}, 0x1, 0x0, 0x0, 0x8010}, 0x40044) r2 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r2, &(0x7f0000000000)={0x1, 0x1}, 0x2) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) accept4$unix(r3, &(0x7f0000000280)=@abs, &(0x7f0000000080)=0x6e, 0x800) readv(r2, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r2, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) 02:24:23 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x48, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:23 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x630b, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1253.007557][T17985] IPVS: ftp: loaded support on port[0] = 21 [ 1253.053447][T18121] binder: 17979:18121 got transaction to context manager from process owning it 02:24:23 executing program 4: socket$inet_udplite(0x2, 0x2, 0x88) r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) syz_open_dev$audion(&(0x7f0000000080)='/dev/audio#\x00', 0xb9, 0x210200) r1 = creat(&(0x7f0000000040)='./file0\x00', 0x102) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffff9c, &(0x7f00000002c0)={0x0, 0x18, 0xfa00, {0xfffffffffffffffe, &(0x7f0000000280), 0x111, 0xf}}, 0x20) getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f0000000300)={{{@in=@empty, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@remote}, 0x0, @in=@multicast1}}, &(0x7f0000000140)=0xe8) r3 = getegid() write$FUSE_CREATE_OPEN(r1, &(0x7f0000000440)={0xa0, 0x0, 0x3, {{0x3, 0x3, 0x3f, 0x1, 0x3ff, 0x20, {0x6, 0xc0, 0x80000001, 0x6, 0x100000001, 0x0, 0x3, 0x21, 0x80, 0x9e7, 0x5, r2, r3, 0x3, 0x5}}, {0x0, 0x7}}}, 0xa0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r0, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) lstat(&(0x7f0000000500)='./file0\x00', &(0x7f0000000540)) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r0, &(0x7f0000000400)={0x7ffffffff000, 0x5, 0xfa00, {&(0x7f00000000c0)}}, 0xffffffffffffffec) 02:24:23 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x630c, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:23 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x4c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:24 executing program 0: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) getsockopt$bt_hci(r0, 0x0, 0x3, &(0x7f0000000040)=""/117, &(0x7f00000000c0)=0x75) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x41, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getpgid(0xffffffffffffffff) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000044ff8)={0xffffffffffffffff, 0xffffffffffffffff}) bind$unix(r1, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x80, 0x0) connect$unix(r1, &(0x7f00003de000)=@file={0x1, './file0\x00'}, 0xa) connect$unix(r1, &(0x7f0000681000)=@abs, 0x8) [ 1253.250562][T18195] binder: 18192:18195 unknown command 0 [ 1253.258844][T18195] binder: 18192:18195 ioctl c0306201 20000240 returned -22 [ 1253.283215][T18267] binder: 18194:18267 got transaction to context manager from process owning it 02:24:24 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x630d, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:24 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:24 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) fsetxattr(r0, &(0x7f00000000c0)=@known='trusted.overlay.origin\x00', &(0x7f0000000380)='\x00', 0x1, 0x3) write$USERIO_CMD_SET_PORT_TYPE(r1, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r1, &(0x7f00000004c0), 0x42) r2 = syz_open_dev$video4linux(&(0x7f0000000280)='/dev/v4l-subdev#\x00', 0x17, 0x115802) ioctl$VIDIOC_G_MODULATOR(r2, 0xc0445636, &(0x7f00000002c0)={0xc10c, "1d17a18b28464ec1fdec5499be6d4277b88a38c5a3caf6c40c36e36e28d9dd29", 0x40, 0x7fffffff, 0x5, 0x3, 0x5}) r3 = syz_open_dev$vbi(&(0x7f00000003c0)='/dev/vbi#\x00', 0x3, 0x2) r4 = syz_open_dev$media(&(0x7f0000000400)='/dev/media#\x00', 0x1f, 0x301000) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r4, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f0000000440)}}, 0x18) setsockopt$inet_sctp_SCTP_AUTO_ASCONF(r3, 0x84, 0x1e, &(0x7f0000000100)=0xfff, 0x4) r5 = fcntl$dupfd(r1, 0x0, r0) ioctl$VIDIOC_QUERYSTD(r5, 0x8008563f, &(0x7f0000000340)) connect$unix(r5, &(0x7f0000000040)=@abs={0x1, 0x0, 0x4e21}, 0x6e) [ 1253.475973][T18309] binder: 18303:18309 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1253.517434][T18309] binder: 18303:18309 unknown command 0 [ 1253.530356][T18312] binder: 18308:18312 got transaction to context manager from process owning it [ 1253.558448][T18309] binder: 18303:18309 ioctl c0306201 20000240 returned -22 02:24:24 executing program 5: r0 = open(&(0x7f0000000500)='./bus\x00', 0x141042, 0x0) close(r0) syz_open_dev$loop(&(0x7f0000000540)='/dev/loop#\x00', 0x0, 0x105082) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0x526987c9) read(r1, &(0x7f0000000200)=""/250, 0x216000) 02:24:24 executing program 1: unshare(0x40000000) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0adc1f123c123f3188b070") r1 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$IPT_SO_GET_INFO(r1, 0x203000000000000, 0x40, &(0x7f0000000000)={'security\x00'}, &(0x7f0000000080)=0x54) getsockopt$IPT_SO_GET_INFO(r1, 0x0, 0x40, &(0x7f0000000140)={'raw\x00'}, &(0x7f00000000c0)=0x54) 02:24:24 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x68, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:24 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40046302, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:24 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r1, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r1, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) ioctl$TIOCLINUX2(r1, 0x541c, &(0x7f0000000080)={0x2, 0xb1, 0x8, 0x3, 0x7f}) 02:24:24 executing program 0: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) getsockopt$bt_hci(r0, 0x0, 0x3, &(0x7f0000000040)=""/117, &(0x7f00000000c0)=0x75) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x41, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getpgid(0xffffffffffffffff) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000044ff8)={0xffffffffffffffff, 0xffffffffffffffff}) bind$unix(r1, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x80, 0x0) connect$unix(r1, &(0x7f00003de000)=@file={0x1, './file0\x00'}, 0xa) connect$unix(r1, &(0x7f0000681000)=@abs, 0x8) [ 1253.863298][T18424] binder: 18422:18424 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1253.887349][T18424] binder: BC_ACQUIRE_RESULT not supported [ 1253.904975][T18440] binder: 18427:18440 got transaction to context manager from process owning it [ 1253.909384][T18424] binder: 18422:18424 ioctl c0306201 20000240 returned -22 [ 1253.933335][T18432] IPVS: ftp: loaded support on port[0] = 21 02:24:24 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x6c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:24 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_inet_SIOCRTMSG(r0, 0x890d, &(0x7f00000002c0)={0x0, {0x2, 0x4e21, @multicast1}, {0x2, 0x4e24, @remote}, {0x2, 0x4e23, @loopback}, 0x8, 0x0, 0x0, 0x0, 0x7f, &(0x7f0000000280)='erspan0\x00', 0x8, 0x41, 0x6}) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r1, &(0x7f0000000000)={0x1, 0x1}, 0x2) r2 = syz_open_procfs(0x0, &(0x7f0000000040)='smaps\x00') ioctl$RTC_IRQP_READ(r2, 0x8008700b, &(0x7f0000000080)) readv(r1, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r1, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) 02:24:24 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40046304, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1254.070710][T18537] binder: 18536:18537 got transaction to context manager from process owning it 02:24:24 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x74, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:24 executing program 0: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) getsockopt$bt_hci(r0, 0x0, 0x3, &(0x7f0000000040)=""/117, &(0x7f00000000c0)=0x75) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x41, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getpgid(0xffffffffffffffff) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000044ff8)={0xffffffffffffffff, 0xffffffffffffffff}) bind$unix(r1, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x80, 0x0) connect$unix(r1, &(0x7f00003de000)=@file={0x1, './file0\x00'}, 0xa) connect$unix(r1, &(0x7f0000681000)=@abs, 0x8) [ 1254.248436][T18633] binder: 18626:18633 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1254.284731][T18647] binder: 18625:18647 got transaction to context manager from process owning it 02:24:25 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r1, &(0x7f0000000000)={0x1, 0x4}, 0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r1, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) fsetxattr$security_selinux(r1, &(0x7f0000000040)='security.selinux\x00', &(0x7f0000000080)='/usr/lib/telepathy/mission-control-5\x00', 0x25, 0x0) [ 1254.297230][T18633] binder: 18626:18633 unknown command 0 [ 1254.322253][T18633] binder: 18626:18633 ioctl c0306201 20000240 returned -22 02:24:25 executing program 5: r0 = open(&(0x7f0000000500)='./bus\x00', 0x141042, 0x0) close(r0) syz_open_dev$loop(&(0x7f0000000540)='/dev/loop#\x00', 0x0, 0x105082) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0x526987c9) read(r1, &(0x7f0000000200)=""/250, 0x217000) 02:24:25 executing program 1: unshare(0x40000000) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0adc1f123c123f3188b070") r1 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$IPT_SO_GET_INFO(r1, 0x203000000000000, 0x40, &(0x7f0000000000)={'security\x00'}, &(0x7f0000000080)=0x54) getsockopt$IPT_SO_GET_INFO(r1, 0x0, 0x40, &(0x7f0000000140)={'raw\x00'}, &(0x7f00000000c0)=0x54) 02:24:25 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x7a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:25 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40046307, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:25 executing program 0: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) getsockopt$bt_hci(r0, 0x0, 0x3, &(0x7f0000000040)=""/117, &(0x7f00000000c0)=0x75) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x41, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getpgid(0xffffffffffffffff) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000044ff8)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000bc000)=@abs, 0x8) sendmmsg$unix(r2, &(0x7f00000bd000), 0x80, 0x0) connect$unix(r1, &(0x7f00003de000)=@file={0x1, './file0\x00'}, 0xa) connect$unix(r1, &(0x7f0000681000)=@abs, 0x8) 02:24:25 executing program 4: openat$userio(0xffffffffffffff9c, &(0x7f0000000080)='/dev/userio\x00', 0x0, 0x0) r0 = perf_event_open$cgroup(&(0x7f0000000300)={0x1, 0x70, 0x5, 0x4, 0x1, 0x0, 0x0, 0xff, 0x10000, 0x2, 0x5, 0x3, 0x1, 0x0, 0x4, 0xe8000, 0x7, 0x1, 0x4dd, 0xe66f, 0x82, 0x74, 0xfffffffffffffff7, 0x1, 0x3, 0x3, 0x2, 0x1, 0xbf0b, 0xfffffffffffffff8, 0x3, 0x8, 0xd6f, 0xea0, 0x8, 0xaf6, 0x7d8d, 0x2, 0x0, 0x1ff, 0x2, @perf_bp={&(0x7f00000002c0), 0x1}, 0x1410, 0xffffffffffffff00, 0x5, 0x3, 0xffffffffffff7fff, 0xeea, 0x10e5}, 0xffffffffffffff9c, 0x5, 0xffffffffffffffff, 0x8) r1 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000480)='/dev/dlm-control\x00', 0x1c1000, 0x0) ioctl$KDSKBMODE(r1, 0x4b45, &(0x7f00000004c0)=0x10000) ioctl(r0, 0x1000008912, &(0x7f00000003c0)="0adc1f313c123f3096e46e5629ec769a32894cd1a603003188b070") r2 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) bpf$OBJ_GET_PROG(0x7, &(0x7f0000000440)={&(0x7f0000000400)='./file0\x00', 0x0, 0x10}, 0x10) write$USERIO_CMD_SET_PORT_TYPE(r2, &(0x7f0000000000), 0x2) readv(r2, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r2, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) lsetxattr$trusted_overlay_redirect(&(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='trusted.overlay.redirect\x00', &(0x7f0000000380)='./file0\x00', 0x8, 0x3) ioctl$void(r0, 0x0) [ 1254.693847][T18764] binder: 18762:18764 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1254.710872][T18766] IPVS: ftp: loaded support on port[0] = 21 [ 1254.736781][T18770] binder: 18760:18770 got transaction to context manager from process owning it [ 1254.764556][T18764] binder: 18762:18764 DecRefs 0 refcount change on invalid ref 0 ret -22 02:24:25 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x300, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1254.806664][T18764] binder: 18762:18764 unknown command 0 [ 1254.834309][T18764] binder: 18762:18764 ioctl c0306201 20000240 returned -22 02:24:25 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) r2 = syz_open_dev$mice(&(0x7f0000000040)='/dev/input/mice\x00', 0x0, 0x2000) ioctl$KVM_HAS_DEVICE_ATTR(r2, 0x4018aee3, &(0x7f0000000280)={0x0, 0x5, 0x2, &(0x7f0000000080)}) write$USERIO_CMD_SET_PORT_TYPE(r1, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0x272}], 0x1000000000000223) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r1, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) 02:24:25 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40086303, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:25 executing program 1: unshare(0x40000000) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0adc1f123c123f3188b070") r1 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$IPT_SO_GET_INFO(r1, 0x203000000000000, 0x40, &(0x7f0000000000)={'security\x00'}, &(0x7f0000000080)=0x54) getsockopt$IPT_SO_GET_INFO(r1, 0x0, 0x40, &(0x7f0000000140)={'raw\x00'}, &(0x7f00000000c0)=0x54) [ 1254.974951][T18880] binder_transaction: 11 callbacks suppressed [ 1254.974969][T18880] binder: 18877:18880 transaction failed 29201/-22, size 0-0 line 2986 02:24:25 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x500, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1255.046444][T18901] binder: 18882:18901 BC_FREE_BUFFER u0000000000000000 no match [ 1255.071256][T18901] binder: 18882:18901 unknown command 0 02:24:25 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r1, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r1, &(0x7f0000000100), 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r1, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) [ 1255.128664][T18901] binder: 18882:18901 ioctl c0306201 20000240 returned -22 [ 1255.137166][T18988] IPVS: ftp: loaded support on port[0] = 21 [ 1255.157574][T18990] binder: 18989:18990 transaction failed 29201/-22, size 0-0 line 2986 [ 1255.237057][T18307] binder_release_work: 11 callbacks suppressed [ 1255.237065][T18307] binder: undelivered TRANSACTION_ERROR: 29201 02:24:26 executing program 5: r0 = open(&(0x7f0000000500)='./bus\x00', 0x141042, 0x0) close(r0) syz_open_dev$loop(&(0x7f0000000540)='/dev/loop#\x00', 0x0, 0x105082) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0x526987c9) read(r1, &(0x7f0000000200)=""/250, 0x218000) 02:24:26 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x4008630a, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:26 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x600, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:26 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r1, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_JOIN_MCAST(r1, &(0x7f0000000280)={0x16, 0x98, 0xfa00, {&(0x7f0000000040)={0xffffffffffffffff}, 0x4, 0xffffffffffffffff, 0x10, 0x0, @in6={0xa, 0x4e21, 0x5, @empty, 0x7f00000}}}, 0xa0) r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000080)='cpuacct.usage_all\x00', 0x0, 0x0) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r3, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0), r2}}, 0x18) [ 1255.682518][T19104] binder: 19102:19104 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1255.693533][T19103] binder: 19100:19103 transaction failed 29201/-22, size 0-0 line 2986 02:24:26 executing program 0: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) getsockopt$bt_hci(r0, 0x0, 0x3, &(0x7f0000000040)=""/117, &(0x7f00000000c0)=0x75) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x41, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getpgid(0xffffffffffffffff) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000044ff8)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000bc000)=@abs, 0x8) sendmmsg$unix(r2, &(0x7f00000bd000), 0x80, 0x0) connect$unix(r1, &(0x7f00003de000)=@file={0x1, './file0\x00'}, 0xa) connect$unix(r1, &(0x7f0000681000)=@abs, 0x8) 02:24:26 executing program 1: mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0adc1f123c123f3188b070") r1 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$IPT_SO_GET_INFO(r1, 0x203000000000000, 0x40, &(0x7f0000000000)={'security\x00'}, &(0x7f0000000080)=0x54) getsockopt$IPT_SO_GET_INFO(r1, 0x0, 0x40, &(0x7f0000000140)={'raw\x00'}, &(0x7f00000000c0)=0x54) [ 1255.733361][T19104] binder: BC_ATTEMPT_ACQUIRE not supported [ 1255.778244][T19104] binder: 19102:19104 ioctl c0306201 20000240 returned -22 02:24:26 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x700, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:26 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") userfaultfd(0x800) r1 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r1, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r1, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) [ 1255.837052][T11447] binder: undelivered TRANSACTION_ERROR: 29201 02:24:26 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40086310, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1255.973286][T19230] binder: 19218:19230 transaction failed 29201/-22, size 0-0 line 2986 02:24:26 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") fgetxattr(r0, &(0x7f0000000040)=@known='trusted.overlay.impure\x00', &(0x7f0000000080)=""/57, 0x39) r1 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r1, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r1, &(0x7f00000005c0), 0x0) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r1, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) [ 1256.019740][T19318] binder: 19250:19318 BC_DEAD_BINDER_DONE 0000000000000000 not found 02:24:26 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0xa00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1256.078340][T19318] binder: 19250:19318 unknown command 0 [ 1256.082865][T11447] binder: undelivered TRANSACTION_ERROR: 29201 [ 1256.123209][T19318] binder: 19250:19318 ioctl c0306201 20000240 returned -22 02:24:26 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x400c630e, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1256.167277][T19338] binder: 19326:19338 transaction failed 29201/-22, size 0-0 line 2986 [ 1256.271599][T11447] binder: undelivered TRANSACTION_ERROR: 29201 [ 1256.319118][T19432] binder: 19431:19432 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1256.361307][T19432] binder: 19431:19432 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 1256.390324][T19432] binder: 19431:19432 unknown command 0 [ 1256.411149][T19432] binder: 19431:19432 ioctl c0306201 20000240 returned -22 02:24:27 executing program 5: r0 = open(&(0x7f0000000500)='./bus\x00', 0x141042, 0x0) close(r0) syz_open_dev$loop(&(0x7f0000000540)='/dev/loop#\x00', 0x0, 0x105082) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0x526987c9) read(r1, &(0x7f0000000200)=""/250, 0x219000) 02:24:27 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:27 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = syz_open_dev$sndpcmc(&(0x7f0000000300)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000380)={r1, 0x28, &(0x7f0000000340)}, 0x10) r2 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r2, &(0x7f0000000000)={0x1, 0x1}, 0x2) accept$inet(r0, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) readv(r2, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) r3 = syz_open_dev$midi(&(0x7f0000000280)='/dev/midi#\x00', 0x1, 0x8000) setsockopt$netrom_NETROM_T4(r3, 0x103, 0x6, &(0x7f00000002c0)=0xfe1, 0x4) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r2, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) 02:24:27 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x400c630f, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1256.634543][T19440] binder: 19439:19440 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1256.657641][T19442] binder: 19438:19442 transaction failed 29201/-22, size 0-0 line 2986 [ 1256.703705][T19440] binder: 19439:19440 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 1256.744164][T19440] binder: 19439:19440 unknown command 0 [ 1256.759032][T19440] binder: 19439:19440 ioctl c0306201 20000240 returned -22 [ 1256.783016][T11447] binder: undelivered TRANSACTION_ERROR: 29201 02:24:27 executing program 0: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) getsockopt$bt_hci(r0, 0x0, 0x3, &(0x7f0000000040)=""/117, &(0x7f00000000c0)=0x75) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x41, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getpgid(0xffffffffffffffff) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000044ff8)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000bc000)=@abs, 0x8) sendmmsg$unix(r2, &(0x7f00000bd000), 0x80, 0x0) connect$unix(r1, &(0x7f00003de000)=@file={0x1, './file0\x00'}, 0xa) connect$unix(r1, &(0x7f0000681000)=@abs, 0x8) 02:24:27 executing program 1: mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0adc1f123c123f3188b070") r1 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$IPT_SO_GET_INFO(r1, 0x203000000000000, 0x40, &(0x7f0000000000)={'security\x00'}, &(0x7f0000000080)=0x54) getsockopt$IPT_SO_GET_INFO(r1, 0x0, 0x40, &(0x7f0000000140)={'raw\x00'}, &(0x7f00000000c0)=0x54) 02:24:27 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x3f00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:27 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r1, &(0x7f0000000000)={0x1, 0x1}, 0x2) r2 = openat$audio(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/audio\x00', 0x200000, 0x0) getpeername$inet6(r2, &(0x7f0000000500)={0xa, 0x0, 0x0, @loopback}, &(0x7f0000000540)=0x1c) ioctl$sock_ifreq(r2, 0x897a, &(0x7f0000000280)={'veth1\x00', @ifru_addrs=@nfc={0x27, 0x1, 0x0, 0x6}}) readv(r1, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r1, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) fsetxattr$security_selinux(r2, &(0x7f0000000040)='security.selinux\x00', &(0x7f0000000080)='system_u:object_r:ssh_agent_exec_t:s0\x00', 0x26, 0x2) 02:24:27 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40106308, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1256.899076][T19554] binder: 19549:19554 transaction failed 29201/-22, size 0-0 line 2986 02:24:27 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x4800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1256.997604][T19571] binder: 19559:19571 BC_INCREFS_DONE u0000000000000000 no match [ 1257.034225][T18307] binder: undelivered TRANSACTION_ERROR: 29201 [ 1257.051216][T19571] binder: 19559:19571 unknown command 0 [ 1257.057359][T19571] binder: 19559:19571 ioctl c0306201 20000240 returned -22 02:24:27 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40106309, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:27 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = openat$userio(0xffffffffffffff9c, &(0x7f0000000300)='/dev/userio\x00', 0x7fc, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r1, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r1, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) [ 1257.149203][T19665] binder_transaction: 7 callbacks suppressed [ 1257.149215][T19665] binder: 19664:19665 got transaction to context manager from process owning it [ 1257.210948][T19665] binder: 19664:19665 transaction failed 29201/-22, size 0-0 line 2986 [ 1257.265717][T19669] binder: 19667:19669 BC_ACQUIRE_DONE u0000000000000000 no match [ 1257.291665][T11447] binder: undelivered TRANSACTION_ERROR: 29201 [ 1257.298498][T19669] binder: 19667:19669 unknown command 0 [ 1257.320901][T19669] binder: 19667:19669 ioctl c0306201 20000240 returned -22 02:24:28 executing program 5: r0 = open(&(0x7f0000000500)='./bus\x00', 0x141042, 0x0) close(r0) syz_open_dev$loop(&(0x7f0000000540)='/dev/loop#\x00', 0x0, 0x105082) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0x526987c9) read(r1, &(0x7f0000000200)=""/250, 0x21a000) 02:24:28 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x4c00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:28 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40406300, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:28 executing program 4: lookup_dcookie(0x1000, &(0x7f0000000040)=""/110, 0x6e) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r1, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r0, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r1, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) [ 1257.660864][T19777] binder: 19776:19777 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1257.692010][T19782] binder: 19780:19782 got transaction to context manager from process owning it [ 1257.708908][T19777] binder_alloc: 19780: binder_alloc_buf, no vma [ 1257.724672][T19782] binder: 19780:19782 transaction failed 29201/-22, size 0-0 line 2986 [ 1257.731330][T19777] binder: 19776:19777 transaction failed 29189/-3, size 0-0 line 3148 [ 1257.824174][T11447] binder: undelivered TRANSACTION_ERROR: 29201 [ 1257.831685][T11447] binder: undelivered TRANSACTION_ERROR: 29189 02:24:28 executing program 0: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) getsockopt$bt_hci(r0, 0x0, 0x3, &(0x7f0000000040)=""/117, &(0x7f00000000c0)=0x75) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x41, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getpgid(0xffffffffffffffff) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x0, 0x0) bind$unix(0xffffffffffffffff, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) connect$unix(0xffffffffffffffff, &(0x7f00000bc000)=@abs, 0x8) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x80, 0x0) connect$unix(0xffffffffffffffff, &(0x7f00003de000)=@file={0x1, './file0\x00'}, 0xa) connect$unix(0xffffffffffffffff, &(0x7f0000681000)=@abs, 0x8) 02:24:28 executing program 1: mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0adc1f123c123f3188b070") r1 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$IPT_SO_GET_INFO(r1, 0x203000000000000, 0x40, &(0x7f0000000000)={'security\x00'}, &(0x7f0000000080)=0x54) getsockopt$IPT_SO_GET_INFO(r1, 0x0, 0x40, &(0x7f0000000140)={'raw\x00'}, &(0x7f00000000c0)=0x54) 02:24:28 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40406301, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:28 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x6000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:28 executing program 4: openat$userio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/userio\x00', 0x400000, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r1, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r1, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) [ 1257.953368][T19895] binder: 19890:19895 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1257.982087][T19896] binder: 19891:19896 got transaction to context manager from process owning it [ 1258.008058][T19895] binder: 19890:19895 got reply transaction with no transaction stack 02:24:28 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x6800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1258.076151][T11447] binder: undelivered TRANSACTION_ERROR: 29201 02:24:28 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b078") r1 = openat$userio(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/userio\x00', 0x8085, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r1, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) setsockopt$inet_MCAST_MSFILTER(r0, 0x0, 0x30, &(0x7f0000000380)={0x7ff, {{0x2, 0x4e22, @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x0, 0x1, [{{0x2, 0x4e20, @multicast1}}]}, 0x110) r2 = openat$dlm_control(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/dlm-control\x00', 0x80, 0x0) ioctl$BLKFRASET(r2, 0x1264, &(0x7f0000000140)=0x4) r3 = openat(0xffffffffffffffff, &(0x7f0000000080)='./file0\x00', 0x20002, 0x8) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r3, &(0x7f0000000280)={0x7ffffffff000, 0x23b, 0xfa00, {&(0x7f0000000340)}}, 0x18) ioctl$SG_SET_KEEP_ORPHAN(r3, 0x2287, &(0x7f0000000300)=0x2) 02:24:28 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486309, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1258.168046][T20005] binder: 20004:20005 got transaction to context manager from process owning it [ 1258.266897][T20030] binder: 20009:20030 unknown command 1078485769 [ 1258.291139][T20030] binder: 20009:20030 ioctl c0306201 20000240 returned -22 02:24:29 executing program 5: r0 = open(&(0x7f0000000500)='./bus\x00', 0x141042, 0x0) close(r0) syz_open_dev$loop(&(0x7f0000000540)='/dev/loop#\x00', 0x0, 0x105082) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0x526987c9) read(r1, &(0x7f0000000200)=""/250, 0x21b000) 02:24:29 executing program 0: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) getsockopt$bt_hci(r0, 0x0, 0x3, &(0x7f0000000040)=""/117, &(0x7f00000000c0)=0x75) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x41, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getpgid(0xffffffffffffffff) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x0, 0x0) bind$unix(0xffffffffffffffff, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) connect$unix(0xffffffffffffffff, &(0x7f00000bc000)=@abs, 0x8) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x80, 0x0) connect$unix(0xffffffffffffffff, &(0x7f00003de000)=@file={0x1, './file0\x00'}, 0xa) connect$unix(0xffffffffffffffff, &(0x7f0000681000)=@abs, 0x8) 02:24:29 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x6c00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:29 executing program 4: r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000040)='/dev/btrfs-control\x00', 0x10100, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000080)={0x1, 0x23}, 0x2) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r2 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r2, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r2, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) r3 = request_key(&(0x7f00000003c0)='dns_resolver\x00', &(0x7f0000000400)={'syz', 0x1}, &(0x7f0000000440)='\\@security{system,em0.eth0*bdev]ppp0\x00', 0xfffffffffffffff9) r4 = add_key(&(0x7f0000000480)='rxrpc_s\x00', &(0x7f00000004c0)={'syz', 0x0}, &(0x7f0000000500)="b8fb3ff5be5d47bdbc73f386e6b40628854f1eda17a61d359d613257b100dcf403eb5370afc375d8329daf5cdabcaa76c3d816491bd2607cb9e32c2bf3784888b9dc33a42e6ce459062b1e15a05188348a4c937160299154cac11b26a06848d538520d5723899d2575eb95b2c8ada733c0eb5687fb3af3f33574b647bef6e19530e5ac", 0x83, 0xffffffffffffffff) r5 = add_key(&(0x7f00000005c0)='trusted\x00', &(0x7f0000000600)={'syz', 0x1}, &(0x7f0000000640)="ef9093e8ee4bf0ab04ba2c364e53ecbf268622abf0a6a0e2545d77c0f185f08662f14193970750cb586653547e2f4373b57bc7a87feee022576b8354e1e16b14d596b1d99ea79e27937b4c5db89d2880a43ecd33b3fbc4d65ea5e17bb5de5f5e412a43a85aede36b340861148c67de8f60d41c0f13576cc929c12340d979ecaf1d87e8ff5e2a9ffe8808d76e01640b4f3a040a22e6f67001cebdf13d9ea32afb5e34bb3e009ff6d5a58ce3ac82c29966e9c5cf424582928701cd296eeab9b977f56bfe9bcb5db4", 0xc7, 0x0) keyctl$dh_compute(0x17, &(0x7f0000000780)={r3, r4, r5}, &(0x7f00000007c0)=""/168, 0xa8, &(0x7f00000009c0)={&(0x7f0000000880)={'sha256-ssse3\x00'}, &(0x7f00000008c0)="ffc6b07f2a4a5ba86504df7653b47cdd03bbd7769b500b5e40973587f2a4bc52b1e87e0408b7ab2b3448a801cb9c5bef91394afffad2b07706b3458aa2f0c37a54ccc0719b242f1fa0d7617c27313adfcb999733413688f02ef202efe9305093049ddc44aedac65bc755a3020682498d1d0d6fde4f44d8eeec6bbab34fc75cfb133fe76dab2067b3f06bce8686704651110ca930c8a69d16af49add7122da601f6b8c0b3a20faf40733d8facf662cd88015b9682757bb723a953573c4c456a3c91370b9ebbd686633807", 0xca}) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r0, 0x84, 0x1f, &(0x7f0000000280)={0x0, @in6={{0xa, 0x4e22, 0x7, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x584}}, 0xffffffffffffff80, 0x1f}, &(0x7f0000000340)=0x90) setsockopt$inet_sctp_SCTP_AUTH_DELETE_KEY(r0, 0x84, 0x19, &(0x7f0000000380)={r6}, 0x8) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r2, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) 02:24:29 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:29 executing program 1: unshare(0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0adc1f123c123f3188b070") r1 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$IPT_SO_GET_INFO(r1, 0x203000000000000, 0x40, &(0x7f0000000000)={'security\x00'}, &(0x7f0000000080)=0x54) getsockopt$IPT_SO_GET_INFO(r1, 0x0, 0x40, &(0x7f0000000140)={'raw\x00'}, &(0x7f00000000c0)=0x54) [ 1258.613376][T20124] binder: 20117:20124 got transaction to context manager from process owning it [ 1258.640549][T20120] binder: 20119:20120 got reply transaction with no transaction stack 02:24:29 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x7400, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:29 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x4048635a, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:29 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r1, &(0x7f0000000000)={0x1, 0x1}, 0x2) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000600)='/dev/dlm-control\x00', 0x901, 0x0) ioctl$PPPIOCGDEBUG(r3, 0x80047441, &(0x7f0000000640)) r4 = socket$rds(0x15, 0x5, 0x0) shmget(0x2, 0x11000, 0x280, &(0x7f0000fef000/0x11000)=nil) r5 = fcntl$dupfd(r2, 0x0, 0xffffffffffffffff) bind$rds(r4, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10) r6 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x406c0, 0x0) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f00000002c0)={r5, 0x28, &(0x7f0000000280)={0x0, 0x0}}, 0x10) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000300)={r7, 0x8, 0x10}, 0xc) clone(0x2102001ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) sendmsg$rds(r4, &(0x7f00000001c0)={&(0x7f0000000000)={0x2, 0x0, @local}, 0x10, 0x0, 0x0, &(0x7f00000002c0)}, 0x0) syz_open_dev$swradio(&(0x7f0000000700)='/dev/swradio#\x00', 0x1, 0x2) ioctl$SIOCX25SCAUSEDIAG(r6, 0x89ec, &(0x7f0000000180)={0xfff, 0x1}) setsockopt$RDS_GET_MR_FOR_DEST(0xffffffffffffffff, 0x114, 0x7, 0x0, 0x0) ioctl$sock_bt_cmtp_CMTPGETCONNLIST(0xffffffffffffffff, 0x800443d2, 0x0) r8 = fcntl$getown(r2, 0x9) getsockopt$inet6_IPV6_XFRM_POLICY(r5, 0x29, 0x23, &(0x7f00000003c0)={{{@in=@remote, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast2}, 0x0, @in6=@mcast2}}, &(0x7f00000004c0)=0xe8) getgroups(0x2, &(0x7f0000000500)=[0x0, 0xee00]) write$P9_RGETATTR(r5, &(0x7f0000000540)={0xa0, 0x19, 0x2, {0x0, {0x8, 0x2, 0x7}, 0x100, r9, r10, 0x3, 0x1000, 0x40, 0x80, 0x3, 0xfffffffffffffffe, 0x6, 0x6, 0x20, 0x0, 0x1, 0x80000000, 0x429c, 0x80000000, 0x3f}}, 0xa0) getpgrp(r8) close(0xffffffffffffffff) readv(r1, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) setsockopt$inet6_MRT6_DEL_MFC(r6, 0x29, 0xcd, &(0x7f0000000340)={{0xa, 0x4e23, 0x81, @loopback, 0x81}, {0xa, 0x4e24, 0x7, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x2}, 0xb94, [0x200, 0x1, 0x0, 0x100000000, 0x6, 0x3f, 0x1433, 0x4]}, 0x5c) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r1, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) fsetxattr$security_evm(r5, &(0x7f0000000680)='security.evm\x00', &(0x7f00000006c0)=@md5={0x1, "ebd66d74db88416dc7e50ee6fb496a8a"}, 0x11, 0x3) 02:24:29 executing program 0: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) getsockopt$bt_hci(r0, 0x0, 0x3, &(0x7f0000000040)=""/117, &(0x7f00000000c0)=0x75) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x41, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getpgid(0xffffffffffffffff) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x0, 0x0) bind$unix(0xffffffffffffffff, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) connect$unix(0xffffffffffffffff, &(0x7f00000bc000)=@abs, 0x8) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x80, 0x0) connect$unix(0xffffffffffffffff, &(0x7f00003de000)=@file={0x1, './file0\x00'}, 0xa) connect$unix(0xffffffffffffffff, &(0x7f0000681000)=@abs, 0x8) [ 1258.858277][T20236] binder: 20234:20236 got transaction to context manager from process owning it [ 1258.892802][T20238] binder: 20237:20238 unknown command 1078485850 02:24:29 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x7a00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1258.933265][T20238] binder: 20237:20238 ioctl c0306201 20000240 returned -22 02:24:29 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x4048635c, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1259.070252][T20247] binder: 20245:20247 got transaction to context manager from process owning it [ 1259.165679][T20338] binder: 20301:20338 unknown command 1078485852 [ 1259.211495][T20338] binder: 20301:20338 ioctl c0306201 20000240 returned -22 02:24:30 executing program 5: r0 = open(&(0x7f0000000500)='./bus\x00', 0x141042, 0x0) close(r0) syz_open_dev$loop(&(0x7f0000000540)='/dev/loop#\x00', 0x0, 0x105082) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0x526987c9) read(r1, &(0x7f0000000200)=""/250, 0x21c000) 02:24:30 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x1000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:30 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r1, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) set_tid_address(&(0x7f0000000040)) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r1, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) 02:24:30 executing program 0: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) getsockopt$bt_hci(r0, 0x0, 0x3, &(0x7f0000000040)=""/117, &(0x7f00000000c0)=0x75) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x41, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getpgid(0xffffffffffffffff) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000044ff8)={0xffffffffffffffff, 0xffffffffffffffff}) bind$unix(r1, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) connect$unix(r1, &(0x7f00000bc000)=@abs, 0x8) sendmmsg$unix(r2, &(0x7f00000bd000), 0x80, 0x0) connect$unix(r1, &(0x7f00003de000)=@file={0x1, './file0\x00'}, 0xa) connect$unix(r1, &(0x7f0000681000)=@abs, 0x8) 02:24:30 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486363, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:30 executing program 1: unshare(0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0adc1f123c123f3188b070") r1 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$IPT_SO_GET_INFO(r1, 0x203000000000000, 0x40, &(0x7f0000000000)={'security\x00'}, &(0x7f0000000080)=0x54) getsockopt$IPT_SO_GET_INFO(r1, 0x0, 0x40, &(0x7f0000000140)={'raw\x00'}, &(0x7f00000000c0)=0x54) [ 1259.639543][T20368] binder: 20365:20368 unknown command 1078485859 [ 1259.647902][T20371] binder: 20359:20371 got transaction to context manager from process owning it 02:24:30 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) socket$tipc(0x1e, 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r1, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r1, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) [ 1259.690537][T20368] binder: 20365:20368 ioctl c0306201 20000240 returned -22 02:24:30 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:30 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1259.872986][T20493] binder: 20481:20493 got transaction to context manager from process owning it 02:24:30 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x3000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:30 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") getsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000000040), &(0x7f0000000080)=0x4) r1 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r1, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r1, &(0x7f00000005c0)=[{&(0x7f00000003c0)=""/37}, {&(0x7f0000000600)=""/155}, {&(0x7f00000004c0)=""/240}], 0x370) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r1, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) [ 1259.914454][T20534] binder_transaction: 2 callbacks suppressed [ 1259.914464][T20534] binder: 20498:20534 got transaction to invalid handle 02:24:30 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1260.092189][T20598] binder: 20588:20598 got transaction to context manager from process owning it [ 1260.115726][T20659] binder: 20607:20659 got transaction to invalid handle [ 1260.137208][T20659] binder_transaction: 10 callbacks suppressed [ 1260.137329][T20659] binder: 20607:20659 transaction failed 29201/-22, size 0-0 line 2995 [ 1260.170199][T20598] binder: 20588:20598 transaction failed 29201/-22, size 0-0 line 2986 [ 1260.276868][T11447] binder_release_work: 10 callbacks suppressed [ 1260.276876][T11447] binder: undelivered TRANSACTION_ERROR: 29201 02:24:31 executing program 5: r0 = open(&(0x7f0000000500)='./bus\x00', 0x141042, 0x0) close(r0) syz_open_dev$loop(&(0x7f0000000540)='/dev/loop#\x00', 0x0, 0x105082) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0x526987c9) read(r1, &(0x7f0000000200)=""/250, 0x21d000) 02:24:31 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x8001, &(0x7f0000000280)="bddb1f123c123f3188b070") write$USERIO_CMD_SET_PORT_TYPE(0xffffffffffffffff, &(0x7f0000000000)={0x1, 0x200000001}, 0x2) r1 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000380)='/dev/dlm_plock\x00', 0x11fa00, 0x0) write$FUSE_POLL(r1, &(0x7f0000000580)={0x18, 0xfffffffffffffffe, 0x2, {0xfffffffffffffffc}}, 0x18) ioctl$IMCTRLREQ(r1, 0x80044945, &(0x7f0000000080)={0x0, 0x5, 0x100000000, 0x2}) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f00000002c0)='TIPCv2\x00') sendmsg$TIPC_NL_MEDIA_GET(r1, &(0x7f0000000540)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0xa002000}, 0xc, &(0x7f0000000500)={&(0x7f0000000300)=ANY=[@ANYBLOB='\x00\x00\x00\x00', @ANYRES16=r2, @ANYRES32=r2], 0x3}, 0x1, 0x0, 0x0, 0x5}, 0x80) readv(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(0xffffffffffffffff, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) 02:24:31 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:31 executing program 0: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) getsockopt$bt_hci(r0, 0x0, 0x3, &(0x7f0000000040)=""/117, &(0x7f00000000c0)=0x75) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x41, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getpgid(0xffffffffffffffff) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000044ff8)={0xffffffffffffffff, 0xffffffffffffffff}) bind$unix(r1, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) connect$unix(r1, &(0x7f00000bc000)=@abs, 0x8) sendmmsg$unix(r2, &(0x7f00000bd000), 0x80, 0x0) connect$unix(r1, &(0x7f00003de000)=@file={0x1, './file0\x00'}, 0xa) connect$unix(r1, &(0x7f0000681000)=@abs, 0x8) 02:24:31 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x4000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:31 executing program 1: unshare(0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0adc1f123c123f3188b070") r1 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$IPT_SO_GET_INFO(r1, 0x203000000000000, 0x40, &(0x7f0000000000)={'security\x00'}, &(0x7f0000000080)=0x54) getsockopt$IPT_SO_GET_INFO(r1, 0x0, 0x40, &(0x7f0000000140)={'raw\x00'}, &(0x7f00000000c0)=0x54) [ 1260.592113][T20701] binder: 20699:20701 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1260.626545][T20701] binder: 20699:20701 got transaction to invalid handle [ 1260.650473][T20701] binder: 20699:20701 transaction failed 29201/-22, size 0-0 line 2995 [ 1260.650523][T20744] binder: 20707:20744 transaction failed 29201/-22, size 0-0 line 2986 02:24:31 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x2, &(0x7f0000000080)="ef9697c8961b1d1b02000000000000003f3188b070") io_setup(0x89, &(0x7f0000000040)=0x0) io_destroy(r1) r2 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r2, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r2, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) sigaltstack(&(0x7f0000ffc000/0x1000)=nil, 0x0) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r2, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) munlock(&(0x7f0000ffc000/0x2000)=nil, 0x2000) socket$nl_generic(0x10, 0x3, 0x10) 02:24:31 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1260.758298][T18307] binder: undelivered TRANSACTION_ERROR: 29201 02:24:31 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x5000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1260.848303][T20822] binder: 20821:20822 got transaction to invalid handle [ 1260.850284][T11447] binder: undelivered TRANSACTION_ERROR: 29201 [ 1260.877146][T20822] binder: 20821:20822 transaction failed 29201/-22, size 0-0 line 2995 02:24:31 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:31 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0xffffffffffff917b, &(0x7f0000000280)="0adc1f123c123f3188b070") r1 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r1, &(0x7f0000000000)={0x1, 0x1}, 0x2) r2 = openat$full(0xffffffffffffff9c, &(0x7f0000000040)='/dev/full\x00', 0x2, 0x0) ioctl$VIDIOC_S_AUDIO(r2, 0x40345622, &(0x7f0000000080)={0x0, "edd72447e0554cf3f98b7c5d6df471dd967f46b499a245fd1149b71c251c63c7", 0x1, 0x1}) readv(r1, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r1, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) recvmsg(r2, &(0x7f0000000700)={&(0x7f00000002c0)=@rc, 0x80, &(0x7f0000000640)=[{&(0x7f0000000340)=""/159, 0x9f}, {&(0x7f0000000400)=""/197, 0xc5}, {&(0x7f0000000500)=""/84, 0x54}, {&(0x7f0000000780)=""/4096, 0x1000}, {&(0x7f0000000580)=""/190, 0xbe}], 0x5, &(0x7f00000006c0)=""/2, 0x2}, 0x10000) [ 1260.961690][T18307] binder: undelivered TRANSACTION_ERROR: 29201 [ 1260.990178][T20908] binder: 20885:20908 transaction failed 29201/-22, size 0-0 line 2986 02:24:31 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x6000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1261.092770][T20929] binder: 20927:20929 got transaction to invalid handle [ 1261.097107][T11447] binder: undelivered TRANSACTION_ERROR: 29201 [ 1261.112758][T20929] binder: 20927:20929 transaction failed 29201/-22, size 0-0 line 2995 [ 1261.228228][T21033] binder: 21032:21033 transaction failed 29201/-22, size 0-0 line 2986 [ 1261.239740][T11447] binder: undelivered TRANSACTION_ERROR: 29201 [ 1261.276998][T18307] binder: undelivered TRANSACTION_ERROR: 29201 02:24:32 executing program 5: r0 = open(&(0x7f0000000500)='./bus\x00', 0x141042, 0x0) close(r0) syz_open_dev$loop(&(0x7f0000000540)='/dev/loop#\x00', 0x0, 0x105082) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0x526987c9) read(r1, &(0x7f0000000200)=""/250, 0x21e000) 02:24:32 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r1, &(0x7f0000000000), 0x2) syz_open_dev$video(&(0x7f0000000340)='/dev/video#\x00', 0xffffffffffffff6a, 0x240002) readv(r1, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r1, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/mixer\x00', 0x2000, 0x0) ioctl$ION_IOC_HEAP_QUERY(r0, 0xc0184908, &(0x7f00000002c0)={0x34, 0x0, &(0x7f0000000280)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r0, 0x84, 0x73, &(0x7f0000000380)={0x0, 0x3, 0x30, 0x3, 0x8}, &(0x7f00000003c0)=0x18) setsockopt$inet_sctp_SCTP_MAX_BURST(r2, 0x84, 0x14, &(0x7f0000000400)=@assoc_value={r3, 0x9}, 0x8) ioctl$SG_SET_KEEP_ORPHAN(r2, 0x2287, &(0x7f0000000080)=0x7ff) 02:24:32 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:32 executing program 0: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) getsockopt$bt_hci(r0, 0x0, 0x3, &(0x7f0000000040)=""/117, &(0x7f00000000c0)=0x75) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x41, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getpgid(0xffffffffffffffff) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000044ff8)={0xffffffffffffffff, 0xffffffffffffffff}) bind$unix(r1, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) connect$unix(r1, &(0x7f00000bc000)=@abs, 0x8) sendmmsg$unix(r2, &(0x7f00000bd000), 0x80, 0x0) connect$unix(r1, &(0x7f00003de000)=@file={0x1, './file0\x00'}, 0xa) connect$unix(r1, &(0x7f0000681000)=@abs, 0x8) 02:24:32 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x7000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:32 executing program 1: unshare(0x40000000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0adc1f123c123f3188b070") r1 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$IPT_SO_GET_INFO(r1, 0x203000000000000, 0x40, &(0x7f0000000000)={'security\x00'}, &(0x7f0000000080)=0x54) getsockopt$IPT_SO_GET_INFO(r1, 0x0, 0x40, &(0x7f0000000140)={'raw\x00'}, &(0x7f00000000c0)=0x54) 02:24:32 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1261.615339][T21215] IPVS: ftp: loaded support on port[0] = 21 [ 1261.651873][T21256] binder: 21203:21256 transaction failed 29201/-22, size 0-0 line 2986 02:24:32 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r1, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r1, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) setsockopt$inet_int(r0, 0x0, 0x6, &(0x7f0000000040)=0x5, 0x4) 02:24:32 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0xa000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1261.754738][T21262] binder: 21259:21262 got transaction to invalid handle [ 1261.775408][T21262] binder: 21259:21262 transaction failed 29201/-22, size 0-0 line 2995 [ 1261.794744][T18307] binder: undelivered TRANSACTION_ERROR: 29201 02:24:32 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x48, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1261.889202][T18307] binder: undelivered TRANSACTION_ERROR: 29201 02:24:32 executing program 1: unshare(0x40000000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0adc1f123c123f3188b070") r1 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$IPT_SO_GET_INFO(r1, 0x203000000000000, 0x40, &(0x7f0000000000)={'security\x00'}, &(0x7f0000000080)=0x54) getsockopt$IPT_SO_GET_INFO(r1, 0x0, 0x40, &(0x7f0000000140)={'raw\x00'}, &(0x7f00000000c0)=0x54) 02:24:32 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x20000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1262.009816][T21371] binder: 21332:21371 got transaction to invalid handle [ 1262.012035][T21261] binder: undelivered TRANSACTION_ERROR: 29201 [ 1262.093447][T21375] IPVS: ftp: loaded support on port[0] = 21 02:24:33 executing program 5: r0 = open(&(0x7f0000000500)='./bus\x00', 0x141042, 0x0) close(r0) syz_open_dev$loop(&(0x7f0000000540)='/dev/loop#\x00', 0x0, 0x105082) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0x526987c9) read(r1, &(0x7f0000000200)=""/250, 0x21f000) 02:24:33 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r1, &(0x7f0000000040)={0x1, 0x1}, 0xfffffffffffffd25) readv(r1, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r1, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) 02:24:33 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x4c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1262.404834][T21419] binder: 21384:21419 IncRefs 0 refcount change on invalid ref 0 ret -22 02:24:33 executing program 0: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) getsockopt$bt_hci(r0, 0x0, 0x3, &(0x7f0000000040)=""/117, &(0x7f00000000c0)=0x75) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x41, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000044ff8)={0xffffffffffffffff, 0xffffffffffffffff}) bind$unix(r1, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) connect$unix(r1, &(0x7f00000bc000)=@abs, 0x8) sendmmsg$unix(r2, &(0x7f00000bd000), 0x80, 0x0) connect$unix(r1, &(0x7f00003de000)=@file={0x1, './file0\x00'}, 0xa) connect$unix(r1, &(0x7f0000681000)=@abs, 0x8) 02:24:33 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x3f000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:33 executing program 1: unshare(0x40000000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0adc1f123c123f3188b070") r1 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$IPT_SO_GET_INFO(r1, 0x203000000000000, 0x40, &(0x7f0000000000)={'security\x00'}, &(0x7f0000000080)=0x54) getsockopt$IPT_SO_GET_INFO(r1, 0x0, 0x40, &(0x7f0000000140)={'raw\x00'}, &(0x7f00000000c0)=0x54) 02:24:33 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vga_arbiter\x00', 0x2000, 0x0) ioctl$IOC_PR_PREEMPT(r1, 0x401870cb, &(0x7f0000000080)={0x10000, 0x6, 0x8, 0x3}) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r2 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r2, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r2, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000280)='/dev/qat_adf_ctl\x00', 0x10000, 0x0) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r2, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) [ 1262.477120][T21419] binder: 21384:21419 got transaction to invalid handle 02:24:33 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x60, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1262.577295][T21496] binder_transaction: 6 callbacks suppressed [ 1262.577306][T21496] binder: 21492:21496 got transaction to context manager from process owning it [ 1262.577983][T21497] IPVS: ftp: loaded support on port[0] = 21 02:24:33 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x48000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:33 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vsock\x00', 0x82001, 0x0) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") ioctl$sock_inet_SIOCGIFBRDADDR(r1, 0x8919, &(0x7f00000002c0)={'hwsim0\x00', {0x2, 0x4e26}}) finit_module(r0, &(0x7f0000000280)='\x00', 0x2) r2 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r2, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r2, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r2, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) [ 1262.710474][T21570] binder: 21544:21570 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1262.746624][T21570] binder: 21544:21570 got transaction to invalid handle 02:24:33 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x68, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1262.797953][T21609] binder: 21608:21609 got transaction to context manager from process owning it 02:24:33 executing program 1: unshare(0x40000000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x10, 0xffffffffffffffff, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0adc1f123c123f3188b070") r1 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$IPT_SO_GET_INFO(r1, 0x203000000000000, 0x40, &(0x7f0000000000)={'security\x00'}, &(0x7f0000000080)=0x54) getsockopt$IPT_SO_GET_INFO(r1, 0x0, 0x40, &(0x7f0000000140)={'raw\x00'}, &(0x7f00000000c0)=0x54) [ 1262.932959][T21690] binder: 21660:21690 got transaction to invalid handle [ 1263.016900][T21720] IPVS: ftp: loaded support on port[0] = 21 02:24:34 executing program 5: r0 = open(&(0x7f0000000500)='./bus\x00', 0x141042, 0x0) close(r0) syz_open_dev$loop(&(0x7f0000000540)='/dev/loop#\x00', 0x0, 0x105082) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0x526987c9) read(r1, &(0x7f0000000200)=""/250, 0x220000) 02:24:34 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x4c000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:34 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000003c0)={0xffffffffffffffff, r0, 0x0, 0x5, &(0x7f0000000380)='bdev\x00', 0xffffffffffffffff}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000400)=r2, 0x4) r3 = dup3(r0, r0, 0x80000) ioctl$VIDIOC_G_STD(0xffffffffffffff9c, 0x80085617, &(0x7f0000000440)=0x0) ioctl$VIDIOC_S_STD(r3, 0x40085618, &(0x7f0000000480)=r4) write$USERIO_CMD_SET_PORT_TYPE(r1, &(0x7f0000000000)={0x1, 0x1}, 0x2) write$binfmt_script(r1, &(0x7f00000004c0)={'#! ', './file0', [{0x20, '/dev/vbi#\x00'}, {0x20, '/dev/vbi#\x00'}, {0x20, 'bdev\x00'}, {0x20, '/dev/userio\x00'}], 0xa, "a2d72aad6f44962b5454b968c2c27bd5a25a12eace920dc9e5ab0e1e4836159ae4e3b35c24188523687c1b44df826851a383f2d7c7546fd68e37b75e5a8421e44b780080aed8c817438b5734114fcb2ec87f177eb4b45fa04b8b11958b8459db1d7979c858e2218b2b6cac2f214659e8d6607d70a748c557f1c78733a59c5c4a73f1dbe44d00b70612218e04ccc5209e8af13bdff16f93d5ee196f90bd02c53c3656c67b57c1aa2bed048ae5650100f38ee875c21c24775986a035ea63e27887d43c031d3489a4f1149bd2223fbc0d1e"}, 0x104) readv(r1, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r1, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) r5 = syz_open_dev$vbi(&(0x7f0000000040)='/dev/vbi#\x00', 0x2, 0x2) sendmsg$nl_xfrm(r5, &(0x7f0000000340)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x10002000}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)=@flushsa={0x64, 0x1c, 0x100, 0x70bd2d, 0x25dfdbfc, {0x6c}, [@tfcpad={0x8, 0x16, 0x3}, @ipv6_hthresh={0x8, 0x4, {0x40, 0x50}}, @tfcpad={0x8, 0x16, 0x2ea3}, @mark={0xc, 0x15, {0x35075d, 0x4d73ebff}}, @replay_val={0x10, 0xa, {0x70bd2a, 0x70bd2c, 0x4}}, @encap={0x1c, 0x4, {0x1, 0x4e21, 0x4e23, @in=@remote}}]}, 0x64}, 0x1, 0x0, 0x0, 0x20048000}, 0x800) [ 1263.359529][T21728] binder: 21727:21728 got transaction to context manager from process owning it 02:24:34 executing program 0: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) getsockopt$bt_hci(r0, 0x0, 0x3, &(0x7f0000000040)=""/117, &(0x7f00000000c0)=0x75) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000044ff8)={0xffffffffffffffff, 0xffffffffffffffff}) bind$unix(r1, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) connect$unix(r1, &(0x7f00000bc000)=@abs, 0x8) sendmmsg$unix(r2, &(0x7f00000bd000), 0x80, 0x0) connect$unix(r1, &(0x7f00003de000)=@file={0x1, './file0\x00'}, 0xa) connect$unix(r1, &(0x7f0000681000)=@abs, 0x8) 02:24:34 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x6c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:34 executing program 1: unshare(0x40000000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x10, 0xffffffffffffffff, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0adc1f123c123f3188b070") r1 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$IPT_SO_GET_INFO(r1, 0x203000000000000, 0x40, &(0x7f0000000000)={'security\x00'}, &(0x7f0000000080)=0x54) getsockopt$IPT_SO_GET_INFO(r1, 0x0, 0x40, &(0x7f0000000140)={'raw\x00'}, &(0x7f00000000c0)=0x54) 02:24:34 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x2000, 0x0) ioctl$NBD_CLEAR_QUE(r1, 0xab05) r2 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r2, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r2, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r2, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) 02:24:34 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1263.521516][T21837] binder: 21836:21837 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1263.558631][T21844] IPVS: ftp: loaded support on port[0] = 21 [ 1263.582959][T21845] binder: 21840:21845 got transaction to context manager from process owning it 02:24:34 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x74, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:34 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r1, &(0x7f0000000000)={0x1, 0x1}, 0xffef) readv(r1, &(0x7f0000000100), 0x0) ioctl$EXT4_IOC_GROUP_EXTEND(r0, 0x40086607, &(0x7f0000000040)=0x8000000000) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r1, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) 02:24:34 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x68000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1263.813134][T21956] binder: 21953:21956 got transaction to context manager from process owning it 02:24:34 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x7a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1264.014102][T22061] binder: 22059:22061 IncRefs 0 refcount change on invalid ref 0 ret -22 02:24:35 executing program 5: r0 = open(&(0x7f0000000500)='./bus\x00', 0x141042, 0x0) close(r0) syz_open_dev$loop(&(0x7f0000000540)='/dev/loop#\x00', 0x0, 0x105082) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0x526987c9) read(r1, &(0x7f0000000200)=""/250, 0x221000) 02:24:35 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x6c000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:35 executing program 1: unshare(0x40000000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x10, 0xffffffffffffffff, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0adc1f123c123f3188b070") r1 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$IPT_SO_GET_INFO(r1, 0x203000000000000, 0x40, &(0x7f0000000000)={'security\x00'}, &(0x7f0000000080)=0x54) getsockopt$IPT_SO_GET_INFO(r1, 0x0, 0x40, &(0x7f0000000140)={'raw\x00'}, &(0x7f00000000c0)=0x54) [ 1264.275188][T22069] binder: 22066:22069 got transaction to context manager from process owning it [ 1264.287833][T22067] IPVS: ftp: loaded support on port[0] = 21 02:24:35 executing program 0: syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000044ff8)={0xffffffffffffffff, 0xffffffffffffffff}) bind$unix(r0, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) connect$unix(r0, &(0x7f00000bc000)=@abs, 0x8) sendmmsg$unix(r1, &(0x7f00000bd000), 0x80, 0x0) connect$unix(r0, &(0x7f00003de000)=@file={0x1, './file0\x00'}, 0xa) connect$unix(r0, &(0x7f0000681000)=@abs, 0x8) 02:24:35 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) prctl$PR_GET_FPEXC(0xb, &(0x7f0000000040)) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000340)={{{@in6=@loopback, @in6=@loopback}}, {{@in6=@dev}, 0x0, @in=@broadcast}}, &(0x7f0000000440)=0xe8) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r1, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r1, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) r2 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x2000, 0x0) accept4$ax25(r2, &(0x7f0000000280)={{0x3, @bcast}, [@bcast, @bcast, @rose, @null, @null, @null, @null, @rose]}, &(0x7f0000000300)=0x48, 0x80800) 02:24:35 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x300, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:35 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x74000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:35 executing program 1: unshare(0x40000000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000100)="0adc1f123c123f3188b070") r0 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$IPT_SO_GET_INFO(r0, 0x203000000000000, 0x40, &(0x7f0000000000)={'security\x00'}, &(0x7f0000000080)=0x54) getsockopt$IPT_SO_GET_INFO(r0, 0x0, 0x40, &(0x7f0000000140)={'raw\x00'}, &(0x7f00000000c0)=0x54) [ 1264.510845][T22079] binder: 22077:22079 got transaction to context manager from process owning it 02:24:35 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x500, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:35 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) r2 = syz_open_dev$swradio(&(0x7f0000000040)='/dev/swradio#\x00', 0x0, 0x2) getsockname$netlink(r2, &(0x7f0000000080), &(0x7f00000000c0)=0xc) write$USERIO_CMD_SET_PORT_TYPE(r1, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) r3 = openat$pfkey(0xffffffffffffff9c, &(0x7f00000002c0)='/proc/self/net/pfkey\x00', 0x800, 0x0) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r3, &(0x7f0000000280)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f0000000300)}}, 0xffffff8b) [ 1264.608857][T22161] IPVS: ftp: loaded support on port[0] = 21 02:24:35 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x7a000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1264.738705][T22193] binder: 22190:22193 IncRefs 0 refcount change on invalid ref 0 ret -22 02:24:35 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x600, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1264.858865][T22237] binder: 22195:22237 got transaction to context manager from process owning it 02:24:35 executing program 5: r0 = open(&(0x7f0000000500)='./bus\x00', 0x141042, 0x0) close(r0) syz_open_dev$loop(&(0x7f0000000540)='/dev/loop#\x00', 0x0, 0x105082) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0x526987c9) read(r1, &(0x7f0000000200)=""/250, 0x222000) 02:24:35 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r1, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r1, &(0x7f0000000100), 0x0) ioctl$EXT4_IOC_ALLOC_DA_BLKS(r0, 0x660c) openat$autofs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/autofs\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r1, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) 02:24:35 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0xfdfdffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1265.220533][T22308] binder: 22303:22308 got transaction to context manager from process owning it [ 1265.270899][T22308] binder_transaction: 20 callbacks suppressed [ 1265.270917][T22308] binder: 22303:22308 transaction failed 29201/-22, size 0-0 line 2986 02:24:36 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000044ff8)={0xffffffffffffffff, 0xffffffffffffffff}) bind$unix(r0, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) connect$unix(r0, &(0x7f00000bc000)=@abs, 0x8) sendmmsg$unix(r1, &(0x7f00000bd000), 0x80, 0x0) connect$unix(r0, &(0x7f00003de000)=@file={0x1, './file0\x00'}, 0xa) connect$unix(r0, &(0x7f0000681000)=@abs, 0x8) 02:24:36 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x700, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:36 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0xfffffdfd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:36 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r1, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r1, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) [ 1265.353920][T18307] binder_release_work: 19 callbacks suppressed [ 1265.353929][T18307] binder: undelivered TRANSACTION_ERROR: 29201 [ 1265.457218][T22418] binder_transaction: 6 callbacks suppressed [ 1265.457228][T22418] binder: 22415:22418 got transaction to invalid handle [ 1265.457277][T22417] binder: 22414:22417 got transaction to context manager from process owning it 02:24:36 executing program 1: unshare(0x40000000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000100)="0adc1f123c123f3188b070") r0 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$IPT_SO_GET_INFO(r0, 0x203000000000000, 0x40, &(0x7f0000000000)={'security\x00'}, &(0x7f0000000080)=0x54) getsockopt$IPT_SO_GET_INFO(r0, 0x0, 0x40, &(0x7f0000000140)={'raw\x00'}, &(0x7f00000000c0)=0x54) [ 1265.501837][T22418] binder: 22415:22418 transaction failed 29201/-22, size 0-0 line 2995 [ 1265.551453][T22417] binder: 22414:22417 transaction failed 29201/-22, size 0-0 line 2986 02:24:36 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") sysfs$3(0x3) r1 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r1, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r1, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) [ 1265.609952][T22509] IPVS: ftp: loaded support on port[0] = 21 02:24:36 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x100000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:36 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0xa00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1265.658929][T21261] binder: undelivered TRANSACTION_ERROR: 29201 [ 1265.671014][T21261] binder: undelivered TRANSACTION_ERROR: 29201 [ 1265.792102][T22535] binder: 22531:22535 got transaction to invalid handle [ 1265.804378][T22534] binder: 22533:22534 transaction failed 29201/-22, size 0-0 line 2986 [ 1265.821501][T22535] binder: 22531:22535 transaction failed 29201/-22, size 0-0 line 2995 02:24:36 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1265.906202][T18307] binder: undelivered TRANSACTION_ERROR: 29201 [ 1265.934512][T21261] binder: undelivered TRANSACTION_ERROR: 29201 [ 1265.995887][T22639] binder: 22638:22639 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1266.011306][T22639] binder: 22638:22639 got transaction to invalid handle [ 1266.020656][T22639] binder: 22638:22639 transaction failed 29201/-22, size 0-0 line 2995 02:24:36 executing program 5: r0 = open(&(0x7f0000000500)='./bus\x00', 0x141042, 0x0) close(r0) syz_open_dev$loop(&(0x7f0000000540)='/dev/loop#\x00', 0x0, 0x105082) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0x526987c9) read(r1, &(0x7f0000000200)=""/250, 0x223000) 02:24:36 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r1, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r1, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) ioctl$TIOCMGET(r2, 0x5415, &(0x7f0000000080)) 02:24:36 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1266.110507][T21261] binder: undelivered TRANSACTION_ERROR: 29201 [ 1266.194866][T22652] binder: 22646:22652 transaction failed 29201/-22, size 0-0 line 2986 [ 1266.295475][T18307] binder: undelivered TRANSACTION_ERROR: 29201 02:24:37 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x4800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:37 executing program 0: socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000044ff8)={0xffffffffffffffff, 0xffffffffffffffff}) bind$unix(r0, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) connect$unix(r0, &(0x7f00000bc000)=@abs, 0x8) sendmmsg$unix(r1, &(0x7f00000bd000), 0x80, 0x0) connect$unix(r0, &(0x7f00003de000)=@file={0x1, './file0\x00'}, 0xa) connect$unix(r0, &(0x7f0000681000)=@abs, 0x8) 02:24:37 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r1, &(0x7f0000000000)={0x1, 0x1}, 0x2) r2 = add_key$keyring(&(0x7f0000000040)='keyring\x00', &(0x7f0000000080)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffff8) keyctl$KEYCTL_PKEY_VERIFY(0x1c, &(0x7f0000000280)={r2, 0x8, 0x6}, 0x0, &(0x7f00000002c0)="1c8e95acc42caebc85e4dddcc44dd5f44a1c5911ef4ca0d88fb96adf73", &(0x7f0000000300)="e9d001b1f35dc4df19abee65b64775be66d234f7c805c49b7f6d86a588020f24d1facaa08ad5e50d7d0e861107f17c93d866fa01e40bd5dadb126937bb87b0057cd0d47b548c68e32cfaf2a9090a64b1524aa4e27fa5a14cda4ecad4aa30b035df1aea010dcfc47863d28f900fa238471bfb6904828962fe68a10a6b847c11e9821ce604dd08185bd8c4e1faca8d4eb2436d772f6ae62a755376704d07208afb2bc100550055151987f92af9f22fbe03e06c9e1ec52cd3e9558975db57cdd054b3909f23801c0f69f8fce8226586a7e9aaeaa99f47aff40dcc2544c3e8871d3fc247c329e1df42d76ee594dcc17c0509") readv(r1, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r1, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00') r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000400)='/dev/vcs\x00', 0x8000, 0x0) write$RDMA_USER_CM_CMD_GET_EVENT(r3, &(0x7f0000000600)={0xc, 0x8, 0xfa00, {&(0x7f0000000440)}}, 0x10) 02:24:37 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x300000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1266.414797][T22758] binder: 22756:22758 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1266.433375][T22757] binder: 22755:22757 transaction failed 29201/-22, size 0-0 line 2986 [ 1266.464730][T22758] binder: 22756:22758 got transaction to invalid handle [ 1266.490577][T22758] binder: 22756:22758 transaction failed 29201/-22, size 0-0 line 2995 [ 1266.561818][T21261] binder: undelivered TRANSACTION_ERROR: 29201 [ 1266.590975][T18307] binder: undelivered TRANSACTION_ERROR: 29201 02:24:37 executing program 1: unshare(0x40000000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000100)="0adc1f123c123f3188b070") r0 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$IPT_SO_GET_INFO(r0, 0x203000000000000, 0x40, &(0x7f0000000000)={'security\x00'}, &(0x7f0000000080)=0x54) getsockopt$IPT_SO_GET_INFO(r0, 0x0, 0x40, &(0x7f0000000140)={'raw\x00'}, &(0x7f00000000c0)=0x54) 02:24:37 executing program 0: socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000044ff8)={0xffffffffffffffff, 0xffffffffffffffff}) bind$unix(r0, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) connect$unix(r0, &(0x7f00000bc000)=@abs, 0x8) sendmmsg$unix(r1, &(0x7f00000bd000), 0x80, 0x0) connect$unix(r0, &(0x7f00003de000)=@file={0x1, './file0\x00'}, 0xa) connect$unix(r0, &(0x7f0000681000)=@abs, 0x8) 02:24:37 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x400000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:37 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x4c00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:37 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = getpgrp(0xffffffffffffffff) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x12, &(0x7f0000000040)='mime_typebdev&\x14[%\x00', 0xffffffffffffffff}, 0x30) kcmp(r1, r2, 0x7, r0, r0) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r3 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r3, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r3, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r3, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) [ 1266.676973][T22868] binder: 22866:22868 transaction failed 29201/-22, size 0-0 line 2986 [ 1266.710606][T22872] binder: 22871:22872 got transaction to invalid handle [ 1266.770670][T22930] IPVS: ftp: loaded support on port[0] = 21 [ 1266.789831][T21261] binder: undelivered TRANSACTION_ERROR: 29201 02:24:37 executing program 5: r0 = open(&(0x7f0000000500)='./bus\x00', 0x141042, 0x0) close(r0) syz_open_dev$loop(&(0x7f0000000540)='/dev/loop#\x00', 0x0, 0x105082) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0x526987c9) read(r1, &(0x7f0000000200)=""/250, 0x224000) 02:24:37 executing program 0: socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000044ff8)={0xffffffffffffffff, 0xffffffffffffffff}) bind$unix(r0, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) connect$unix(r0, &(0x7f00000bc000)=@abs, 0x8) sendmmsg$unix(r1, &(0x7f00000bd000), 0x80, 0x0) connect$unix(r0, &(0x7f00003de000)=@file={0x1, './file0\x00'}, 0xa) connect$unix(r0, &(0x7f0000681000)=@abs, 0x8) 02:24:37 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x500000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:37 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x6000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:37 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") fchdir(r0) fcntl$setsig(r0, 0xa, 0x20) r1 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r1, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r0, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r1, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x0) 02:24:37 executing program 1: unshare(0x40000000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x0, &(0x7f0000000100)="0adc1f123c123f3188b070") r1 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$IPT_SO_GET_INFO(r1, 0x203000000000000, 0x40, &(0x7f0000000000)={'security\x00'}, &(0x7f0000000080)=0x54) getsockopt$IPT_SO_GET_INFO(r1, 0x0, 0x40, &(0x7f0000000140)={'raw\x00'}, &(0x7f00000000c0)=0x54) [ 1267.117890][T22991] binder: 22985:22991 got transaction to invalid handle 02:24:37 executing program 0: socketpair$unix(0x1, 0x3, 0x0, 0x0) bind$unix(0xffffffffffffffff, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) connect$unix(0xffffffffffffffff, &(0x7f00000bc000)=@abs, 0x8) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x80, 0x0) connect$unix(0xffffffffffffffff, &(0x7f00003de000)=@file={0x1, './file0\x00'}, 0xa) connect$unix(0xffffffffffffffff, &(0x7f0000681000)=@abs, 0x8) 02:24:37 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x600000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:38 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x6800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1267.282957][T23031] IPVS: ftp: loaded support on port[0] = 21 02:24:38 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r1, &(0x7f0000000000)={0x1, 0x1}, 0x6) readv(r1, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r1, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000002c0)}}, 0x18) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000040)=0x0) timer_create(0x7, &(0x7f0000000080)={0x0, 0x39, 0x0, @tid=r2}, &(0x7f0000000280)) 02:24:38 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x700000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:38 executing program 0: socketpair$unix(0x1, 0x3, 0x0, 0x0) bind$unix(0xffffffffffffffff, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) connect$unix(0xffffffffffffffff, &(0x7f00000bc000)=@abs, 0x8) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x80, 0x0) connect$unix(0xffffffffffffffff, &(0x7f00003de000)=@file={0x1, './file0\x00'}, 0xa) connect$unix(0xffffffffffffffff, &(0x7f0000681000)=@abs, 0x8) 02:24:38 executing program 5: r0 = open(&(0x7f0000000500)='./bus\x00', 0x141042, 0x0) close(r0) syz_open_dev$loop(&(0x7f0000000540)='/dev/loop#\x00', 0x0, 0x105082) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0x526987c9) read(r1, &(0x7f0000000200)=""/250, 0x225000) 02:24:38 executing program 0: socketpair$unix(0x1, 0x3, 0x0, 0x0) bind$unix(0xffffffffffffffff, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) connect$unix(0xffffffffffffffff, &(0x7f00000bc000)=@abs, 0x8) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x80, 0x0) connect$unix(0xffffffffffffffff, &(0x7f00003de000)=@file={0x1, './file0\x00'}, 0xa) connect$unix(0xffffffffffffffff, &(0x7f0000681000)=@abs, 0x8) 02:24:38 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0xa00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:38 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x6c00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:38 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = creat(&(0x7f0000000040)='./file0\x00', 0x10) r2 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r2, &(0x7f0000000440)={0x1, 0x5}, 0x2) readv(r2, &(0x7f0000000080)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000280)={0x0, r1, 0x0, 0x31, &(0x7f0000000100)='vboxnet1!ppp1\x05^\xd1vboxnet0{wlan1*[()vmnet0selinux{\x00'}, 0x30) ioctl$SNDRV_CTL_IOCTL_ELEM_REPLACE(r1, 0xc1105518, &(0x7f0000000300)={{0x7, 0x5, 0x101, 0x18d, 'syz1\x00', 0x8}, 0x0, 0x20000010, 0xffffffffffff0001, r3, 0x2, 0x0, 'syz0\x00', &(0x7f00000002c0)=['/dev/userio\x00', '\x00'], 0xd, [], [0x7500, 0x6, 0x20, 0x2]}) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r2, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) 02:24:38 executing program 1: unshare(0x40000000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x0, &(0x7f0000000100)="0adc1f123c123f3188b070") r1 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$IPT_SO_GET_INFO(r1, 0x203000000000000, 0x40, &(0x7f0000000000)={'security\x00'}, &(0x7f0000000080)=0x54) getsockopt$IPT_SO_GET_INFO(r1, 0x0, 0x40, &(0x7f0000000140)={'raw\x00'}, &(0x7f00000000c0)=0x54) [ 1268.043097][T23324] IPVS: ftp: loaded support on port[0] = 21 [ 1268.052312][T23327] binder_transaction: 7 callbacks suppressed [ 1268.052321][T23327] binder: 23326:23327 got transaction to context manager from process owning it [ 1268.068700][T23333] binder: 23328:23333 got transaction to invalid handle 02:24:38 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000044ff8)={0xffffffffffffffff, 0xffffffffffffffff}) bind$unix(0xffffffffffffffff, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) connect$unix(r0, &(0x7f00000bc000)=@abs, 0x8) sendmmsg$unix(r1, &(0x7f00000bd000), 0x80, 0x0) connect$unix(r0, &(0x7f00003de000)=@file={0x1, './file0\x00'}, 0xa) connect$unix(r0, &(0x7f0000681000)=@abs, 0x8) 02:24:38 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x2000000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:38 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x7400, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:39 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r1, &(0x7f0000000000)={0x1, 0x1}, 0x2) r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000040)='/dev/btrfs-control\x00', 0x300, 0x0) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000000280)=0x0) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffff9c, 0x29, 0x23, &(0x7f0000000440)={{{@in6=@empty, @in=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@dev}, 0x0, @in=@empty}}, &(0x7f0000000540)=0xe8) ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f00000006c0)=0x0) sendmsg$netlink(r2, &(0x7f0000000700)={&(0x7f0000000080)=@kern={0x10, 0x0, 0x0, 0x40000081}, 0xc, &(0x7f0000003580)=[{&(0x7f0000000780)={0x136c, 0x38, 0x100, 0x70bd2b, 0x25dfdbfb, "", [@typed={0x14, 0x63, @ipv6=@ipv4={[], [], @dev={0xac, 0x14, 0x14, 0xd}}}, @generic="933d2728fb2c17d5aff222aa94714b16beada280ca98ddc846642382e4b4a1f1774d1a6279871361531b72be5a90324ad3035dc9", @generic="b60460a72c02713e339c62dc36d3f1771679584b92e66226c33a130355093c4b661f62c24a4a982f7c25eaec6cfa958c883a1ba6e3747f6753d5ba4697318c6570aec950dc792762c7f02ffcd1375aadda74440c3594db3d5c30a21d5e61298482d1b95b99eebf5db82a3f71c0f59878d1525f3fcab2cd2c04ddec9732687d368c32b654b8465a", @generic="ebb8d402a6d2752bff84c1fb75ee9d1a23daeb4dffc7c798", @nested={0x1268, 0x4e, [@generic="1ba38c4c30413cc518222c7c7824f241449c1870c08f4a4c72c89bad2e50cd2fe30464fe18f33ae01f9b24e0ee4e3e60e2581627b586661626d1aa620e81c8c78c1d2760894d8d4598244dd0bec88ecebb8774152ce93ce3df7614dd743eae0396", @typed={0x10, 0x19, @str='/dev/userio\x00'}, @typed={0x34, 0xc, @binary="b8fd9182b4a18e0ab1dd480cd432d4752238ab7059176a550a875f00849572ce4d6cd4a9cb69efd8c952c24b022f"}, @typed={0xc4, 0x30, @binary="16d9683f29638a2565b89b52d050df0623190561ec34ce122dbe85f6cc53ebdf4797e4b1f3e46944cedc7936f7984e5de342ac4e8ec06887dd268ed1f2e4c1ef4c1ff75dc3d8fbaa79000fbd5a637b66b1e6fb987527009aa14fa049884c1c3e260c8e11c2cd342065a45e24f1332fbad1f3b0f472dd21d676f397835fb1bf398bb984133ba40cb74141b123d48422fd64eeb79727296741b1303d94465dc190d16078658bc80af8c0611bc363ab873147d193e7d2f651648c13fdd9a5e948ce"}, @typed={0x8, 0x1a, @pid=r3}, @typed={0x8, 0x22, @fd=r1}, @typed={0x10, 0x27, @str='/dev/userio\x00'}, @generic="9de7a631cdcf919ac154a0073028dd9e1e7ccfc6b9ea5ada784f63d67fb0f395989cfea07e9408507fb982af1c0bc8df5e8ce45435105f646b804ef7185dc5ee021bb64057dadd236cec0e8a4cb94e43cd0bb1dee58f6fa71dfc57114400058956c121e09326a7ccd1d207e5313e543d6bedfd81d9c8db6b7e692f82998961ad5874c8bddc33be845f64220dffd333d16302decb61234e293d262931d91dd104b49b4b69933c318cfa3e3b28cdb3b7304e3df75f0d4a63b67e2f1f246db1a0cd4eefef4a6681337b1cf1d7f84c3585793defdf23ac23891630", @generic="e1afd986c5745217999c3f79eccf09905a64257301ce7853d1d5a4fd369b4c17ef05d9501a52a470c5d69bd6d838b3c2a3e49f6ffdeab764f95b9d4d213569ccf16d0cbc15335a440568edf0b303d6f1d63226f7bcf30c468f45447ec0c6aeb0671a9d4a93001aee0612586b399e55c4195109354719860c4ade39dda8025fddd7b88df70f36fb89a83851baaa4c4f06939c6605251908e1f76c8fe7f6355d2c4aead9a60ebccd03a4f3ce3c57b23741af580e5779ac5fa8057318707843cd67dcdb4c69c8fb513baea3d09db8fd8eb00f00aba2f7985d3ab6b3338f4fd23ae5a1cdc2748ab1b85e10f445fb2ba530b9c6bc52ea569a0c2e70720f443ee926f85ef194aa6b711e9af49fd47d890e21192dd4475de676338ca2522152b590dbc1d29b15484886f076b7c08c3c2560028dc820436e9677143442254f0161a143ab82050062d2a872e9accaef851f1787ce59056ae561fe7b29539b5059fb2c6900362b99d18f2075a38baa23c9a4222f4d739162448cf64328c250ce69be71f4ac1ef02aa61cee4b53dbdb79fa3148099006b457ac74defdb5740212c90a0e23ceb78632fea223b98776ffbd0ea078e4793813c93833f210021404573abca5aa509e7447117330ecb782e297845c87ce19202a1f1a757ada36ca1d4bed990f0ed3b1148a01631879f1615d80056156b86b24f60b2d6288329226ec5fc3655b28c942276aaa5e1f58e8622ef76fa861f726cb91c3f7ac493c80be43c912a3b240fb36fed9fbf931e0c7c8d4df1b91f0b9a9748acc648640e5fec01b760b6c44856f3f69ee915e86c27ab575a16bf3389a8fe1087f3e52b2cc1e0d35e1208662ce687d328b3059b41615c692153c2805bdc3655c9f9ba00874467930a75a64f0391f524de17d97306708ff5e26a6a171349890bd5f2891d45344af79289b309b15fafd12716ddfcf23031e61f2c6cce0fff901dd7eeef2ae6a48ccba7d7ed44f294c94d55d5d384de116156d7090d81169c4a1a8aa8f2af93c3695bcc03f87bc64a5d2ad222f507103836f1bd8f53ae916a270171aaf1b6cfa715ef044763abe830355fe9d1ae9308cd785f429b7769d9cd822517fe356bdc75d5b7a9f6fb375c8d30218fb8bf3fd85ea238ee0811032634ffce1a0d094576c977bfc632eeecbd65b7736fe57163e9ef6f30616a2b19cfd4c2c9153452c6ab533ecc5b9df551a30f88175b3eaaf704cc1bde1b26a2ea77bfb3dc49072a78d41b968e8e5cacd04c78f5f7aa5e721907e2c06066cccbb667e014095bc78f5ab65a92e4f5f8748e51db79d912032d104beff0f9fff48b2b7696eff67f7d36c5af9769f6ebaeef336e036259aaf0e0f6752f6f3f08322a0049c9dddf71ae9537c76a466e3d62e02ccbe88b4cc4ec77d754c18120fb7f287904c6b5a2a59970d4e26778582e5e2035db8cd29a216bcd3d5f370701bfee5ee1f38bb161f37d00cfa33a0dbdd2ee65d21ed3b4d6962f21342744a40f3fffbf7818fe9fd22327005ce344f076f7c7a911f06146486e304e90e48cdf4fb01c585a637fb51826461df48d1c4e253ca7bfdd9664073963cb26485521762e43562414c40fb8a446c5f34ebf00a0586f4561c6fa3b1f916c089a48855098e470377bb86ae3c192bdf2b27068f3f477d12d91141d6be6b2f271affb7261a1fcfba52bfe275febf1ccf72e49d22cb35f0bf85aa8020e6a18b9851878270c009b4abe3f4b0f94593c4364f1783aecc269b4be712d924eeeabf74b11aba8575028c8a789f37644e4514f4e09cd1bafc923baae78d9d8b497dcb973867305145d97849b2c20357b9aba790086b3e1ebf2bee99d234176bcd91737c701eee10480d4b6e06f8c7e58fe3f7f88deb50790a06003286b85b276297205183e10951a46bdf64b763a7c1762c7e36ff71e480a6bd39713c8408a98dfaef9c4e926b2056b80b0a40199ab28892f27a926f2ce3ae910153e8d8091f421385d05f5db9d61499e507048880be9f939ae755e0101fd006f175f14291e125731882f56ac5fc82455e1fc3750e8d0250be745485b4eb13e0d9af0f6df0dbf67372077ee3305ee0ade75aee2d257c5dab31fd3fdec83cd8a8ef7f78e8bc3f58c038ac57e095afb5d39367064e91da6584a6386a5d7f64b3c46113d25ebdee01df6646c6e45ad1c99b91835c9ff60b8ab1759f039360a7f0b494663ce8a33a7d545ab59f6fbe3411b0ae1039d7d0b448c4ab5dcfed9492762ce47a71d3b64f9a5c32be760238688c19bdf3ba1704c7818cf1b75fd10881d62650c168151b74ea18423b0ad46454f0c2bc1f5f5bbdc4bfac32c0a948c50cfc34e7f1686206d6fff1f4e58dd5e47623a291fd4a6a67f31d6546f6d62d9109dd83156098238f942226779fd16429de14cb07b7fa987a8d33a8d77a623e3b8adfd50fda1d9ddc4f01998c70d8d9d8cc4df7153bf05cadec663adfd23c6ad43b6467a13d775dd1d775746cbba1c733d2ca1fab663afe97f859849f64d45d6fd5f732e56c7948244f4594abc13721849a83827fb4d3b5d3bbae1eafd82a63072506ba5a172dddbfddac1649c626860420b1a55f785bece2e8cd418aa9cd231e8b5aacfb962313fbbf9f08385d788a720a9403b65d19a8370595ae51135b47bc34fac8c3a58157a24e444d242a1e8f234e5a4e6f03846c6cd51f92a94ba748f22480df5c8f5476c68a563328a2de97590d1a47a2eeea2f4796b9f6e981d0de4fee7d24d417b5a691c98a3db6c9d8df7f3575bde8ccc440e405c1a15d7610b5e4d09c4e3c433c034207872244260ccd5e9243ebe050f3b74f64e1f4131fe004bc875d4e4bfe14f97bf0ffeb0b3f2ff640e9d44a6fa6c6f71c716b105cc29cb2e703d8bc959da9cce0bc6b710795ce9a5af21a5552a9e287d626a004080046ec0d977a5d318f21c491c92f21262dbc5bc2e7d3ee154945535a1c89de1489a5efc2dcc8a024d860172b3ba905eee28962d3d35eee1402e4b5ed60434640a2bbf7ee26cff61789bbd79739e5fbf517f8b51886d08c4b204578632d00baec27bd7f371302eeb5abeb27a6ea2a794748bb657d04d42ff09666242b0f4e0291f790732ad039fec114c1a07fe2f3ecb55f840946dc083b178f2eba6d13567bf5159ae061565cc67f51e1e0b4cf1d04dc674b740ad592586d9c9ff9c701b3b9e3ee6fd1d95ac62adc48b2fa8d4f56d6d9a1f5c47be029ef4c96697bed995545e1e16dc1ff1e6de9aa08c9558c3e97e3af2d26c590fbcfe0739036235a136442eb69d30a2439c82a2f6f47bed7d7c02c75e1d91eb85a8e909821ebcfb0f7040ff462989096264f742c8ca6162bcf91f599b651d9c28cfc74065fd6f70f84bf4969c23ff938ca05445a8d4a090533f5ef0778c43f9171a84fabeb3e8f92455894d41f7bffdb1f402ba379fe045510434a8113adc1a0e8b961671197ce10732cb423156cd9f1d8b1cfc513a962e4ca18875f0981027ebed3f05cdbbcf8a51491440010a7413e41a4cce198e7d108b2617aa513a5bd2ebba5cbc903bd4eb5d461c64f83b03e998ab4eee7c11365841d35db5cc286c8dff3a26918c778fa9047453f58aa7f45b3f905fd06013cfa4577d70b0eb9c1ecf775dc55b66e48ae5a4edff55abfe30b952c490c24b093782ae236a969f836319d6724a87a22269723b9ccd34c56e696a516a9da8fad1b67c0b0e30f4e2358d87a6a70be1af284c28797e0edb7356838dd9b499112af2cb7b47af6c6de385c99eb521f57ee3d152030a538fdef4e64d1d60ccfdadecdafcf58c2677ec2907b3de7ae0d5574e9cd5821dfee57d32603709e6988dd39c728c309b9791a96ac783fac4fc6c5d2aac997c22810582a1b0170284db5eb7918b354318a10865bf8c6c0c70ecef0ec26114afe096d4da26393dcd131aa5a77b52b6339e04da90f0ae92d426db9a4854ee63e75d31fc7d3ec35b09818f2647dda67f7dc8434fb9fdcb3c621bc341d8d35bbaa0e9cf2cc21a99a2242543b5ba6984efc7d7852bc5ca534ede02885b7a8c3aa5b7ade9b1997d8c9108c649201f12d1db4e6798fa574411b6277ce05f570f828080115f6c4f0bbe558f6e7541bc7e44811011f7a901adefbf933ac7bbc2248d386ca19bde12fb14280d3b47d4fc735fbedf8f0d2aedfc96c1c2c659d68fcca9c5fc75cd15be15a211164362239e21afff928b2d5880d2500c6fd9add8f3d10bf3847c802e2dcd6a6b009b29420531cb3cecab71718d1ee5a93e2d19c60d6b8a7459a8a1ee5a6d7f8a1df08397269eb2a665a4253ee61502533c58a92116b0e833bd7659571be7ce3da05f33d7fb82eb0ca088e5a7fd055efb36f6c094f403ad20c0c6dc8340c471ef108c68816b67407c45d6f1698e0c667c9dee71f045f64e704d0de3fa13f0de3cd7894166c78bb292e79b0baf8db1ea0a8042fcdabc86927adfc2cb9e84ff486cf5b7ccc0cf7adf36e80d821047eb2a8ddced23c0a8a0f92a35fe114d54ffde991257db89f6db6c0fe6801c227da66e3dfe8f75cf772edcd1fa6c4c31e04c55f1232d63f2c1518315c0faa6c1f7f3a329b7bd5f53d2c67dd8790099f8cbe765ddd61462cef3f69c774b23d8fe11b397092032909825e693de37303b5066635c031a0b1ac7b2d858800070108e0752114df4fed5dae5b37444b464999271564c0c39c4d68ccd994d18cf5507f2c1e36bb9029ccb90f2981c573f219e6849ad1c5180124578267f38f04961cf4242dd207e500d6b6753cc7be05cdcabdb9fb73a238fa884296b98bc720e41e884fab283a263b32399cbb5ff99f0299778ee511ce39c1f6934b852f610431302759c403bba88b90995941b257010a73a542ae19d4eb31092ee3a3d80c101cb19d717a84ebc9b9aa34616217113bdc041b5affa3766f437af94e248fa2b398366a38602028d7e137cbb0243d203372056f5ddb65932982cff0bc217478dfa70b99ba6bb96f908adc034f3812f0928d701fbf925eba44468078d0b85a5636d345b195cfd351ed973d19a845cae54f5dd95de93a97327916722740c95b306cfe1bd1a74c152abd5e7adda6dd99cc1955f7335c02c4e6c542beed0d2cdd50902b0a31b873f565a8e99e852d3a0f39298eb4029afb2573e7ee3a482060672d194721b81e0920a768c38d9aaea53cc69f857a9046cb8f02401a79b1f2ca6b2a022d5c1947e3d4c53ea5ca46d386583c6d72fa6534a0e3f5c36e14a64fcd4877b571210b850915e3b3d2510d8e478addddef5b53dd7e5e52645ed017ac1c8c468beb97fdf778a04c7a9f1126c2b74c3d9edf511eb92de7ef8353ad43c35d18aca10b940aee0f844261fcbfda7acbb417d8c0bce0e8b8544a950d427c7005f91059945097f925753ea23ca377eabe8679fdfb9764b65b2fe584c3d76a2ec17727f5f9c9f8dc236d33ae4f0cb053a7a6e2c1759da88f1ea9f28c048b6a1c10a50d7f56e5d94e957356e9ef4b414b766ac1c393e11197ed342605599519b3b3c20f412a979577bc1005c3d44be8a457a4b37462e149ce83c9e443b52c59734277c9bbef04a6ae7c871f2c0dd389db7490df1d1b14e1b419a9edc663fd4dadc7155dd28a661e9206a8c9f59a2489e3168c4e447f2fda07f9ac4edd3b15e8c7190faac2fc77abfe05b9858d96986cd30c162b48246225e20947d90d71325dacf118506fcf07aae3bde88f7a14ed078575b519b714b0d7b907e46f746a2ba27d53d8c4338a5d2e5b6da31e044041a4de871634ed5eafaa979d9ce5811d35f19c7a6139113365d0"]}, @typed={0xc, 0x40, @u64=0x5}]}, 0x136c}, {&(0x7f00000002c0)={0x158, 0x17, 0x700, 0x70bd25, 0x25dfdbfb, "", [@generic="69671cfaa5cda094094476e06b3f21be42723e5e7d98126c1a8881d00fef8a1c36fb8bb2ff8811b18f338995e3ae8742be92d3370d0e901eb32361a872634d61eafae1b6b9c4200a274dcc54a97e51d664e82a87bd003feb878c011ab87a8fb730e245ea4a44a59666384de327a014126ad5c38d04e0ae303c8cbd778d08fa9f07488a363f361958a43daa09b7ce867fd8b706e4042d86c269343b4b", @generic="fd8fba3cd5ceec6a8bd81f36e0cfea9741c578baea0831b5b48fdd3aacbabf087cd457eec06bcda11f845ba72337e917849344f7a9e9b7ff1963511ffdacc5065a75ff52e5a71883b52d055636588418937558bb9487dff84646adf71067942248bfe577df9b3f5acceb876fcae1eaf2f33fe152db801fca9c2c6efbd11050c4e495aca1ffd6a48d0c361364a53d429dd928e64f3358e149874e37c3a73fd63a8bce28afe3dc1a8de7048c"]}, 0x158}, {&(0x7f0000001b00)={0x138c, 0x33, 0x310, 0x70bd26, 0x25dfdbfc, "", [@typed={0x10, 0x7f, @str='/dev/userio\x00'}, @generic="fdb80778af06d1ad0ce4c93fc4490505cd9b9e35e23a3afead3407739023ffc61e53346c86f1c3b2a495e97c2565cdfa6100102988c742f38fa74622189e52611c31eabab3262f8c1dc8d357ad3fd3f9b3f4b12b3bdc4066404c9e14402bfad79615c682aa3eb06b11f789b7f1f0e9c13a26cf210e35dce63b401b477c85c89ac1cf976604bf5e1bc8f882bf18d60f", @nested={0x10a8, 0x82, [@generic="628a63c4fff6d02db87b961e0d66c76c1029307ecd3cba30fd01fd33d155171880741c3c0de1803e88745de8a65cd4f81b19f1b91752de6c1695a64a0d357a53a392a8cadee414b67d5da8f81f46d464b6a4ca26eb24c10e92f8621950f9aa8ec61eabdd19765d395cf204ed13acb4da74608ecb8625a0ae473b0144ea7f354fa25c12fc561496ec4fc2968bac9e4c0e1f015446dcc4e628", @generic="da9b42047bfad2a7ad22ce394d879d2aa280bc8247d8286702e89707b2982208964ed0a03033a91a3b43b4a8e3313de9b2694860df53e69f766a30f0eeba042cb3f67ef191d041bed5f41648fc8f035d59fb8e9239cfd5835153b5044ca8b69ce58e49b30abefb7902df402200a25fdf21c323bc026cba79242fcc98efb21422ba55f67d4c005421d967843cd3944f20fadf965c718d7fc601e32664366c8ecb94412b74686d74d48640f64b25b2c48db7b2a157c313880a87661d3ee0a204cd72da0a39c7a498f7a5a60aee5d3b00f33329a1be8e2473bfabb3be03696f6f57a92a56498e035bafc123686f27fd7fffa984c0bac01dca0cf5d871a27df0db348da875eb88bb4b47ac67564c9a14b367f2636bc6b0e8786e85f8ef0fa3d0a4a1e8cd3efae749f0af0491e64f0f2a4729d9445ab46a6ff7f2204010504718147824b1167d6853e40a9f3d8884255a40f5f0669b13da0ef5a68bcf5617582618cb9f4c8b36d85ce874d6b370e7ef075bddcc71ac1186616b3a4dfb9235d42bde3b1f8704705a17ade673fbc5e25e725c53d32667ee0604f1440a9ba1aa0bf5a284fde11bd777b90a058e9ca4f6fc9d704d2aaf0923f728854ae3f38c0acec927cdf16b373aba4d774c097d364bf75c3823dad9a17749f1d516c4e2603bec5f3834c58841b93e0241afcd8d34fc8bdecc57fd05ff4e65a7f414c71402d485bda4c90cdeff145d53c595ead9ed271fdb98d454d47cdaa12c857132d02965df9376ccb7ec0dfa8cce935587fb55286b96d591b59482196f47d8bc362a3294974a2c8c145979aa57c782f44934d6fd9f09afa024c2fd259c69a82be76324b1fea7921b91326a170dadb5a3c95909a39ef650bb4b5ccfd20e01c4eb5c6eba237f120ff12c9c11dc44307ba67e01a47666121590a568e8e4c441b62350a4ebb39d629e10495117f8be47c2c73821e49e3a0f52fb808b7355a74d3d5b5844a1f19eb33956db736313e1f2a1882a24168cad2da8499115273aa775c69b7bd61526fe0b7ff379d156ee779d12af7d481f34cf3b7f33145ce5b346bec94392f4f26a6819a96098287968bcd97c7b54be6028864a4a5b7bae36c227e65e4dfb0818cdc924a90bae5e0d447e39232b183cbf87a1df87aaf659aa9c1e008e3f0946febe98dbed7ebc0bde101ccaf79ae09e995992164ad510d51439c722d377ccbad754ed7b3e3c4899ad85e1e8b154923eafbfc5b10f857ffcf91bff861b3b9bb969ac74439738888a57b71cffb1c87d42beca4ec63ce93687517b4c3c239ce78f51eb8f7b8a3941bce55037a84b5661d828100ddd588f76e565f207b4ee4e968e383dc452dbf2480bc24bb18fc1140fc82b90f8f99005c78784ea744d2cee83bd59eab88b69c7d095868251545b3a9741b874985b5e5219e0bf5df269e11c4b1ff32b2a71c07c142f335c6c50c358df37eaee07d967d410a14c719042245f6ee0c82ef1ae173cc7b3e8f00f9e3367ca31530f2a024784e450d55635544fe80d7878ace6d9144c333712e89f5faf5bcc3d428a9c6432ea83bc5a44b811debfaee2721f1737e056b310e9728d8db7bd51b9e2f62f864f9211c5744fb2665ae325bca48f523c7ec6718df785e993dca336f0e2d54249d54dcd0ba3c6fef5bbe7f3afd756157a525043af31a843ce306cd0be8cf0f43e1baffc3fe282badfd432b9858927b8a0f9e9c1e0fc739fbd57b8a79f32d733150d264f17ded04d757a1e82caecaaa207ebbca2d863c81af0f4abf02833c0fdcd1b0f30b8794ac30877abdf82f455d6366ba8a430d97ea5b4301a3e2fbd2d3a7c6d40088884daa9a9ac1b9c802889a1412f424774b52e6331ca4e84846c755c99f7a851eeee8f66d63aae3de057521baaf5c0553b3f4df34703cd302dad47e8660d28a818ea59a668a2424fbea8aaa446c5cb13fd24171d348c327d0f0af96961935c04e9d21158ebdab3c56987ac1bd992fef01e09f288d6927220e543456edae774201b29158577d2e5e934ae7ab030c89158ac1bc091f68f9b858d096a6c5f50632557e9f9ca1645fd27a7127a6c327b6449a9c5c36b6b34667169454fd9c72578e6bbfcfbf9bbf8f272114ca71acb4e96b0a7cefad0fe3ef76040943a70def12144f354af053d8cdb3a4113c33b87075dcc1509b1f30f5ed984079302332fc5e18d0923e0329402c7a9766c8280166fb54ccad4366a6abdbce4c71120823247f6c9cb5e2a7b90204e0bde6e2500c661c83ed8703fe3c210d1f0f654efad79fc0fa0159932b7d5644fed2358d7b9a8e32258db7556aa69c082793aacb0830b1ad66c5f6fb5594294fa13453dfca7819d5a10eddae1af8b53a5e41979b2ae625d764fc6753e46d8bea0eb9891291f83261bac3204c97535d39e232bbf4bdee31a4c4db3f1d3d16fb53e7ef7ad20a24db504730ec9768682d497b60a9e4201bcc58c29bdf9772ac54e592215f8978c578e9706dd41e58fd55e2ee354e68ff0ef181ba1546dcdf08be531a63897a9b5c32f34d1759b977e35a95d9ac63208025737039cae98c390c742185f0e2f4ba32d1887c28a7cc39d894daa67db4ea0978e3cbfcd2b9b21abe4884086d071b4286eefe9cf2d94781a6f3b10763f9e6bf21cd59181b72234485b6eef53e44c2b261822a1407a943ee6e7efa27eab51935426e9ebaaddb61e0057855d02a1c34ef2b34e614a228ed2e72491187f80ba99959f2aef48fe7c41b8e93a90853c6b945ca422b2b28e1368864aa6eecd98e07a902cabce33968caa321877235ccbd66491a4ae2e4a72cb0f085ea2334d89f0178235a9baee461f2262613599003eb6b91b93bab5ab32b0824dbc376f3f655a677173cbaeb32ff3c65d61bb486391ce97bfb98171c8bd14fec47f276abfb0a303080527548bba6e66aec332d105ac409e3b7dbb81ad6171032ec52eb381a45d0812c9a6ff42be86767e957cbfbcb483686be524ed669c266b1fe9dce9811b0ae293199033dc24dd9ab6a64b75528902daf3fa79a2a78a681643a734f2f7e6e7805aecf9b0aa635ac6d3e9af9818eb2dd1a9c4dc36b67e132089be13692414c1468039a9172da94c096308729cf6eea5bb5ff76768c7b93d6004c8ba2a87da2c180d59b3c3c84bc0ca3eea99931226709923734e03aaa8ed3614f39af15d097c5a6fab7b1b8eb92825519c59b6788a859898208fb9a7c928cfaeb5061ab379f0651b780a0a7c2071f75b0b5c2308d08f7aea988e78e0b7f968fc30ffdf7422ddad7ada05cf25ba91e66e7abda5626cd14551be099b635531f5e9825ae9dba3ee425b000ae43ea6d99bc87d1e51c87a3cea60a060acdc83a3154cddc35f13a34473588301c642d46916f7051b832218c4bfa5c24d61a878bb5bcf6004e53c849204312bfd16503f4df9de85bf930127328aad7373bb3a2726f85020941774668bc45fe683a961519fbf0512fe993a96c8e9b470227945c22266799e18e9dc955a98d73589e820eaed86bb72b80e0fd305523030faf43d5c89a7b22e8d183f63b9c4c00d5ff9e161c7ee8d99509d9220576e0dbd0dc63d1c8c0f49e2b4d83633241b37c20fd8b7240ae0b9e9468c561f0e4d0a3e2bbc998f89f74101fa2abbe94b1fa79666c20e6c612b8074535caa4a866e5128094f41f0c9994511ad0b2f5284537afa79f7e1837793561e1c5b28925d0ad516b6b617ef29265800ed5db623e1ae5e2c4f13dbd04a0076072527f1e13a042ddaf4ca8357d32e951e6fdb33c51ccdc5cd17d91c17df6a1f023109927d23cd82edacab78c2437cbe0c3940385f2f44545373b679c09da58dcddf51cbf7cff6aa83d3ea4687bdbfa8e2fb80b545785c0345a3ff9d225cd80dc4146a73de6f4d9250d730728901312df065b0f4f653603f2ae0a55798235d9162c7a5036c3563899d431577f48250aca00374b15467d7a7b7d53b6f8926ef17bc7fabc6dcee83139e2bd792f5850ea97314cd6683381ba6be02f307595ac7e2db950d502c836e93f59a116bfca3751e1b65b16527a5f61acd4397086a151a359ec72596b5ea1c730ab421c1095326495c39cfd519f87982e02032d688e68432b523f52e469dcb46eda42fcad539473175e69a49ce8eb5de32a91984143d41a953c4d147040a6d8bcf687a2e4d0cc8ec7aec0dad81bf7ecd8dd1eb52515e0cf9dd5d01bb744990e5b4ff503a1dd5e982512df2f4106b287aab4a15beb09eb4c4c4651d9879051e1e50a74c78587e2c3811aa51ef05e2a17890672870c082dfb7ec8466d7278100d4b3e51acc7e90747d267a3b0c8e3094490c47a56717b38762ab3a3d0a7a3e1b48ca301afd91f09f8e30a55b402074c5b89c874bc27f7c4081618123a06cd6684ca0b2405091010df66ff3d4710af1437bf2ef7b7232ea300f6eb8f8d2bc95b2b4279381b494795efdea77fe59bad022df83e26c45cbe90c0f8fe990efe36602b8ae9cb9c25f7f28862ddfdfde79664461adafb29c2c00babb85d191e4d03de0dde881eb0a4dad8353565ff324cb58856805c749fea6e162e708d615a00a8b95948343e9da7b78b60ce63b14249c22a7bc34c8db20851e4cf1a8781ed42f1498026e75cd6c91de33d3349f99e3b547caeb3529c36458c29e2f6a1b3cce13d2658e253be0eab33d41ecf02dbcc5076cd55448695fda69241e415c784533dc85db181df68d2d25d65c6a5e2bef8283d64161ebcacd3d5a6afd64a39b1839b06e071690ccfad4c3b1a931e612761af4cd15932c450ad874ef9370bd15f641a66d7ae1be08666ff48397d112e3694c39943d698962020ada83911a7c963dda473de3c00a5a7462cada927f235d4f1327ff0dc0baa2a4131c2761031c3a300b61e8f93afcbe1baf3fa21ed5203737b989c757ad217f89551f68e3211a7cf5a80fe8cb8f1c26885351cc2abf20d8ac2e98830e75b4b61971c1ffab6b30dc6a5bc2686994606493b059cc4fc2d842c2ed62e4f3cbab88fae1aad387879806e79eee22d29953b058117020af181c78c8bd8e91a0f260108d3149bf371f4af1e8310f97518a5398a47cb053a7706e4f6c559f05ff866232b53dcbda9b21cf7cc46988a1f49208384226bc86a20f0ef48b1d1c51e7977eb83cba57a36896b54dea9d9cf5a2c87846128969e86cb9eaf92285723ab6862864707d237ce5420b50ede38b55dc0799a46094fb7a12c2c0d7d75e4f0df68047551cf4de0b5cf40147fdbce98f4bae73faf236142a1dd1f7f0ac3afca563ec2977314e9970b18d8d1909f34e3c7b7f40a3341ecf7e65cd9918d5af7931c74e72896c543c5ddbbaa8b0c78f959a3bbc126e7879f1e985d94b0fbbe4c106ca16441301c0b11488d5946a27932b43c2db4c9792478f2e26dee68c2ab3f6748bd8609daffef2d308b7ee3118d2492326243549ea08aaffcc1e5a5f168553b65486522fb8299afc4450e98d239c6a38076efc2f9f461bfeadcfc0685f79b0528c2abccc9c9ae85ab60d2a4bc29ef081e00cd25ea3f0f8988f58c47113f1097249ea32d8217bad8829c931302cfe0a4d52d37db591955480e6446efbd270baccb6c8d266e2bafef9deb55dd81187cc5624864d412ae0a6883c43077862f28afe2378f47dd36625a79adae6ed3252a7768622f490e725d13041c470f76543878ca504e243ad0ea26198e164d6f31dec5df2d2a9e7eb372ecfddff17f8c4ee8fa25bf65eb78195a153eda1137b1b1cccbb41c6d560c24162cfe9a90ccb23b15a83f0e45bd6ecb2b07250415adb353a9bc204a8fee9f0", @typed={0xc, 0x6a, @u64=0x7ff}]}, @typed={0x8, 0x58, @u32=0x2}, @nested={0x190, 0x15, [@generic="03b3f6f7114a1aa38646d5a8064e9c83ece0db14dd0dbb9873d285f309502f9073401c5f90ecaf2fb8da4aaca222895bfc9d82d654d2cf54f998199e86cc0409d3b40632f35c6fefa1b5c033645b12af5fbf00148c9e41a109eda9e9f6", @generic="eda23e89fc81830e1ef290f116fee72cc79bbe06063d4f926185d40873a48c5efdaf86640d0aa2b7734d145edbf09864943fa942d8a989b42359b93b35422ae3dd3928c6dcc9428bc4df4715b5ad7edb51cef051ee96c0bf24e492c0b618c22fa76a3d06ae5bb1145d77c216be71eed50231878ff4bb301540e959308aae6b631076316a3d2d5ea6d83bda572af64b9113ab4952c9ac958d2fb70cb6a97bdfb7d490c7eca691277ebf5386ba3fa6c94438504a89", @generic="40816cd2005bfdc2275b4d7d8a13d0e0c44f62049ec5527356b4a98a07683aec7c4d13396032f6d9dde14fcd3b00efcf13a4e2253d3bf0050b77d0e4a6790f5b1dbf621e1fac14ad9ed91b8b9caf75f9f7af33396b87e6b0bac0c000e27af51a1367e264a3e31f703017f973e082b4c6785b93b501077df1"]}, @generic="6418fa628b88fbe148e6cf95bd4f2c66a68bfdd7a268698131cbc202994f692a7b52a683517fcecb57a9073faca153454bc4b7143e5a9a0ad2c4125d8e49529bfb242c808cf3d8ce6e275946fe93dae574359e961dc9f6a4c04d4d770c5e36ba5e1ca16bfc3ca6ef349e45ba99a6877263cae86aff832f433227d2", @generic="7ea9f08a2d08611027cc1ea96c9929ba299326363bee13c881dc48073bf7bfc6cf"]}, 0x138c}, {&(0x7f0000002ec0)={0x3d8, 0x13, 0x0, 0x70bd29, 0x25dfdbfc, "", [@generic="35ad4ef6d98e30378ea1c3bc4d08bf6ec7f5f093b2e264940a256d49989a7fb52f69a96b0d6cca352742bcb77724fadd2091ce2a24d2edb18f06c66c7b6dce99d0c8b25109c01175323bcd0b86c59439ad58756a512c3ebb15ad41e1441c0e2c7b322a3e79ab55126a28f99cb687f1a8b478d42a9170715fbc6da8ee6b743d124c520206a69fe06e1345699fbc8cf8d800092fce370041ec2c4a18f1ab92d383284cdf274a4022b0dff58f785bea985e803be6e4f7c11bed05e94cc396ea7478c35161a82a2367c103e83f95", @typed={0x8, 0xa, @ipv4=@local}, @generic="e2dc1b5a6f2cebb1221af26c0453b1db0cd3b6a65bd03d01c4739bea84c5b0c837275c9aadbeb87ae1c2f149fec00f84fe826f18d788b559b9dc3e767499e1b6f2ce478d01855909f8069669d3344e369566223070f3e7fd4042398a2f5dcfcfd3ec95300d2ccd85e488ccbba672e62711c1fd9f4a5dbc9bd5d0b78164aea237b26d2bd217fe9679df2767d188108e5ddbc1c2ef801e379ac92ba8243628df8f7ef20fa9567747f28b2f6dee3ef853d5029f8d191f836db1f2ce06c97f0233956f1ac25a7eef085df1fb6bba5633e289d3fcdfd540d7f8790e2524818fb4c1547ba2f729c7c41513b1", @generic="63c58c72970c28f964ea30c03d7b659f03c42e3a861546cedef77a87e0dc1f72d3f58cf7113b2319ee491160e7c1b10f35fbf771285a4bc3", @typed={0x10, 0x80, @str='system\'ppp1\x00'}, @nested={0x90, 0x33, [@typed={0x8c, 0x66, @binary="9b66ff605f6771482a197f4034f5a9315510973ed05de2f6404d1e6bcc2026fe1d3dcc3522083f3d3ebbc6ca98f95d121ebabe1a4be1b1c4dc2af24824c6910f95e531d8762a78dbd66d5d6fd0ba19b3eca59982490b5a8a00d367037396b691015d06d13aa986cd51546783595992c12caae2dcc90c0887ee1d3d79a51f0f89917765d03d2649"}]}, @generic="b5b56665bde695eef73714dd24f24f0474ac39649d2de5c72c7c753eaeb0b96dca8c855250a8d524", @typed={0x14, 0x1d, @ipv6=@dev={0xfe, 0x80, [], 0x28}}, @generic="b4035bd6d07b900faa577214e1b941292cceacc1cc3aadc6e8fc5057abd767b8d2a6ad9def0bd70449d6594317baceb34078e0b5aef36da672571434ef062aeb669c85c611e146c9c5025d0f8548dc7cb9d69d34db3c9a33a0f9fde3301c6af577b8b23441119207b7a5ecaee574f491bcb5fdf5b99c88bbe1f71d22a3b8408964b9397a36e3ce869a3a2bf04cd8ff1f032bfe34df656405398e4d02233bffa5797b4e72fd14aa3cfdc61460d030f3676ab6b29bd639f04f14ff04a753bba4da685666438af20e312684bd2bc82ad2fc103d48b68c08dd1c37edce75f2cab9f9045e4229eace9f545d9bc50c74451e", @typed={0x8, 0x3e, @uid=r4}]}, 0x3d8}, {&(0x7f0000000580)={0x10c, 0x3b, 0x4, 0x70bd29, 0x25dfdbff, "", [@generic="9a6bc3b1a032963cad9be5b6aec7f6aca5631176eb6ed245751c436e761c71b94594ff4df2be653c98f7ea069683ff96a820af94c2fd4b42d5f5f5555976b5b97c4a3cd05f76719fdfcfa1934cf1d687fdeb2e11ff66b5acae2521634e8938309d0f6b211acab32621d691f0ac3767904c5517b420995aaf6be35d99610b5d8770bb9b9069e0ca63fce3522c0552fba7a8f56d61a1d1e9ad271ebe666d06868b2d339036d217d4c33619a35da0a0fc75eb13b514fbd89736eada730e7513c4538f5e1691ed41350bee9c23134680c712ede67a5f2f52538c35bdf3de88f0f576e0", @generic="cc946a29929386d749e0838c6a471b19e927dcb8b196784bd4"]}, 0x10c}, {&(0x7f00000032c0)={0x2b0, 0x24, 0x1, 0x70bd2c, 0x25dfdbfe, "", [@nested={0x6c, 0x5d, [@typed={0x14, 0x8e, @ipv6=@mcast2}, @typed={0x8, 0x41, @pid=r5}, @typed={0x14, 0x87, @ipv6=@dev={0xfe, 0x80, [], 0x1a}}, @typed={0x38, 0x70, @binary="4f68b299227ea5d80dc1e214288e39f0d5b564214d68e390b584315bd9cc29f13e2e8031534e533953ad4f147a03578215"}]}, @nested={0xcc, 0x8a, [@generic="c720970fb1a49daf0aea5db3e1ca49c177a6f76a3fc5a869740559b20fef27657c5dc0a3277320f31a7801122583edfdae0e1a8d3fa1015b2a3b2a3efb204e6c5406adeb7ec488bdb3507f675391dc10af8362594bdc24942727febbefe7be5bb0aa45f0c0d520d423f6065fca8726884304cecef1871ba778b83c725f3481d2bd5db3bc4d338900d18738991530e12fe7170348dea3f59a4fd8a334f2edf6d0f3e231b00567775025f1d8cc6a47034a8c5969bf1e74e7a4c74914d05df9a5d9c8461bf2e4c62aca"]}, @typed={0xc, 0x1, @u64=0x5}, @nested={0xc, 0x35, [@generic="518a4400f3"]}, @nested={0xc, 0x5a, [@typed={0x8, 0x4f, @u32=0xcc29}]}, @nested={0xbc, 0x26, [@generic="239410773ff13d15b8f71e0c9cd3afae71a00a6106ebad1001df28084f30ca833eb880d3e6801712b3c551f07d8bd413b4d2b17e09e1865fba6ba2fefb3d91c50b068e3adf727b72a70254937432ea5e853a2d8e714f427eb609ee87", @generic="663efbc2f2088b1bfc50a6badcd48a34cffc8d3c49a4fa35fd56c8215d4f9eac95baee4760fb5894183e25c6a934ade93023dac4ced223bfb7d70c7928e9d70e67e442cdc68674ce19d365be1a4c82903a4cce917d00c04f1f55"]}, @nested={0x88, 0x43, [@typed={0x8, 0x44, @u32=0x800}, @typed={0x8, 0x52, @fd=r0}, @typed={0x14, 0x8f, @ipv6=@rand_addr="0751cd308e16748bcfd6851280b10e9a"}, @generic="c6577d36e2293de96f607f3b15771899be1dc0e4dd0999264e9f14e94787bf35f52d544aadcb441b143c4af1b4dd6d707e3367ce6e0404425ae43ba4038070afdf2367ee265ecd1d5c8ab6", @typed={0x14, 0x8d, @ipv6=@loopback}]}]}, 0x2b0}], 0x6, 0x0, 0x0, 0x90}, 0x4000000) readv(r1, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r1, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) 02:24:39 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1268.291551][T23444] binder: 23443:23444 got transaction to context manager from process owning it [ 1268.318596][T23448] binder: 23446:23448 got transaction to invalid handle 02:24:39 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x7a00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1268.478078][T23555] binder: 23506:23555 got transaction to context manager from process owning it [ 1268.503317][T23556] binder: 23554:23556 got transaction to invalid handle 02:24:39 executing program 5: r0 = open(&(0x7f0000000500)='./bus\x00', 0x141042, 0x0) close(r0) syz_open_dev$loop(&(0x7f0000000540)='/dev/loop#\x00', 0x0, 0x105082) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0x526987c9) read(r1, &(0x7f0000000200)=""/250, 0x226000) 02:24:39 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r1, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dlm_plock\x00', 0x2, 0x0) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000280)='TIPCv2\x00') sendmsg$TIPC_NL_UDP_GET_REMOTEIP(r2, &(0x7f0000000500)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000780)=ANY=[@ANYBLOB="dc0100000568e77927d86432ebf5ae5ecb2046221817b5a5f5587b5aeb743883e74424aafa9335913fd231bb685f10dc40eff960df92214068579821082feb33ef1dee", @ANYRES16=r3, @ANYBLOB="040027bd7000fedbdf2516000000240007000c0004000080ffffffffffff08000200080000000c000300f7ffffffffffffff3800020008000100c8b40000080001000200000004000400040004000400040008000200e141000004000400040004000800010003000000180002000400040008000100070000000800020009000000d40005000800010075647000080001006962000034000200080001001c000000080003008e000000080002000300000008000300ff07000008000400ff0f000008000100040000001c000200080004000500000008000200ffffffff080002009b000000080001006962000044000200080001000f00000008000200050000000800010002000000080001000800000008000200080000000800020001000000080001000b00000008000200030000001c0002000800030007000000080003000700000008000400040000000800010075647000280002000800010008000000080001008000000004000400040004000400040004000400040004000c00060004000200040002004c00090008000200f8ffffff0800010000000000080001000700000008000200ff7f000008000200040000000800020008000000080001002000000008000200008000000800020005000000"], 0x1dc}, 0x1, 0x0, 0x0, 0x800}, 0x20044880) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r1, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) 02:24:39 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x4800000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:39 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x1000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:39 executing program 1: unshare(0x40000000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x0, &(0x7f0000000100)="0adc1f123c123f3188b070") r1 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$IPT_SO_GET_INFO(r1, 0x203000000000000, 0x40, &(0x7f0000000000)={'security\x00'}, &(0x7f0000000080)=0x54) getsockopt$IPT_SO_GET_INFO(r1, 0x0, 0x40, &(0x7f0000000140)={'raw\x00'}, &(0x7f00000000c0)=0x54) [ 1268.888764][T23565] binder: 23564:23565 got transaction to context manager from process owning it [ 1268.896227][T23570] binder: 23563:23570 got transaction to invalid handle [ 1268.922932][T23567] IPVS: ftp: loaded support on port[0] = 21 02:24:39 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x2000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:39 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x4c00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:39 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000044ff8)={0xffffffffffffffff, 0xffffffffffffffff}) bind$unix(0xffffffffffffffff, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) connect$unix(r0, &(0x7f00000bc000)=@abs, 0x8) sendmmsg$unix(r1, &(0x7f00000bd000), 0x80, 0x0) connect$unix(r0, &(0x7f00003de000)=@file={0x1, './file0\x00'}, 0xa) connect$unix(r0, &(0x7f0000681000)=@abs, 0x8) 02:24:39 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") timer_create(0x4, &(0x7f00000004c0)={0x0, 0x30, 0x2768b9813d9cb38c, @thr={&(0x7f0000000480)="6cd0b70220c3f14257954be3c3caddbaa0033e267fd4681624ab590863c129bd18a010de427bb462db80cd51d6f96aa89be8877a1172666fa530e4", &(0x7f0000000c40)="a2797b547b591c4c6c149abea1940364684000e9f456ad55c4207f97f4b6f88604ccea4ee2e4bb80b512a2e538d5d570834375d48e1318bccbcd10d5e28e8e2d75992c3c3b863309b848eb15f00cf60e48c642a3872250f49d16aeec2244c21576529bb4deb1ca2a6bc624ddd09214ad2efe815f63016f901b8881ea0743262c9b999aedd5b572c706ad0ff0456d7dce032213a73c30a96d838c8381860b24cf1479a81dfbf674e5c498352f7b990b3d9e56de5c7ecada8ddece7d40b44fa4786a954eaef6e925bf113baab904"}}, &(0x7f0000000640)) r1 = syz_open_dev$swradio(&(0x7f00000003c0)='/dev/swradio#\x00', 0x0, 0x2) ioctl$KVM_ENABLE_CAP(r1, 0x4068aea3, &(0x7f0000000400)={0xf9, 0x0, [0x0, 0x10001, 0x0, 0x1d]}) ioctl$KVM_SET_CPUID2(r1, 0x4008ae90, &(0x7f0000000780)=ANY=[@ANYBLOB="03000000000000000a00d5400500000002000000000400000100000041070000070000000000000000000000000000000100000006f6ff000300000007000000110600005b6a00000100000000000000000000000000000000000080090000000600000003000000030000000000000000000000fb89d41cb05236024cc9aa6a23dcf37101b03b236384165f88502e07dae9961b79e1b905aa503d18d049be4e7bbfb20f5a86d26226ebbcb0b2453ec34e0b12b7df5211b7be325369816f529d6ed4e5be328c"]) r2 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000580)={0x0, r1, 0x0, 0x5, &(0x7f0000000540)='\xe2&]^\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000880)={0xffffffffffffffff, r1, 0x0, 0x7, &(0x7f0000000700)='hwsim0\x00', 0xffffffffffffffff}, 0x30) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000b40)={r1, 0xc0, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=0x8, 0x0, 0x0, 0x0, &(0x7f0000000980)={0x9}, 0x0, 0x0, &(0x7f00000009c0)={0x0, 0x0, 0x10f, 0x1}, &(0x7f0000000a00)=0x9, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000a40)=0x5c13}}, 0x10) r3 = openat$cgroup_ro(r1, &(0x7f00000008c0)='cpuacct.stat\x00', 0x0, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000ec0)={r3, &(0x7f0000000d40)="0bccd338dd6f91966dbfb25e2e491dbcc57b032cf74cccdb3a8f2af410382963a52f51932a1fc7caddf30aa22f6ea1c5f67f033a24ff9e290f16f0d1218d4000deff9afb6732f5e7e5745d2f26be82b9743a2970df65e28196e33ec9d32ff68885fbc827c0a5a40bada016f38ea6d2a4a7299505c39cae67d25f5a799aa8b9840e7607e3085e89731b35ced18604a30d00189986770704b75291b72515828ee8a363ab92e42dbcf7b5838247eefdb475128ca5dfab75fa35d4d21266afdd50a06eefa393efd3539d4410073ac7b70908b6e98bd10ff9030a2f50a1a38cf98ea719e2e88a52f0bee939f8aba57e36c0c939ed0045d4ec1b", &(0x7f0000000e40)=""/117}, 0x18) ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f0000000b80)) r4 = getpgid(0xffffffffffffffff) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000c00)={0xffffffffffffffff, r1, 0x0, 0x2, &(0x7f0000000bc0)=':\x00', 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000900)={r4, r1, 0x0, 0x23, &(0x7f00000006c0)='[-vmnet1eth0{ppp1^keyringselfnodev\x00', r5}, 0x30) fcntl$setownex(r0, 0xf, &(0x7f0000000500)={0x0, r6}) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000680)={'hwsim0\x00', 0x2000}) write$USERIO_CMD_SET_PORT_TYPE(r2, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r2, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) timer_create(0x0, &(0x7f0000000080)={0x0, 0x29, 0x2, @thr={&(0x7f0000000280)="ac9afe8c56cda185bce6c64bfe41ad24dc2067a0273b5970d10a88593e547a123616f1274fb5dc1ec2d1dbdaaf8185c20e27f92292e03ef7c38db97d7c9708632ed2ed8745c9338c16bd60428f55fb9af54348a6e15ad9fe47b8a1309885fdeaa4a679642d197013c6e30a5113ee3dfaf00d208fd5f2d16cd7d7aa95bce9bfa408a42f3dd9aca948199b6bed489cc2c31dc1b1c63d2cdfbd1e9f3e25d3dfd79e5fd84b91775ed1bcf76b960b06fc736c2f1a1e475b14cb4c6af2958a42432c5d0286e6", &(0x7f0000000040)="dcb8adf003f8c4f68805961cec8811056895752e8b34ceec8bc7a5fb3e8aa65bdd7cf5ce3802010392eb992c0e4d"}}, &(0x7f0000000380)) ioctl$PIO_UNIMAP(r1, 0x4b67, &(0x7f0000000600)={0x2, &(0x7f00000005c0)=[{0xfff, 0x80000001}, {0x8000, 0x3}]}) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r1, &(0x7f0000000140)={0x7ffffffff000, 0xfffffe31, 0xfa00, {&(0x7f00000000c0)}}, 0x18) [ 1269.144186][T23681] binder: 23678:23681 IncRefs 0 refcount change on invalid ref 0 ret -22 02:24:39 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x3000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1269.196044][T23685] binder: 23684:23685 got transaction to context manager from process owning it 02:24:40 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x6000000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:40 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x4000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1269.369567][T23770] binder: 23750:23770 got transaction to context manager from process owning it 02:24:40 executing program 5: r0 = open(&(0x7f0000000500)='./bus\x00', 0x141042, 0x0) close(r0) syz_open_dev$loop(&(0x7f0000000540)='/dev/loop#\x00', 0x0, 0x105082) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0x526987c9) read(r1, &(0x7f0000000200)=""/250, 0x227000) 02:24:40 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = openat$userio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/userio\x00', 0x8080000, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r1, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r1, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) 02:24:40 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x6800000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:40 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x5000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:40 executing program 1: unshare(0x40000000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$IPT_SO_GET_INFO(r1, 0x203000000000000, 0x40, &(0x7f0000000000)={'security\x00'}, &(0x7f0000000080)=0x54) getsockopt$IPT_SO_GET_INFO(r1, 0x0, 0x40, &(0x7f0000000140)={'raw\x00'}, &(0x7f00000000c0)=0x54) [ 1269.857535][T23814] binder: 23811:23814 got transaction to context manager from process owning it [ 1269.868924][T23817] IPVS: ftp: loaded support on port[0] = 21 02:24:40 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x6000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:40 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000044ff8)={0xffffffffffffffff, 0xffffffffffffffff}) bind$unix(0xffffffffffffffff, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) connect$unix(r0, &(0x7f00000bc000)=@abs, 0x8) sendmmsg$unix(r1, &(0x7f00000bd000), 0x80, 0x0) connect$unix(r0, &(0x7f00003de000)=@file={0x1, './file0\x00'}, 0xa) connect$unix(r0, &(0x7f0000681000)=@abs, 0x8) 02:24:40 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x6c00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:40 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") socket$pppoe(0x18, 0x1, 0x0) write$USERIO_CMD_SET_PORT_TYPE(0xffffffffffffffff, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(0xffffffffffffffff, &(0x7f0000000080)={0x10, 0x30, 0xfa00, {&(0x7f0000000040), 0x3, {0xa, 0x4e22, 0x1, @empty, 0x3}}}, 0x38) r1 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000280)='/dev/vsock\x00', 0x41, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000500)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x111, 0x7}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f0000000300)={0x16, 0x98, 0xfa00, {&(0x7f00000005c0)={0xffffffffffffffff}, 0x1, r2, 0x3c, 0x1, @in6={0xa, 0x4e20, 0x1, @empty, 0x3}}}, 0x474) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/vcs\x00', 0x402800, 0x0) getsockopt$inet6_opts(r4, 0x29, 0x37, &(0x7f0000000480)=""/68, &(0x7f00000000c0)=0x44) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r4, &(0x7f0000000440)={0x7ffffffff000, 0x5, 0xfa00, {&(0x7f0000000400), r3}}, 0xffffff75) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f00000002c0)=0x6, 0x4) [ 1270.027809][T23923] binder: 23922:23923 IncRefs 0 refcount change on invalid ref 0 ret -22 02:24:40 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x7000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1270.113373][T23947] binder: 23942:23947 got transaction to context manager from process owning it 02:24:41 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x7400000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:41 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0xa000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1270.312678][T24039] binder: 24038:24039 got transaction to context manager from process owning it [ 1270.351669][T24041] binder_transaction: 23 callbacks suppressed [ 1270.351686][T24041] binder: 24040:24041 transaction failed 29201/-22, size 0-0 line 2995 [ 1270.353989][T24039] binder: 24038:24039 transaction failed 29201/-22, size 0-0 line 2986 [ 1270.413246][T21261] binder_release_work: 23 callbacks suppressed [ 1270.413255][T21261] binder: undelivered TRANSACTION_ERROR: 29201 [ 1270.499655][ T2988] binder: undelivered TRANSACTION_ERROR: 29201 02:24:41 executing program 5: r0 = open(&(0x7f0000000500)='./bus\x00', 0x141042, 0x0) close(r0) syz_open_dev$loop(&(0x7f0000000540)='/dev/loop#\x00', 0x0, 0x105082) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0x526987c9) read(r1, &(0x7f0000000200)=""/250, 0x228000) 02:24:41 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x6cdc112d, &(0x7f0000000040)="fbffffffffffff000005071ae30cd08f970c8864") getsockopt$XDP_STATISTICS(r0, 0x11b, 0x7, &(0x7f0000000080), &(0x7f0000000280)=0x18) r1 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r1, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000600)='/dev/sequencer2\x00', 0x8000, 0x0) bind$bt_l2cap(r2, &(0x7f0000000640)={0x1f, 0x9, {0x2, 0x20, 0x6, 0x8, 0x9, 0x6}, 0x1ff, 0x6}, 0xe) syz_mount_image$ceph(&(0x7f0000000300)='ceph\x00', &(0x7f0000000340)='./file0\x00', 0x1, 0x6, &(0x7f0000001780)=[{&(0x7f0000000380)="cad703cddd815d374883778ec1ca32be83ee28a9d0bd81b990b5ae74b075597a01141d60d899b490c48be98aed30946e00c7fb2d3fe6c67515016a9d3ec9288c150350e18c07a55a32291b7e8b1d4f6df9878ddd5cf1a1ade1abc249ee2ad7f54cfb3169354c1598ebafcab56dcaf14de36d30b4560f727d35cd1d11cba88a4632f16b223a72f59f31086d83037d9b3e3445bae1336c014006af3009944304cb2308b6e4efc0b97eab2adf1a55d8c39c7fd3228f791eab8128d51ca9473bc232", 0xc0, 0x4b}, {&(0x7f0000000440)="b5ac132c0fb0afd1241e3dc14eab39f7758cb0703606803d1b0df28aa9f553c01dce944b252d2a9be05525eaa048a54c96a33c58eadbfe02ad949cc2e84e81c1e9aaeeba2ee841059dcf41b1074dd531cfd24283b7c53a3d4a1edc67809cbc775f9e5f9bf47b5eb944725e58d3a00c1c51d04deb1c9f3f699a92c11534650b27c09ab02f3559118f9d0ce4234892b395a9c368ea8028b05a", 0x98, 0x7fff}, {&(0x7f0000000780)="52da572db217330499b04264c330a1004c89a827c2100942a2648efb0a12d8d5afbfdd8200e00301c089902dc96284293cf9894ee4da7515fcdee75a9d23d9ec67c9ad1aab9a5a25a0224c3e4929b8b8fb6fb26161278fa651109c2ade8b0da613d18400f077a9e0177f006d6725dd84108866b268796aadcf842d7e5f74f2eac468fcacf37231ecb02c2042a67eca02e9d8672fa8f43d828a3487c489a8e14a1bb2ce0eebfc71db6580811dab9de12861067cd7ba67beef5074f49066ec1f3ebdd1eac84d2e3160a53f6379cec0073d694fc6cc42374c8559e09953dad6b64a82a2aad9f128cc4ebeb077ba111e498511b22d81f624e8936ae966817fda370c3785321c3fab9e83fa0e7655062b481ab5024fb1a8b32c50657249f6f588bc8b8b3ab93d95c3d8046fe24b54701f144373ed88050f15e353e34c913688fb8ca0a8c816d8bcdd6102f259cf88077fce9c3555f48510f8968c8fd66f61d735d8826d683aa3ae4495bf5ba71f0fa813592ab7df7a0f472368140352f2f60c982d4b08140501f09dbf258e03f02fbe652422f359ac0178177be7d1a0edd9c151a8a91c3eb02acc27c85f1103523346b27dfef463ee9040f8050b7625a430e944538d3c8d152d878c8bdd2c11c39fc95e62acef2e08f0488b4a3f5230e858cc8eded5d1b474f3f7dd18a1aa4480e1f9276c5986da8c86d8f4d661ea8199c63cd208f374cbe115c3fbc2b8d41cf0b356b0aa094eba3cf7577cf6bd5f618f13117e8be67951f7cb1062f89eaebd45ea0312da8cd87656597dff5d6bc68416b16098e0aef4a223e2169fb3f038069523ea1da54f0892483f88172d9fbbc5a66a1b72bf20778d83a79c43fd303cd13b32927936250b1690fcb4b7873824e9a22a2280e909ea94627af04b25299e9380bb5990c16a449163e9dc65b2bc03765d8e5298518beca074589bd33c1b0a1edf3703790aa419cf9f11525bce1970ae2e30bf545890cf7963de07ead91c8a77920b55c7c96415a23f7ea6f1395b6159902214bc482614ecdbfb637a78fb6b72728ed79690c8ad38e41ce83460a2d632090989da71880c54e977824ad03be26c9e44631dfb69f9f1a39b7d82ea122dc9ad57a076ef68da39838a2689dc9cfcc3db5dd419bcf4353f1d39035ce7527e481120c0b95c5c2e835048824a4d1c1b3d3f27d0a91df16121231907ff331ed99e8814fe212adcd43aaf87eb279a28ae321bad96638c7523c73e2c5ac99362a286c730bb4e05c15fc45426c08cbcf71a6f3d134936c45cf6729a7290d49e08762fca08b7e5306a325b6a1fc73e67a415d2ff650d203487e1e0268450325fcbf27980b66cdcfb770c53734d56e71b29c090bdd644187f10704989ab0270fedc6f7d6d9fa48313d1781ba42f1b6516c85e52884f8839de3b80c1ed5412de624a9b594c34e07f40ad065e63b144b09471a5286550bc07d966ebfae42a7087554661879d8888b7ab37f70f1e2a27095f1624f06977b50222de96e229cb1670c82fcce51ba7ecb2ee8ea9aa3314161bfe9296ff290a472d12e236bb0a283c58ab389db4037cfad89d91bd4237e614c9b8073ac952dec5a82a799711320604e1e4fa893d452c2c214a06c61a924e8e5367421fe870cb4295dbde37b61ed1251df8827c31209dab2ae4b8fe1a55b11143c4d70f0b52b4265c3539fd7b9af236f4de236abc3d1ad8cd41ac146587c2c84d629c9c2dab1230a202068e9d502705de1f3f1263badf572d2169a4d2c479f6289a9c70ef39c73066ed5763db048195cd22193ebce1dae8dac5cbdcf41988284ffa6c687a9050adea23597ca570b50d13ca0520d45924a41498a8df4fd9ec1449a4e0bdf393f250511bc1d9378dc51c6164c170b5127e33fe2936ca72de8c468e6b34a23f73f23e7d7a9cc68ec61b4876bdd4c4a008b3e5b9b51e3720328d720d938ea53cf9679af542968360ddb468ffdce5d0e821f254b41105b21a9b598fe17ee1bd659b1945e8167f45e35495ab75a5e68a310831849ef10a6287fea01b733a13c0bb59f047c81b45d922335cb044619d76971f51d651390973ac02861ad11d8c55856ad37e654264735391e28b5cb00523645d6761356462cbe2c310b4c2d53aaf507604151b8918dc3f44544d953010cb3bf7f0ac61d020b3cdfacbbffc7137ec3e21effb1d61a7ab02796abb871aede5e831fc2da86230adeff3c69c283c8b95ddaa9d3d232408f268fadb5d1226135d2b933776632394dc7e66a82b3329c314f8049bb7123aaaf8b8c6f16ba9d8078def7354727e2b81fa2a3f0bccdde863fd2af0c4babe1fa1191c4aa315c853f51542c5821f452d39a6a18b05bec81601d53a60d7f47693a8e8dce6b1c958104ac6d90c88cc3476c02979f76bb1a9073ce5b43b4f5f978128c56cb03bf9c7acd7c8c43854c9e45ad98810084826694c9c67c876e4fa01cbd01aa6b30767fecba7ca9bb296f5c86b097f05a12036f39ecfee942fa0fc3c139b18eab3e92eac44516ccfee212efad3883231f05697126c401b1ef01e4de19ace9b4dc031c09d20dcf42959f9bc3cc9750d33c541b81e24b61a91fb619f2faff0cefd17f9a4bc684fee50bc02cb5f8cc9dbb6e2f003f7ae970296f2c39d64bb8670e0fffb754d4d6880f6d3ec757ddd169e1140ee40661541811d3f203f96d8a8276adf4c1e97e20837564e94d95367fff0f2095eecb9a811e8a83415d33b0607703466a766238a86b6e8b893d51ead5e1ac6692c40358db28a3acb4a0547d03d4ff09540e26e7dccdcee68210815b6b848f8f922488d555114c12bd24a0b7bde3966c57147024e1d8489bbcb990b067eeab6ff43e9e6e0880c65b5f87f0c48b0ecd49b4d96dbda2901f6c5b33eee467523178acf5d68c0040dc5c035ea4a40adaa668ea19bf8afe3d83a6fc67087eb0d7b9ed3da02dd2a76615efdd75fffa13cc89f16519d6824471b78f85d9703917bd2910ecbbb7af7179f6554d21d557768081f0a2f8534077ad2fa879f246e856e546bacbef8e78439a6a1e5ce09d7248919187bfc765a54fb29b31a6cc9a1c785971a317c755b2278e6e2f48bb8fe5b5a67eacd667013cd053d7ce0ab79f7cfe385d7dd91da90e69e7fbb8370a510c8a516e1b7d5d5183c1aa2fd8f3ec931c8ca678efc611dcad27af6cdb323e028b6cfd5929b0eeb9c826b93d9434b177745217fc46b83395d032357e460af412db3ef5ad068c89cf930a66119ed812cf6cd712ae43f4cf69e17c0dd3c46254bc0170ce2d3538396094089c8451a8a194523c8beb3aeb40ae89417ab4e1f69c73b5706b32ea63bd9cd84f41113f5f2a0ca0920426abf4c453b3812db4a18f59aaa9faa65867a3c78ffcb63e78d8783ccf1ddaa9af976a241f2752398c219d580be3c21bc159c6d5c19c37862ff9ba20ad34c31bcdf59341a9a116e8c2514ba9c78919583af14d538ddaa11c8a3e4bfea45c7361049dbd15e1faad09c303f7e0f357e3fc484d352de27f8669452a8f8ed832767b757d0f83ceb59be38e11eced5a1d9ef3447db1af800d30ad145618d764727a7c1def188c893ae6a14c8ef17861e7eb556e66bd2a6c4e4ba0b0f7836ceef8cceb5c3fda9fe29acbae12d63f3c8fd341c62bf2421bb746af4af465e4f3a01795f04dbf69b11ec5b544af417649594235d2e8325f6b7580519a06719b975ceb942bdb3728f21ba56905ac70b74ffe87bf5f4ddb7552720643908a1fd57e3e120c2c2f055d8a43904d829a8c272ce0c9f8811299a129bf1d54d5d07888a5c6cccb7bf90f09f4b868f25d75fd7faa2ab0f15d0d330f69c3ee22ce68583abbd2df36427917acf502ff549771d75021462aed0561b79610566997cca23cf63ec94a4d2aa7043cc3a63609e087a21b1d0110c407f3354465290e68371524ee76f9c27710a66c351761b78b9ecc5d01a8bd2a18e928f44629b9599ebe7f473690e5501048d337846628d6263758f7f1e469794a3b06d98d3c13b434eb8706c2d2590c79caa5e2042eb8def61c163693e77f1d04ef29feae1389357ee2e8e3f2fdcdab6a32299075f54ba7c5dfd00175be729bd1413257c0e895261b8a94848386bcc5aa5d9342aaef33fe142764fc74817fbed02961574ece1e5c2cd1d4332dcb7f2d55d3cc0dea4fa2f08819c7d714fc5b47280e666ccc96dcf7ba139cc5278c5abcc5180901f7632d450be76ff7b1d565dd859eba2cdf3cf1b93dcd7fea142f4f20d48c9cdbebb537a89313ee4f9502229b561e846dea0e5fedcc39ea41c2c851d43c920d9676fe164fe73a9860dea600132aa201e3bfc2f202c415dd184bb5f5308b2d86d60a3824665351b2673839e8d94c5886086576e5af4f7b61d876da16efe4cfb8065d5be1bfa7c30d63e41cefe7ffce386791942bf98c0a623f0e0859e98922ce428b275e6fd6cb71ea5c54e5b900c8a8e6cad233875876d7637e54b73f772d710cf7a37360d42e50d3b10359fe8bc64fe55e5235e349089d49e024a905bf1de8db185d83c3a0dc235a8c871db4f03e161b695fc0049a9e8b637e71d7ff62f3358f5ed83c360d5684541516140a0c12f38e54796970d596074565ffe77209a49407a722cd4f3bc859a706f4f937a1f7263df59ac29c8e739c76e55bceee175f1d8e629267523b322769fbed89432149c51cf03adc491e5f92c32cb185466593b9aed8b2c246aa35ed3d4991e0d245fce52cf66091bc23059eb8a5f1843603f36cc2dc0bbcff9fd72d7cf587eaeaf7e7f4fc7b865a59f6bcf7ebeaedef66f8962a7d7ef34bb798486773e7cb2272d2b217146c4480ed2e5602a87b41b4f5f1e3f02d4ce3a869cea16ed947d7cdf17a7e070e390b67b85c5b3523b60a1fd3b931a8541417312bff6f3f21216f31bde4d91c96ee918302b699b016584a3277e719de8c00b50785e47a9ff121e10da930a55af677f40e47b0a1db17dac1dbbe67af559e6d98777da83a927bd6e5aec7ab6afbe2d5c58efa11100b777286124f1b7df5108da88b5ab6565ab1734092f6fc7dcbda153f8a2175d8075ee6469a4e6b2a4bbc702d8fe8207e4744a8928f0ad51fb098ebca7bf0142a20016c88b2c56ed2c8c0d23e1934d0115523cad89cea44886146c12bf979298a18e035475c277cf57e6bea81c631849f2dc691eaf10a08fa89ea4061061fcd6560b339dd0bbd906998214c80aae44ee0cd3ae2642b015e77ec55942292f7e52079e5a36ec7b2c12284545a2acb0f7b59cf293095f21fa1e1a949f84000bd3651ae4d398b48cad0b32b97ce3d0169ce28741c7b3df333408ff0995e443c500cbbde0e55d92084d6b1a242a9eb54d27611859c1b34c06784a794b3f0a38bb086358482a07ffb5dd59446043059992fc6347a880e803b128d21896e705dbd25e941b9c9235b3005fa220d2ab2516597780a2c1c650a50a6616ea8a035e9ae558e37c3ad34900488bf792767cbb909b7c86dd126f655c064bc8510ce5ba4ca97a87c983a7f89c6a4495206c3d9388e34bb50e414ddce9a7d6142027ea6c6dad49117624a78273156adc2a952ad02b7b055baa2aa451aaf41aa75868e81ee4cdde9dd99633c669a2ef4cb4ac861511222cf02ad6f6d9e49bfaab61effeaa474c1cc6345aa072ffceab5cc6f183d43f7a905adc586185bfe2b8cf7c787dc4f2a2fbfd0d0ef6e3033f51740bd4d8d06ae0b017b8515e623daab02edcfeb5e01a3a12dbb353b963b0879992d0ba8cb31df7b2fc566a5e1d22dd036f22b34a5b36c4fb9765ac2d23108122c5", 0x1000, 0x80}, {&(0x7f0000000500)="2ebba210470bb5528851ec0a92639431206ee40b8b855c6fd1638ad57469020b3aa92d357aff3ab5bfd2d4aa32ac7c3e543bd18a4dbe2a1a59e66e70f80edf32e0b8b1280b322053c2bf36359f40cb2afda5b781cf5a7acfe829c26bf0b52d86c0adcf73206666e5b852d2902cbda75bc0f3307e00e24734668bcab132cff4ef1543bd940dea766020bf46aca4bbce7f2e2b6b9b", 0x94, 0x4}, {&(0x7f00000005c0)="0e60950ea29e795083a05e53fb6af894353c51e76510f5314099e8", 0x1b, 0x400}, {&(0x7f0000000680)="d1bc3438931826", 0x7, 0x6}], 0x20, &(0x7f00000006c0)='$ppp0ppp0eth0keyringvmnet0&\x00') write$RDMA_USER_CM_CMD_LEAVE_MCAST(r1, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) syz_open_dev$dspn(&(0x7f00000002c0)='/dev/dsp#\x00', 0x5, 0x2000) 02:24:41 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x20000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:41 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x7a00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:41 executing program 1: unshare(0x40000000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$IPT_SO_GET_INFO(r1, 0x203000000000000, 0x40, &(0x7f0000000000)={'security\x00'}, &(0x7f0000000080)=0x54) getsockopt$IPT_SO_GET_INFO(r1, 0x0, 0x40, &(0x7f0000000140)={'raw\x00'}, &(0x7f00000000c0)=0x54) [ 1270.866322][T24054] binder_transaction: 7 callbacks suppressed [ 1270.866333][T24054] binder: 24047:24054 got transaction to invalid handle [ 1270.881487][T24051] binder: 24050:24051 got transaction to context manager from process owning it 02:24:41 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000044ff8)={0xffffffffffffffff, 0xffffffffffffffff}) bind$unix(r0, 0x0, 0x0) connect$unix(r0, &(0x7f00000bc000)=@abs, 0x8) sendmmsg$unix(r1, &(0x7f00000bd000), 0x80, 0x0) connect$unix(r0, &(0x7f00003de000)=@file={0x1, './file0\x00'}, 0xa) connect$unix(r0, &(0x7f0000681000)=@abs, 0x8) [ 1270.907411][T24064] IPVS: ftp: loaded support on port[0] = 21 [ 1270.928866][T24054] binder: 24047:24054 transaction failed 29201/-22, size 0-0 line 2995 [ 1270.948182][T24051] binder: 24050:24051 transaction failed 29201/-22, size 0-0 line 2986 02:24:41 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x48000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1271.018720][ T2988] binder: undelivered TRANSACTION_ERROR: 29201 02:24:41 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = syz_open_dev$mouse(&(0x7f0000000140)='/dev/input/mouse#\x00', 0x100000001, 0x80000) r2 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0)='nbd\x00') sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f0000000480)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x40040}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)={0x20, r2, 0x108, 0x70bd28, 0x25dfdbfc, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0xb}]}, 0x20}, 0x1, 0x0, 0x0, 0x80}, 0x40010) r3 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) r4 = syz_open_dev$swradio(&(0x7f0000000040)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_G_INPUT(r4, 0x80045626, &(0x7f0000000080)) ioctl$PIO_FONTX(r4, 0x4b6c, &(0x7f0000000280)="b226d97d26073932f47cedf3d3baeb83d6fea7afdb9c45ded8c24a3542a8e213d3449bf9c56b67a695f425be3c3e82b320d6c0015ec140cf8d2a7cc5156bb287ae53f2ffe8d68fac1fe38df14d4bc2e7e54505d346c4a8c3d33268590a") readlinkat(r4, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000300)=""/79, 0x4f) readv(r3, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) 02:24:41 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0xfdfdffff00000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1271.101665][T21261] binder: undelivered TRANSACTION_ERROR: 29201 [ 1271.150480][T24166] binder: 24165:24166 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1271.163179][T24200] binder: 24170:24200 transaction failed 29201/-22, size 0-0 line 2986 [ 1271.177543][T24166] binder: 24165:24166 got transaction to invalid handle 02:24:42 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) r2 = syz_open_dev$mice(&(0x7f0000000040)='/dev/input/mice\x00', 0x0, 0x200) accept4$unix(r2, &(0x7f0000000280), &(0x7f0000000080)=0x6e, 0x800) write$USERIO_CMD_SET_PORT_TYPE(r1, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) ioctl$PPPIOCGIDLE(r2, 0x8010743f, &(0x7f0000000300)) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r1, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) [ 1271.208420][T24166] binder: 24165:24166 transaction failed 29201/-22, size 0-0 line 2995 02:24:42 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:42 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x4c000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1271.263807][T21261] binder: undelivered TRANSACTION_ERROR: 29201 [ 1271.298578][ T2988] binder: undelivered TRANSACTION_ERROR: 29201 [ 1271.338087][T24276] binder: 24274:24276 transaction failed 29201/-22, size 0-0 line 2986 [ 1271.394474][T24328] binder: 24326:24328 got transaction to invalid handle [ 1271.438636][T21261] binder: undelivered TRANSACTION_ERROR: 29201 [ 1271.458059][T24328] binder: 24326:24328 transaction failed 29201/-22, size 0-0 line 2995 [ 1271.541499][ T2988] binder: undelivered TRANSACTION_ERROR: 29201 02:24:42 executing program 5: r0 = open(&(0x7f0000000500)='./bus\x00', 0x141042, 0x0) close(r0) syz_open_dev$loop(&(0x7f0000000540)='/dev/loop#\x00', 0x0, 0x105082) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0x526987c9) read(r1, &(0x7f0000000200)=""/250, 0x229000) 02:24:42 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:42 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) r2 = syz_open_dev$sndpcmc(&(0x7f0000000080)='/dev/snd/pcmC#D#c\x00', 0x0, 0x400) getsockopt$inet6_dccp_int(r2, 0x21, 0x6, &(0x7f0000000280), &(0x7f00000002c0)=0x4) write$USERIO_CMD_SET_PORT_TYPE(r1, &(0x7f0000000000)={0x1, 0x1}, 0x2) ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f0000000040)=0x0) ptrace$setopts(0x4200, r3, 0xfffffffffffffff9, 0x100000) readv(r1, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r1, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) 02:24:42 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x60000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:42 executing program 1: unshare(0x40000000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$IPT_SO_GET_INFO(r1, 0x203000000000000, 0x40, &(0x7f0000000000)={'security\x00'}, &(0x7f0000000080)=0x54) getsockopt$IPT_SO_GET_INFO(r1, 0x0, 0x40, &(0x7f0000000140)={'raw\x00'}, &(0x7f00000000c0)=0x54) [ 1271.890965][T24390] binder: 24388:24390 got transaction to invalid handle [ 1271.896717][T24392] binder: 24387:24392 transaction failed 29201/-22, size 0-0 line 2986 [ 1271.906518][T24390] binder: 24388:24390 transaction failed 29201/-22, size 0-0 line 2995 02:24:42 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000044ff8)={0xffffffffffffffff, 0xffffffffffffffff}) bind$unix(r0, 0x0, 0x0) connect$unix(r0, &(0x7f00000bc000)=@abs, 0x8) sendmmsg$unix(r1, &(0x7f00000bd000), 0x80, 0x0) connect$unix(r0, &(0x7f00003de000)=@file={0x1, './file0\x00'}, 0xa) connect$unix(r0, &(0x7f0000681000)=@abs, 0x8) 02:24:42 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x68000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1272.013163][T21261] binder: undelivered TRANSACTION_ERROR: 29201 02:24:42 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:42 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffff9c, 0x29, 0x23, &(0x7f0000000480)={{{@in=@dev, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@dev}, 0x0, @in6=@empty}}, &(0x7f0000000580)=0xe8) mount$9p_xen(&(0x7f00000003c0)='/dev/ptmx\x00', &(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='9p\x00', 0x8000, &(0x7f00000005c0)={'trans=xen,', {[{@loose='loose'}, {@dfltuid={'dfltuid', 0x3d, r2}}, {@access_client='access=client'}, {@loose='loose'}, {@posixacl='posixacl'}, {@cache_mmap='cache=mmap'}], [{@fsname={'fsname', 0x3d, '/dev/dlm-monitor\x00'}}, {@context={'context', 0x3d, 'unconfined_u'}}]}}) fcntl$getownex(r1, 0x10, &(0x7f0000000040)={0x0, 0x0}) openat$vsock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/vsock\x00', 0x48000, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000380)='/dev/ptmx\x00', 0x200084, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000080)={0x0}, &(0x7f0000000280)=0xc) r5 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/dlm-monitor\x00', 0x80000, 0x0) kcmp$KCMP_EPOLL_TFD(r3, r4, 0x7, r0, &(0x7f0000000300)={r5, r1, 0x20000000000}) write$USERIO_CMD_SET_PORT_TYPE(r1, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) gettid() write$RDMA_USER_CM_CMD_LEAVE_MCAST(r1, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) [ 1272.068276][T24501] IPVS: ftp: loaded support on port[0] = 21 [ 1272.094067][ T2988] binder: undelivered TRANSACTION_ERROR: 29201 [ 1272.128803][T24507] binder: 24503:24507 IncRefs 0 refcount change on invalid ref 0 ret -22 02:24:42 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1272.174760][T24507] binder: 24503:24507 got transaction to invalid handle 02:24:43 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x6c000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:43 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IP_VS_SO_SET_STOPDAEMON(0xffffffffffffffff, 0x0, 0x48c, 0x0, 0x0) ioctl(r0, 0x800000000008982, &(0x7f0000000080)) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r2 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r2, &(0x7f0000000000)={0x1, 0x1}, 0x2) getpeername(r0, &(0x7f0000000280)=@pppoe={0x18, 0x0, {0x0, @link_local}}, &(0x7f0000000300)=0x80) readv(r2, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r2, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) r3 = syz_open_dev$vcsn(&(0x7f0000000040)='/dev/vcs#\x00', 0x7, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(r3, 0x89e1, &(0x7f0000000080)={r1}) [ 1272.367054][T24617] binder: 24616:24617 got transaction to invalid handle 02:24:43 executing program 5: r0 = open(&(0x7f0000000500)='./bus\x00', 0x141042, 0x0) close(r0) syz_open_dev$loop(&(0x7f0000000540)='/dev/loop#\x00', 0x0, 0x105082) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0x526987c9) read(r1, &(0x7f0000000200)=""/250, 0x22a000) 02:24:43 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:43 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x74000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:43 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = openat$userio(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/userio\x00', 0x200, 0x0) ioctl$FS_IOC_MEASURE_VERITY(r0, 0xc0046686, &(0x7f0000000780)={0x3, 0x1000, "32b433ffb0c5f2ee5232fbdaef2dc0db2ee8383d15f7c121e9f1c4bb5830bcfd356f1bac948effc7ced8e61828ff6039924ac7482b6e47375bff30c19ce485128465e4167e014b24255c702e44d6b6c1ddac46eb04f305a3fa11d41014aeb96953fc5dd4c77d1a9dc4aa0eaeb02c341f63beccb5e4ecfcc8615ead87b28f9cfcbe9aadebf6b5786497064d517615004573c9b4f212b966e8bbc9b1ed51d68e329225c531c5b51e65d902689cbfe15571aa6a3bf58fc81d788d12bdbd5b8ec2eaf14fd0dc64b083301e27a9092496ce2cfa38dba224cb665633ba4feec4e36e232b7ace6c2912c14db4535449baacba994b9d1e6d2ca616852793b714a6f564e328e04ef6b47435cd4dea56f5f7bc1d799247d3fb727daea09b2a570448a98ba80c3655dee85976c871342be9fd07f2b260d5d4c953f817bc359e8d78e83861ace34ce0bdf04d970ce5f0bd590978ad7d6d10f408a6db428d71330440d59b5af946f453ff1f67ec989bd44001b967133f4fd5f254b91c794b0003a5ae019279f4c4dc997c171ec9f721387f06bf1ab54fbafb9b882fe1a8e058d857504d4d6ed78db71ecb5b70d59ffa81a81effd816b74bcaf37de0fbd3337f63f457925c92f3679f4dc92f165aeefb99ff37eda5c5ae44ea469e7e399a6a9be1ab70bea822b29ae7784f4463c25cd5b8b21bcede777bf07fdd0fa821de111b9747104ef48c5aa0ed13c6b331076eaa6d5737f6680d11a922a64a32bc9b03ac4842e2af1044e5c9bcef115cff58f6e456a41a8706e689ee90392c7c26d23122a8e5760371f74f9014c6cbb883ced709ab40ff3ef0dcdd205d3fdaca996ea8054c3b8d0a9c33df32a110a5ce98c994bf6d0df46e967788e17f3169f6e089d68a5f909831766449af6a8187e2b9e34723e61bcdad61cc0c3f8b25c5eb5f5524f752f91cea442d39b59f12198a7b06ce3dc8069c26040f4b84d3a223be6013d0b1cf92bcccb94169b4a89fbafbfb9897de8d12a483c67bf6b1335432b62bdebb4ca921b2c68aa28448f1d63d53f69d3171e8322285bfee957b4fd98a08ab4b7e2687a604f25d1109a0b5b1a2c5c687b814833407f2a46636c5dce3a28fd0a99581672ab3c5b952fe607aff0bfbb6edb92a555267787d3c3e1da55e13ddc2568cb1344469fef5291104bdfd623f3e74878476f19f22bd0a42ecaf82f371ce08f66bc0bfe6f5a3d404bd6e54f44f0066bc935b4133492715c527059c82227c3965bf1671569ef93e83be375e1ac26da9fa0bb6488d9f2428c51e8333d57ffa7519e6b15e03060f0eaf581f491512826b3b15b4ab029497c29b49a9a7b9f4cd0878014208db3780fd553fd7d2c18babf9aea5f1d04c23e0f8913ea7fd58d67447999b843c1337fdbb40d34aaf6c50802300f4ccafe0cc7bd95d80e37a051ffcd7f609c938806ff4967b4c9a1a34fade4b46ffcea5a5dc08155dd49333919e98f9071b09dac6648597cdd513a613b9eabfa52e819e18588b6796e8a7187d449620889bd6c6100f9b30d72696f4a377a01f2b446350134876711991e1cda5841d508f1ecc874094af18ab3000753524793db263c2f7b54f02b47e2764b986b1ea041205d53df1448d0ddf811717f8827b731dbb6331f95c85822d13f863db41959ecba3f02c4bfe9773b8d9e54eec584ed17fc427b19df4e2ec2e0c98fa14ae812a71885141b69fc777f53c594e7651be62c7e50f367671ae09ded57140c9a11481830d358902c2882aa8fbc02edf11babc6a7fb651e975040afacbf80f9bcba6a51a53eee89925fab58efc92fc058126ca14be10655f847e401a4fefbed9940eaffd15928b725e1d71c905734d2e8d3730d7952dae5e8ddf7b48002a455d3f97a60b4e503365a2fa0faf88bee56c74e2c89170cef84cd0fe30ab26ff20fd4ec31e45b2ea684270598011cf4284926b0cd5641352d47ae4fae6dd8714a20506ce0ebf1a8e75bd6ea10115f8266fb43d9ea42e68573db66f81cc2b85df2af4bbd8072451ffcd2fef869786ea105ba219b51c2342948f4f0909da60685bd9c0ba60443c3f830ea641c9e7aa9c608d4915143ebdccc9848adeb48d9ffad9db71f38a2321de5765d570b031c816348b03364a0f8c3956c32927eb4d492b2e96aed987d3a31bdeba58f983b3621a150d221d37e2bacefff17d31e895ff38a44cf1d2899ecb57c7ec9ce081d47ff221b049848ebc54eee6deae5257aeb07002cc24a3d4d0cb5bd141e55b481f4e93b09796dd62989bd8fd30ffe17c588f9203c404694cd9d25aa94e6841667a7d4641341bdc9a0a1e145890444a86b655a403d4232a6413f16ded1938007bc8bcf02e285befc5733d40b9a6ce48d538e9bd11a4b44b5d263f042f684c529f58f2c17a82a294da044b88a11215a660a02868b7b6e0c069453bf0c9d424ff21b40b60dd91fd39f813a7ff37385da9f6470e0f56e73e34192743930abbc918eb940eb611d25dec67a8de851050c25af2dd45c0790fcc98d515b37c66a2c2c19ba4272f7a1aeefcab0697cacd7bae3be6b1c0fb1429bba348a86a0b0fb59044a9ddd258871a9daf355183da8e3e5e4be960aaf132eb525e0611ca8978e9a1377dffaa719fe2dede5f3f4f82adbbb6e96642eb46a34b633d827deb89c09756f9960b54228f09452b336197e2c008d2e78181c96c041bc92a8b9720b09fcaee62bc4fbcc8f231625a5b3ca81e1c4ca6187bc4c9e7368b67f395d0c28d731e49c85785c1a8a27e189713ef960dfd7c384b834a7ff2e278d165b220b736f0e4836f2671706bed4921ec96ce588ec444b91fe6ff3c1f03e297cb47b82d3574f4a7ffaa0b40357f0b24dcd847909bd0c12a4ae51719eee1068e36f38bfade523f3f48f179c7561b1c2982b5f858470cb6abcb9bfb0c82083bd54f41e8461bd873bc7722914e20885e3fcfe2067534909a9345d248d7ab34f90e28d35630db4063ae0e7db276df7c35229d6e924b204ca2118c84c62bd8074dbc65b1035b2d3c05b4399dc85d0154c5699b203c4beb7b3dc93e8f9643f86e80dbcfc9ffb85fce5ce954bc0173eb1d4ea057e6e086078e4e1d46106dc0bf9516d5372a26977a5f01a8ee38ca577a7ecc68ca8c31a9bfbe7300c521e717c56da7e76470e649405b66bd9ec50091c127fe546b70d1340fc6352f0a267b16734010748500873c46a7fd4435e7a2ef6a485fd25c3f85f8e7dc423d7d3794c852d934568202174cbf031d13c9a3d8d89371839a683a3f149cf168e6a0e91ae17f0cfbdd92c8f0e8221c30b6cd7fa65cea140574ce62e8e77d53351cb2be31a0a508c79258f726997fef59b37fd9e1ffe97e92e575d1b2dc402b02bda1ecc272f0ee49cef7b3210fb1c20f63ac31abf5a6f3f54a686c49ce28a9ea409aeb5dc4712b0f69b1448b485ba00c82721b61eecb130c3011214dda469d2ca8d2b466f2a6d66fada668b06afef02f859a45bbde5fa173f4357679a8453516eb0e312411fbc6e20aea4778ba6a57146d96d0750aa7ceb3d21bc608c809482e4d3e208e6d95dcf028e0039081d3d9b597eb5ae24408a5a26acfc2a8a658924d15c0f9b18926f5b052682d01126c05250b9502f93d6bd0f1cb6a7199254a3b3b68961423cabb0b43e94d89f175058075d80c115986cfc92de87361217ead66d5509cccbbc660ccabd1bc86901e5c72fb34c7beff671fb02da36ba087c16a4019a39896f3cfe0ef0cc9d801cb912f806b4baf1ab3188e0d17cc83f00b691c686edaffa83d2efde1c9458c50b264a69b6661632b3a7e4cd06adf4bb8b9bfd8f6345154bbf30d23c42134036851281aa94c3b25852b456fdcf90c1b39b4d1b6a101bc0a617193e5ad5ed9a638d1a7e54ae94f88d68e2565c02f7d2a27936336a82052fd2c146e7927aa839c1a7e6797663182093f947a8ae47c480ec189971021f6fba8581aa2d91f7ad994f65922055a3a3c4e8b512b08f35d7bde99d6c1d1e005eb2c7d1abeaa12b8563c50bbd980b0f9da2d96a5e4f2b960af591ebd003c3ab07ffe8828cdc6df3db3e8fa9d6826aaab0a373ebc250fbf9f0810417f77fa9fb0786c5b8751405307afa682ed46c48754e347716f8641648a75031716678297660b35cafc332489eaaa9474d92d854c1e3b5aa6052743035598a7743830b8dcb8182095ccdf871463c3d6715139af32a9b42b35bbdd8cb6aa9705b54491541d67ee27e7f71b34b8abf1bf3d486694c604aeedb6561787dbf8c645f006f950cf8b843be69b00507529e1c1b570ee03422a936e5e1be0818557bba4e9f4c505c40e043670323a50fa9123b1bf2b87883fa7914163377a444d13af500e9f9e571b45496d729c4cf1ebfd48c356534118e54e9cbca287c18d5ee4d31d4419c522affe37fabc043bc1e2e141b2e99f90daf1d19bd9e1cc317269490c7590a0f6fb73c06b04e8c8e21bbf1207361154ec7d20aa457a6698f221321f712140a8378200f0eaf76a3c2a92844ed7fef58d1be8f870721d8f50cbfc52715d0cb6f386935b9dba08156d65f4eed4121e389395a3b31180d71ffceb90b4b7ce635d33bc7ac9d6424a1e059ccc987f8398d1477311c0691608db0085284c852ee1cba664ce02a004562be554f951208517f854ad95b631eeb07665e8d1bb5475997b7549e538937f4f616c3fa5a3ba5b23f5120f6e51ff348a62b6a1174a07ad5c6591e12989fcb2f2b3f71d28a226bae721b584e9416bce1ffc98020c2068287056b989e938384bc9d01000e837e180ed9babb02c543108778f368f1f3e2af0023b81afb2d1ed79f4f483a650ec42de03cfb3a65035af0ef65514d1d5793af0a00dd225cc830bd7c294244304da895bc1dc1928e87cdb1e809c4e2ee4f233a7f6bbf6c95698786efa465c17aa39055958aa1e19313e66d4f9c43b7c2493f7e4549eaf8d34542c7edb5e713c3f97645e5151a4f843ceac1db3baa54700570e839bae39c90b77cc9ee1050e250f12f71aa3bbf82cb1ed3efaaa5b5228584fe9c8f950290d8a4ecf52847c56ecfc347e2ae6ebb5247b8eecbfb50a3ef8f64f3ac0116886672dd63f261b817dea5ac23bc7eba4cb25a82d37e96849cb7ef921696caaee1b065474c6a7b4bbfde87736012adde145bdcc13cca6a9e5b1928640f3856ae260b0743b596878a9ca878ab161dcb02dc309ef5a622edd2c6fc7f3649b93eca26e0bc2967e1d8093a205bcd3c2fd47f44eea0b1a20c77a4a55b2a1e9ada69fdaa23cd7e7b3d5da85d80f10c633e691954cd0ba2834524fc777ce80f4467beaf9a0198df2aa6abdc2a7573b369b2df6a88a2daddf99a7e47450936e5e08859ef98827f834b8a387efe538cb4e2f0d7928ca22c27beaea2e31d10a77817003d097418c884ea7461017c047172c6108008de5ccc19bcea6728068e6a0b303e2881aa730ee52d137debba60b9176d2d39258db982897ec48021c07a636dff11c9292099a2848318d144d9ec4d01aa68065ff9bb1bd8663761d1aa3cea4ccab9ba6532a2af660931b0816245636419b167b7df1cf02746fe3ca2f4ae1d1915ebd41410fec93eb0c55e2d449976a1a1e83b5a226574d2e649e1a1896af2625fb3254017e37234366e9988b4b3ee983699a414b8bce9109ef2b641114f84d3bb636221345ffa2a8a22946d36dc7bac2d3494a9ea0f14f3d00a1c0d2937dd076273c3bc8ce57b0b9b75c3b09b7546df8baca62b82271a3d3523940d61dc92afff625c86ff220ba3aeae5308a497c447ddbc9adeeb073cbee23a10b4c93e5"}) write$USERIO_CMD_SET_PORT_TYPE(r1, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) r2 = creat(&(0x7f0000000080)='./file0\x00', 0x149) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r2, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f0000000040)}}, 0x18) 02:24:43 executing program 1: unshare(0x40000000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)) r1 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$IPT_SO_GET_INFO(r1, 0x203000000000000, 0x40, &(0x7f0000000000)={'security\x00'}, &(0x7f0000000080)=0x54) getsockopt$IPT_SO_GET_INFO(r1, 0x0, 0x40, &(0x7f0000000140)={'raw\x00'}, &(0x7f00000000c0)=0x54) 02:24:43 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000044ff8)={0xffffffffffffffff, 0xffffffffffffffff}) bind$unix(r0, 0x0, 0x0) connect$unix(r0, &(0x7f00000bc000)=@abs, 0x8) sendmmsg$unix(r1, &(0x7f00000bd000), 0x80, 0x0) connect$unix(r0, &(0x7f00003de000)=@file={0x1, './file0\x00'}, 0xa) connect$unix(r0, &(0x7f0000681000)=@abs, 0x8) [ 1272.913286][T24731] binder: 24728:24731 got transaction to invalid handle 02:24:43 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:43 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x7a000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1272.985352][T24769] IPVS: ftp: loaded support on port[0] = 21 02:24:43 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r1, &(0x7f0000000000)={0x1, 0x1}, 0x190) readv(r1, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r1, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) [ 1273.072969][T24845] binder_transaction: 6 callbacks suppressed [ 1273.072980][T24845] binder: 24844:24845 got transaction to context manager from process owning it [ 1273.104846][T24847] binder: 24846:24847 got transaction to invalid handle 02:24:43 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0xfdfdffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:44 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1273.250381][T24875] binder: 24868:24875 got transaction to invalid handle 02:24:44 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) lstat(&(0x7f0000000040)='./file0\x00', &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) getgid() r2 = getegid() setresgid(r1, r2, r1) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r3 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r3, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r3, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r3, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) [ 1273.405382][T24955] binder: 24954:24955 got transaction to context manager from process owning it 02:24:44 executing program 5: r0 = open(&(0x7f0000000500)='./bus\x00', 0x141042, 0x0) close(r0) syz_open_dev$loop(&(0x7f0000000540)='/dev/loop#\x00', 0x0, 0x105082) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0x526987c9) read(r1, &(0x7f0000000200)=""/250, 0x22b000) 02:24:44 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0xfffffdfd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:44 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x48, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:44 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r1, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r1, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) 02:24:44 executing program 1: unshare(0x40000000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)) r1 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$IPT_SO_GET_INFO(r1, 0x203000000000000, 0x40, &(0x7f0000000000)={'security\x00'}, &(0x7f0000000080)=0x54) getsockopt$IPT_SO_GET_INFO(r1, 0x0, 0x40, &(0x7f0000000140)={'raw\x00'}, &(0x7f00000000c0)=0x54) 02:24:44 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000044ff8)={0xffffffffffffffff, 0xffffffffffffffff}) bind$unix(r0, &(0x7f0000000080)=@file={0x0, './file0\x00'}, 0x6e) connect$unix(r0, &(0x7f00000bc000)=@abs, 0x8) sendmmsg$unix(r1, &(0x7f00000bd000), 0x80, 0x0) connect$unix(r0, &(0x7f00003de000)=@file={0x1, './file0\x00'}, 0xa) connect$unix(r0, &(0x7f0000681000)=@abs, 0x8) [ 1273.836595][T25065] binder: 25064:25065 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1273.848034][T25068] binder: 25066:25068 got transaction to context manager from process owning it [ 1273.898998][T25072] IPVS: ftp: loaded support on port[0] = 21 [ 1273.899574][T25065] binder: 25064:25065 got transaction to invalid handle 02:24:44 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vga_arbiter\x00', 0x40000, 0x0) ioctl$BINDER_SET_MAX_THREADS(r2, 0x40046205, 0x10001) write$USERIO_CMD_SET_PORT_TYPE(r1, &(0x7f0000000000)={0x1, 0x1}, 0x2) r3 = syz_open_dev$midi(&(0x7f0000000040)='/dev/midi#\x00', 0x1add, 0x8400) ioctl$KVM_SET_ONE_REG(r3, 0x4010aeac, &(0x7f0000000080)={0x0, 0x1}) readv(r1, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r1, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000002c0)}}, 0x18) 02:24:44 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x4c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:44 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x100000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:44 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) dup3(r0, r0, 0x80000) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/mixer\x00', 0x400, 0x0) setsockopt$inet_sctp_SCTP_RECVNXTINFO(r1, 0x84, 0x21, &(0x7f0000000280)=0xdc8, 0x4) r2 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) r3 = syz_open_dev$usbmon(&(0x7f0000000040)='/dev/usbmon#\x00', 0x5, 0x401) lstat(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, 0x0}) fstat(r3, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) write$FUSE_CREATE_OPEN(r2, &(0x7f0000000400)={0xa0, 0x0, 0x1, {{0x4, 0x3, 0x3, 0xfffffffffffffffd, 0x0, 0x1ff, {0x3, 0x7, 0xc90, 0x1ff, 0x9, 0x101, 0x80, 0xfff, 0x8, 0x0, 0x7, r4, r5, 0xfffffffffffffffc, 0x1ff}}, {0x0, 0x3}}}, 0xa0) ioctl$SNDRV_TIMER_IOCTL_STOP(r3, 0x54a1) write$USERIO_CMD_SET_PORT_TYPE(r1, &(0x7f0000000000)={0x1, 0x1}, 0x2) socket$vsock_stream(0x28, 0x1, 0x0) socket$nl_route(0x10, 0x3, 0x0) readv(r2, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r2, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) 02:24:44 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1274.143464][T25194] binder: 25184:25194 got transaction to context manager from process owning it [ 1274.153191][T25203] binder_alloc: 25184: binder_alloc_buf, no vma 02:24:45 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1274.300839][T25294] binder: 25291:25294 got transaction to context manager from process owning it [ 1274.359623][T25392] binder_alloc: 25291: binder_alloc_buf, no vma 02:24:45 executing program 5: r0 = open(&(0x7f0000000500)='./bus\x00', 0x141042, 0x0) close(r0) syz_open_dev$loop(&(0x7f0000000540)='/dev/loop#\x00', 0x0, 0x105082) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0x526987c9) read(r1, &(0x7f0000000200)=""/250, 0x22c000) 02:24:45 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x68, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:45 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r1, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xfffffffffffffc82}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r1, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0xfffffffffffffed4) 02:24:45 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x300000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:45 executing program 1: unshare(0x40000000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)) r1 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$IPT_SO_GET_INFO(r1, 0x203000000000000, 0x40, &(0x7f0000000000)={'security\x00'}, &(0x7f0000000080)=0x54) getsockopt$IPT_SO_GET_INFO(r1, 0x0, 0x40, &(0x7f0000000140)={'raw\x00'}, &(0x7f00000000c0)=0x54) 02:24:45 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000044ff8)={0xffffffffffffffff, 0xffffffffffffffff}) bind$unix(r0, &(0x7f0000000080)=@file={0x0, './file0\x00'}, 0x6e) connect$unix(r0, &(0x7f00000bc000)=@abs, 0x8) sendmmsg$unix(r1, &(0x7f00000bd000), 0x80, 0x0) connect$unix(r0, &(0x7f00003de000)=@file={0x1, './file0\x00'}, 0xa) connect$unix(r0, &(0x7f0000681000)=@abs, 0x8) [ 1274.839958][T25407] IPVS: ftp: loaded support on port[0] = 21 [ 1274.905948][T25468] binder: 25409:25468 got transaction to context manager from process owning it 02:24:45 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") fcntl$dupfd(r0, 0x0, r0) r1 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r1, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) mount(&(0x7f0000000040)=ANY=[@ANYBLOB='/dev/so0\x00'], &(0x7f0000000080)='./file0\x00', &(0x7f0000000280)='exofs\x00', 0x880000, &(0x7f00000002c0)='cpuset\x00') write$RDMA_USER_CM_CMD_LEAVE_MCAST(r1, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) 02:24:45 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x6c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:45 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x400000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1275.159225][T25689] binder: 25624:25689 got transaction to context manager from process owning it 02:24:46 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x74, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:46 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = syz_open_dev$usbmon(&(0x7f0000000080)='/dev/usbmon#\x00', 0x0, 0x181000) ioctl$VIDIOC_S_EDID(r1, 0xc0285629, &(0x7f00000002c0)={0x0, 0x9540, 0x1, [], &(0x7f0000000280)=0xffff}) r2 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r2, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r2, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r2, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) write$P9_RREMOVE(r0, &(0x7f0000000040)={0x7, 0x7b, 0x2}, 0x7) 02:24:46 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x500000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1275.317269][T25811] binder: 25809:25811 got transaction to context manager from process owning it [ 1275.422771][ T2988] binder_release_work: 18 callbacks suppressed [ 1275.422778][ T2988] binder: undelivered TRANSACTION_ERROR: 29201 [ 1275.457182][T25884] binder: 25875:25884 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1275.478236][T25884] binder_transaction: 19 callbacks suppressed [ 1275.478252][T25884] binder: 25875:25884 transaction failed 29189/-22, size 0-0 line 2995 [ 1275.556608][ T2988] binder: undelivered TRANSACTION_ERROR: 29189 02:24:46 executing program 5: r0 = open(&(0x7f0000000500)='./bus\x00', 0x141042, 0x0) close(r0) syz_open_dev$loop(&(0x7f0000000540)='/dev/loop#\x00', 0x0, 0x105082) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0x526987c9) read(r1, &(0x7f0000000200)=""/250, 0x22d000) 02:24:46 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x7a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:46 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) r2 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vsock\x00', 0x410000, 0x0) ioctl$EVIOCGVERSION(r2, 0x80044501, &(0x7f0000000280)=""/115) write$USERIO_CMD_SET_PORT_TYPE(r1, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r1, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) 02:24:46 executing program 1: unshare(0x40000000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0adc1f123c12") r1 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$IPT_SO_GET_INFO(r1, 0x203000000000000, 0x40, &(0x7f0000000000)={'security\x00'}, &(0x7f0000000080)=0x54) getsockopt$IPT_SO_GET_INFO(r1, 0x0, 0x40, &(0x7f0000000140)={'raw\x00'}, &(0x7f00000000c0)=0x54) 02:24:46 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x600000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:46 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000044ff8)={0xffffffffffffffff, 0xffffffffffffffff}) bind$unix(r0, &(0x7f0000000080)=@file={0x0, './file0\x00'}, 0x6e) connect$unix(r0, &(0x7f00000bc000)=@abs, 0x8) sendmmsg$unix(r1, &(0x7f00000bd000), 0x80, 0x0) connect$unix(r0, &(0x7f00003de000)=@file={0x1, './file0\x00'}, 0xa) connect$unix(r0, &(0x7f0000681000)=@abs, 0x8) [ 1275.738041][T25945] binder: 25944:25945 got transaction to context manager from process owning it [ 1275.786975][T25952] IPVS: ftp: loaded support on port[0] = 21 [ 1275.801216][T25945] binder: 25944:25945 transaction failed 29201/-22, size 0-0 line 2986 [ 1275.826821][T25948] binder_alloc: 25944: binder_alloc_buf, no vma [ 1275.846312][T25948] binder: 25946:25948 transaction failed 29189/-3, size 0-0 line 3148 02:24:46 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x300, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:46 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x700000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1275.899690][T21261] binder: undelivered TRANSACTION_ERROR: 29201 [ 1275.912357][ T2988] binder: undelivered TRANSACTION_ERROR: 29189 02:24:46 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") write$USERIO_CMD_SET_PORT_TYPE(0xffffffffffffffff, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) r1 = open(&(0x7f0000000080)='./file0\x00', 0x44200, 0x5) getsockopt$inet_sctp_SCTP_GET_ASSOC_NUMBER(r1, 0x84, 0x1c, &(0x7f0000000280), &(0x7f00000002c0)=0x4) openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) write$RDMA_USER_CM_CMD_LEAVE_MCAST(0xffffffffffffffff, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) [ 1275.988992][T26064] binder: 26063:26064 got transaction to context manager from process owning it [ 1276.003240][T26064] binder: 26063:26064 transaction failed 29201/-22, size 0-0 line 2986 02:24:46 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x500, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1276.063513][ T2988] binder: undelivered TRANSACTION_ERROR: 29201 02:24:46 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0xa00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1276.156970][T26148] binder: 26124:26148 transaction failed 29201/-22, size 0-0 line 2986 02:24:47 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r1, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) syz_open_dev$vbi(&(0x7f0000000040)='/dev/vbi#\x00', 0x2, 0x2) [ 1276.251411][T21261] binder: undelivered TRANSACTION_ERROR: 29201 02:24:47 executing program 5: r0 = open(&(0x7f0000000500)='./bus\x00', 0x141042, 0x0) close(r0) syz_open_dev$loop(&(0x7f0000000540)='/dev/loop#\x00', 0x0, 0x105082) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0x526987c9) read(r1, &(0x7f0000000200)=""/250, 0x22e000) 02:24:47 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x600, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:47 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x2000000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:47 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) r2 = syz_open_dev$dmmidi(&(0x7f0000000040)='/dev/dmmidi#\x00', 0x6, 0x40000) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, &(0x7f0000000080)={0x0, 0x9}, &(0x7f0000000280)=0x8) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r2, 0x84, 0x7b, &(0x7f00000002c0)={r3, 0x9}, &(0x7f0000000300)=0x8) write$USERIO_CMD_SET_PORT_TYPE(r1, &(0x7f0000000000)={0x1, 0x1}, 0x2) r4 = fcntl$getown(r1, 0x9) ioctl$sock_SIOCSPGRP(r2, 0x8902, &(0x7f0000000340)=r4) readv(r1, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r1, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) 02:24:47 executing program 1: unshare(0x40000000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0adc1f123c12") r1 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$IPT_SO_GET_INFO(r1, 0x203000000000000, 0x40, &(0x7f0000000000)={'security\x00'}, &(0x7f0000000080)=0x54) getsockopt$IPT_SO_GET_INFO(r1, 0x0, 0x40, &(0x7f0000000140)={'raw\x00'}, &(0x7f00000000c0)=0x54) 02:24:47 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000044ff8)={0xffffffffffffffff, 0xffffffffffffffff}) bind$unix(r0, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) connect$unix(0xffffffffffffffff, &(0x7f00000bc000)=@abs, 0x8) sendmmsg$unix(r1, &(0x7f00000bd000), 0x80, 0x0) connect$unix(r0, &(0x7f00003de000)=@file={0x1, './file0\x00'}, 0xa) connect$unix(r0, &(0x7f0000681000)=@abs, 0x8) [ 1276.674723][T26487] binder: 26486:26487 transaction failed 29201/-22, size 0-0 line 2986 [ 1276.715690][T26496] IPVS: ftp: loaded support on port[0] = 21 [ 1276.731235][T26494] binder_alloc: 26486: binder_alloc_buf, no vma [ 1276.737586][T26494] binder: 26488:26494 transaction failed 29189/-3, size 0-0 line 3148 02:24:47 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x700, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1276.816839][T18304] binder: undelivered TRANSACTION_ERROR: 29201 02:24:47 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x4800000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:47 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000044ff8)={0xffffffffffffffff, 0xffffffffffffffff}) bind$unix(r0, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) connect$unix(0xffffffffffffffff, &(0x7f00000bc000)=@abs, 0x8) sendmmsg$unix(r1, &(0x7f00000bd000), 0x80, 0x0) connect$unix(r0, &(0x7f00003de000)=@file={0x1, './file0\x00'}, 0xa) connect$unix(r0, &(0x7f0000681000)=@abs, 0x8) 02:24:47 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r1, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$USERIO_CMD_SET_PORT_TYPE(r1, &(0x7f0000000280)={0x1, 0x7ff}, 0x2) r2 = creat(&(0x7f0000000040)='./file0\x00', 0x101) ioctl$BLKROGET(r2, 0x125e, &(0x7f0000000080)) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r1, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) [ 1276.857627][T23677] binder: undelivered TRANSACTION_ERROR: 29189 [ 1276.969501][T26612] binder: 26605:26612 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1276.978442][T26607] binder: 26606:26607 Acquire 1 refcount change on invalid ref 0 ret -22 [ 1276.997565][T26612] binder: 26605:26612 transaction failed 29189/-22, size 0-0 line 2995 [ 1277.010484][T26607] binder: 26606:26607 Acquire 1 refcount change on invalid ref 0 ret -22 02:24:47 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r1, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r1, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) connect$inet(r0, &(0x7f0000000040)={0x2, 0x4e21, @rand_addr=0xb16}, 0x10) r2 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000280)='/dev/dlm-monitor\x00', 0x20000, 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r2, 0x40345410, &(0x7f0000000340)={{0xffffffffffffffff, 0x1, 0x1, 0x1, 0x6}}) r3 = syz_open_dev$mouse(&(0x7f00000002c0)='/dev/input/mouse#\x00', 0x81, 0x208800) setsockopt$inet_sctp_SCTP_RECVRCVINFO(r3, 0x84, 0x20, &(0x7f0000000300)=0x4, 0x4) syz_open_dev$media(&(0x7f0000000080)='/dev/media#\x00', 0x5, 0x50800) ioctl$DMA_BUF_IOCTL_SYNC(r3, 0x40086200, &(0x7f0000000380)=0x2) [ 1277.053414][T26607] binder: 26606:26607 transaction failed 29189/-22, size 0-0 line 2995 02:24:47 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x4c00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1277.100084][T21261] binder: undelivered TRANSACTION_ERROR: 29189 [ 1277.158466][T11612] binder: undelivered TRANSACTION_ERROR: 29189 [ 1277.188311][T26720] binder: 26718:26720 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1277.241489][T26720] binder: 26718:26720 transaction failed 29189/-22, size 0-0 line 2995 02:24:48 executing program 5: r0 = open(&(0x7f0000000500)='./bus\x00', 0x141042, 0x0) close(r0) syz_open_dev$loop(&(0x7f0000000540)='/dev/loop#\x00', 0x0, 0x105082) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0x526987c9) read(r1, &(0x7f0000000200)=""/250, 0x22f000) 02:24:48 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0xa00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:48 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000044ff8)={0xffffffffffffffff, 0xffffffffffffffff}) bind$unix(r0, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) connect$unix(0xffffffffffffffff, &(0x7f00000bc000)=@abs, 0x8) sendmmsg$unix(r1, &(0x7f00000bd000), 0x80, 0x0) connect$unix(r0, &(0x7f00003de000)=@file={0x1, './file0\x00'}, 0xa) connect$unix(r0, &(0x7f0000681000)=@abs, 0x8) 02:24:48 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0xffffeffffffffff9, &(0x7f0000000300)="0adc1f123c123f12fb3fa57d032fd8687569cea1f4a1a4543fb149774d43a3651072a0048aa1b07e95a626d20d0456b1934b81178e89bdcccb8223936e1522d4191c579e56e58128000000000000000000000000000000006d378877cdb123061b23f7a8ab35bf2d188225a055ff617a7681ebe0077df529f284f03eaa9428d891c48f0033a971185e2c5e35a37c8a608d2408b776ad515fcf76ca53a7df9a8e554a07fd9090690c4719bc4b317052142ba8cf09f10fcb46310aa65b92241a81c875a4edc8633a976c631530d5695da77e685469b18be165682512c072605b0b85ae320ef6fea57c6f120432448d4bf6ed2e2d151f416694aee24ab1394b65f0df89f9fa8ec97060e90ebcb65ad81df086ae83f1a400"/291) r1 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r1, &(0x7f0000000000)={0x1, 0x1}, 0x2) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040)='/dev/hwrng\x00', 0x800, 0x0) ioctl$PPPIOCSMAXCID(r2, 0x40047451, &(0x7f0000000080)=0x7) readv(r1, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r1, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) 02:24:48 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x6000000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:48 executing program 1: unshare(0x40000000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0adc1f123c12") r1 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$IPT_SO_GET_INFO(r1, 0x203000000000000, 0x40, &(0x7f0000000000)={'security\x00'}, &(0x7f0000000080)=0x54) getsockopt$IPT_SO_GET_INFO(r1, 0x0, 0x40, &(0x7f0000000140)={'raw\x00'}, &(0x7f00000000c0)=0x54) [ 1277.708809][T26840] binder_alloc: 26829: binder_alloc_buf, no vma [ 1277.720146][T26841] IPVS: ftp: loaded support on port[0] = 21 02:24:48 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:48 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x6800000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:48 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000044ff8)={0xffffffffffffffff, 0xffffffffffffffff}) bind$unix(r0, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) connect$unix(r0, 0x0, 0x0) sendmmsg$unix(r1, &(0x7f00000bd000), 0x80, 0x0) connect$unix(r0, &(0x7f00003de000)=@file={0x1, './file0\x00'}, 0xa) connect$unix(r0, &(0x7f0000681000)=@abs, 0x8) 02:24:48 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") setxattr$trusted_overlay_redirect(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='trusted.overlay.redirect\x00', &(0x7f0000000280)='./file0\x00', 0x8, 0x0) r1 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r1, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r1, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) 02:24:48 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x3f00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1277.964567][T26951] binder_alloc: 26937: binder_alloc_buf, no vma 02:24:48 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x6c00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1278.107171][T27013] binder_transaction: 4 callbacks suppressed [ 1278.107182][T27013] binder: 26957:27013 got transaction to context manager from process owning it 02:24:49 executing program 5: r0 = open(&(0x7f0000000500)='./bus\x00', 0x141042, 0x0) close(r0) syz_open_dev$loop(&(0x7f0000000540)='/dev/loop#\x00', 0x0, 0x105082) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0x526987c9) read(r1, &(0x7f0000000200)=""/250, 0x230000) 02:24:49 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000044ff8)={0xffffffffffffffff, 0xffffffffffffffff}) bind$unix(r0, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) connect$unix(r0, 0x0, 0x0) sendmmsg$unix(r1, &(0x7f00000bd000), 0x80, 0x0) connect$unix(r0, &(0x7f00003de000)=@file={0x1, './file0\x00'}, 0xa) connect$unix(r0, &(0x7f0000681000)=@abs, 0x8) 02:24:49 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x6, &(0x7f0000000280)="0600001e00000000000000800c3732b8f822cc2183a94ee9605bda871904fbf29696cba021fb9a281989793d6831fce52b9ccb2edfed19a8066eba507db136e5d0b9c2d2b4d72fe887d9c72b13f1") r1 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r1, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r1, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) 02:24:49 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x4800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:49 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x7400000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:49 executing program 1: unshare(0x40000000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0adc1f123c123f3188") r1 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$IPT_SO_GET_INFO(r1, 0x203000000000000, 0x40, &(0x7f0000000000)={'security\x00'}, &(0x7f0000000080)=0x54) getsockopt$IPT_SO_GET_INFO(r1, 0x0, 0x40, &(0x7f0000000140)={'raw\x00'}, &(0x7f00000000c0)=0x54) [ 1278.706941][T27178] IPVS: ftp: loaded support on port[0] = 21 [ 1278.728127][T27182] binder: 27175:27182 got transaction to context manager from process owning it [ 1278.746551][T27180] binder_alloc: 27175: binder_alloc_buf, no vma 02:24:49 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000044ff8)={0xffffffffffffffff, 0xffffffffffffffff}) bind$unix(r0, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) connect$unix(r0, 0x0, 0x0) sendmmsg$unix(r1, &(0x7f00000bd000), 0x80, 0x0) connect$unix(r0, &(0x7f00003de000)=@file={0x1, './file0\x00'}, 0xa) connect$unix(r0, &(0x7f0000681000)=@abs, 0x8) 02:24:49 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x7a00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:49 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x4c00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:49 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000b40)={0x26, 'aead\x00', 0x0, 0x0, 'morus1280-generic\x00'}, 0x58) ppoll(0x0, 0xfffffffffffffda4, &(0x7f0000000bc0)={0x0, 0x1c9c380}, 0x0, 0xffffffe3) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmsg$alg(r2, &(0x7f0000001380)={0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) write$binfmt_script(r2, &(0x7f0000000600)=ANY=[], 0xfec8) recvmmsg(r2, &(0x7f0000007e00)=[{{0x0, 0x0, &(0x7f0000004700)=[{&(0x7f0000003580)=""/4096, 0x1000}], 0x1, &(0x7f0000004780)=""/245, 0xf5}}], 0x500, 0x0, 0x0) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r3 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r3, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r3, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) r4 = syz_open_dev$audion(&(0x7f0000000040)='/dev/audio#\x00', 0x10000, 0x400000) connect$x25(r4, &(0x7f0000000080)={0x9, @remote={[], 0x1}}, 0x12) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r3, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) ioctl$DRM_IOCTL_AUTH_MAGIC(r4, 0x40046411, &(0x7f0000000280)=0x1f) [ 1278.997700][T27294] binder: 27292:27294 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1279.025393][T27294] binder_alloc: 27295: binder_alloc_buf, no vma 02:24:49 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000044ff8)={0xffffffffffffffff}) bind$unix(r0, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) connect$unix(r0, &(0x7f00000bc000)=@abs, 0x8) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x80, 0x0) connect$unix(r0, &(0x7f00003de000)=@file={0x1, './file0\x00'}, 0xa) connect$unix(r0, &(0x7f0000681000)=@abs, 0x8) [ 1279.047521][T27297] binder: 27295:27297 got transaction to context manager from process owning it 02:24:49 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0xfdfdffff00000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1279.242993][T27358] binder: 27352:27358 IncRefs 0 refcount change on invalid ref 0 ret -22 02:24:50 executing program 5: r0 = open(&(0x7f0000000500)='./bus\x00', 0x141042, 0x0) close(r0) syz_open_dev$loop(&(0x7f0000000540)='/dev/loop#\x00', 0x0, 0x105082) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0x526987c9) read(r1, &(0x7f0000000200)=""/250, 0x231000) 02:24:50 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x6000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:50 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000044ff8)={0xffffffffffffffff}) bind$unix(r0, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) connect$unix(r0, &(0x7f00000bc000)=@abs, 0x8) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x80, 0x0) connect$unix(r0, &(0x7f00003de000)=@file={0x1, './file0\x00'}, 0xa) connect$unix(r0, &(0x7f0000681000)=@abs, 0x8) 02:24:50 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:50 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") syz_open_dev$sndpcmp(&(0x7f0000000280)='/dev/snd/pcmC#D#p\x00', 0xfffffffffffffffb, 0x10000) r1 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r1, &(0x7f0000000000)={0x1, 0x1}, 0x2) fchdir(r0) r2 = dup(r1) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, &(0x7f0000000040)={0x8, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, &(0x7f0000000080)=0x24) readv(r1, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r1, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) sendfile(r0, r0, &(0x7f00000002c0), 0xd9) [ 1279.684510][T27417] binder: 27412:27417 got transaction to context manager from process owning it [ 1279.714776][T27420] binder_alloc: 27412: binder_alloc_buf, no vma 02:24:50 executing program 1: unshare(0x40000000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0adc1f123c123f3188") r1 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$IPT_SO_GET_INFO(r1, 0x203000000000000, 0x40, &(0x7f0000000000)={'security\x00'}, &(0x7f0000000080)=0x54) getsockopt$IPT_SO_GET_INFO(r1, 0x0, 0x40, &(0x7f0000000140)={'raw\x00'}, &(0x7f00000000c0)=0x54) 02:24:50 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000044ff8)={0xffffffffffffffff}) bind$unix(r0, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) connect$unix(r0, &(0x7f00000bc000)=@abs, 0x8) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x80, 0x0) connect$unix(r0, &(0x7f00003de000)=@file={0x1, './file0\x00'}, 0xa) connect$unix(r0, &(0x7f0000681000)=@abs, 0x8) 02:24:50 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:50 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x6800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:50 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = openat$userio(0xffffffffffffff9c, &(0x7f0000000280)='/dev/userio\x00', 0x1, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r1, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r1, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) [ 1279.890322][T27529] IPVS: ftp: loaded support on port[0] = 21 [ 1279.950260][T27533] binder: 27532:27533 got transaction to context manager from process owning it [ 1279.963725][T27534] binder_alloc: 27532: binder_alloc_buf, no vma 02:24:50 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000044ff8)={0xffffffffffffffff, 0xffffffffffffffff}) bind$unix(r0, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) connect$unix(r0, &(0x7f00000bc000)=@abs, 0x8) sendmmsg$unix(r1, 0x0, 0x0, 0x0) connect$unix(r0, &(0x7f00003de000)=@file={0x1, './file0\x00'}, 0xa) connect$unix(r0, &(0x7f0000681000)=@abs, 0x8) 02:24:50 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1280.198272][T27646] binder: 27645:27646 IncRefs 0 refcount change on invalid ref 0 ret -22 02:24:51 executing program 5: r0 = open(&(0x7f0000000500)='./bus\x00', 0x141042, 0x0) close(r0) syz_open_dev$loop(&(0x7f0000000540)='/dev/loop#\x00', 0x0, 0x105082) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0x526987c9) read(r1, &(0x7f0000000200)=""/250, 0x232000) 02:24:51 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x6c00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:51 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x35954e58, &(0x7f0000000040)="fc55103c123f0000000000") r1 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r1, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r1, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) 02:24:51 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000044ff8)={0xffffffffffffffff, 0xffffffffffffffff}) bind$unix(r0, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) connect$unix(r0, &(0x7f00000bc000)=@abs, 0x8) sendmmsg$unix(r1, 0x0, 0x0, 0x0) connect$unix(r0, &(0x7f00003de000)=@file={0x1, './file0\x00'}, 0xa) connect$unix(r0, &(0x7f0000681000)=@abs, 0x8) 02:24:51 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:51 executing program 1: unshare(0x40000000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0adc1f123c123f3188") r1 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$IPT_SO_GET_INFO(r1, 0x203000000000000, 0x40, &(0x7f0000000000)={'security\x00'}, &(0x7f0000000080)=0x54) getsockopt$IPT_SO_GET_INFO(r1, 0x0, 0x40, &(0x7f0000000140)={'raw\x00'}, &(0x7f00000000c0)=0x54) [ 1280.719356][T27659] binder: 27652:27659 got transaction to context manager from process owning it [ 1280.730242][T27655] binder_alloc: 27652: binder_alloc_buf, no vma [ 1280.757275][T27655] binder_transaction: 15 callbacks suppressed 02:24:51 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000044ff8)={0xffffffffffffffff, 0xffffffffffffffff}) bind$unix(r0, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) connect$unix(r0, &(0x7f00000bc000)=@abs, 0x8) sendmmsg$unix(r1, 0x0, 0x0, 0x0) connect$unix(r0, &(0x7f00003de000)=@file={0x1, './file0\x00'}, 0xa) connect$unix(r0, &(0x7f0000681000)=@abs, 0x8) [ 1280.757291][T27655] binder: 27654:27655 transaction failed 29189/-3, size 0-0 line 3148 [ 1280.778800][T27750] IPVS: ftp: loaded support on port[0] = 21 [ 1280.788614][T27659] binder: 27652:27659 transaction failed 29201/-22, size 0-0 line 2986 02:24:51 executing program 4: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f00000003c0)='/proc/capi/capi20\x00', 0x200000, 0x0) ioctl$KVM_GET_LAPIC(r0, 0x8400ae8e, &(0x7f0000000780)={"8adcd16a030359cb66890e754a8b2e83dcacf6e7784bb62829f4e1c87aaeb05f90c20db65220da2ccccd8cbf9bd81d51453d91def23cd5e6c2a259b5d0f143003e743a3b985fe1da08fd1429dcda9bd412fe5a282cd996124b1d74c56372146b809319e68f00ca72e6d50b614e062efc7a7c5f0da15e63098b4adc3e684c1ef11de9ca52eb9a0e297c3db521821f5bf694a81b112167af73c7e0bddefd90aa3ec2571ed688821d1aad8c393bf238aa4b019e6acaab42e70dfac62b562b6d70c58404ed60fad901654d9e084217f2438a4c22d38d8f4352fcea33677c98fa6208d4dfdc123366164a2ebd8b262dc82f910bc1a7ab35feeeba91afcedeb3bf88bcf48cb7acb148ec348631ff59bc70c38ffd9afbc66e77e4659f1eabbe1c7815918d0a0b420c1e40cde93e282ed44e5f7170912cfa7846e57564f04c47bbe9546baa531c2192413bc2c6116e7697768624d44daf9148bc27cb5e786f1557368f6875fdc335b7d298ebcfdf563744b13616fc8b51a285b84d96cd0baf8c39fdb63b4e04ef6855f97a19e0ecca82a9920ae83f57a57c068d650a7e8deb83bfbf38a440736040f8d1b1b93f8fbde295c5cee209a22836eacf198302deaaf8b205dc3f822c50d28b9ede129fda8a66dcdd479c839fbdce76018a1d97c5d23f3db2ac648d594748a66b3f9298cd96d00d4d437cbe796b7904b24774a47c961bc9090f7d7f243605c28937e23110ac52c89f7c619662a99d346498ce87b99f43626913178bc632c501a336acc954b07eda167211e09a769c1a053e458b2f0ffe8deaee8cef43e134b1e3a70adb140df28fef037e5c2de87139f63b9c9d9f5a268e3e881101a5b8b294a2878e556deeb9a186ba6b156be53b816dfbc2dfb1a7d1e5f511c6d90941a4c25fe41a6459cb4a64564efc79e0e2e1a52adf3dbb39a29b74ed92485d7a923edce7676e0893b6c75e5b944aa39b9c8c1a8ee4fcd7b3542054a9314e752289b736b44100580e40f9ffe10157bce139f131efa76a5d7b19f2b2facf65864ef2a968842b065a4ce7555f98a8410da86a69b056de077255ac9460b78c06d3dd4ff3fc21cdf400deb789547354101ceaefe147a99732a95c67d7c03964016584c3a47635cae56d90fcb636a6f45f395e53c208539f21e031d149783d1f46f1bcadaa0231506c0317563cc6bd7cfa4d96ee1733a09e39b9aaf3c0b218acf70a13d99ab9262ac1ce9df9179752cd85acfd6c2729790727ad002b0a32b717477620adf25ac13ae40008e07c20456681580604baeaa7d5490ab0a18634b8c1f84f95027522e1eda64e2ab03911fa1167960c0bdbfa04b3c6e677a90efdeec3094867d1535fb279b4db2deb99d28ac02dd9c7c40f70844a0e0b079a79f6b51c505bab4a8feaac08885727fec284bde30fbc2bcaf836cd8fa99345d0a615973de9"}) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000400)="0adc1f123c123f3188b070") r2 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r2, &(0x7f0000000000)={0x1, 0x1}, 0x2) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x88000, 0x0) ioctl$TIOCGSID(r3, 0x5429, &(0x7f0000000140)) readv(r2, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffff9c, &(0x7f0000000280)={0x16, 0x98, 0xfa00, {&(0x7f0000000040)={0xffffffffffffffff}, 0x4, 0xffffffffffffffff, 0x1c, 0x0, @in6={0xa, 0x4e22, 0x8, @ipv4={[], [], @remote}, 0x80}}}, 0xa0) ioctl$TIOCGSID(r3, 0x5429, &(0x7f0000000340)) close(r1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r2, &(0x7f0000000380)={0x7ffffffff000, 0xfffffffffffffe9b, 0xfa00, {&(0x7f0000000080), r4}}, 0x18) 02:24:51 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x7400, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:51 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1280.919680][T11612] binder_release_work: 16 callbacks suppressed [ 1280.919688][T11612] binder: undelivered TRANSACTION_ERROR: 29201 02:24:51 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000044ff8)={0xffffffffffffffff, 0xffffffffffffffff}) bind$unix(r0, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) connect$unix(r0, &(0x7f00000bc000)=@abs, 0x8) sendmmsg$unix(r1, &(0x7f00000bd000), 0x80, 0x0) connect$unix(0xffffffffffffffff, &(0x7f00003de000)=@file={0x1, './file0\x00'}, 0xa) connect$unix(r0, &(0x7f0000681000)=@abs, 0x8) [ 1280.982486][T11612] binder: undelivered TRANSACTION_ERROR: 29189 02:24:51 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x100000891a, &(0x7f0000000b00)="0adc1f123c123f3188b0702f3741592e9996a9fc1339c315a5d0d3abd66a8f31b3d73c6cbc7a8026bc360c33c244b507d5e7a1235239a6005261ab3fcf0b81b881a7fa2e47e538ef7601de97bcb9ddbf5c35b15c4aa5f5e99ac272331f46d53afb1e849bb0a06a82cf4a65fcbb5f2e79435ab4b10eff51f4b27b6de15c80aa6a594cdfc226d07b5d7f0621a4c9f7e2edbcc8f89807c61410066e660ed255c4393ab59e91b1b15d17a2307537371e2638063b6b5d7d8b46ab513f779a0b120d4fbfa07d82920833d5304a95b75ad8742da352c15a74596683ffd08fe35199371b6b876e559eae68d652fecf44b195303d8cf0df9e3b973d4a0d2f01a9e2e18551fb03f11f5ee6d2eb4f8ceb8a7d0fb833b44aed0415fdde13a4d64b90886fb9755dee6928911ab22626753e856d5c3693ccbbbe16f665a99f3bd6562f439fa85e095c86d101000000952fd21224192a23ea57500c4c578e9b0a629523c28dba0f4f31d32a3ea6d3a12388939be656e50e65e35a379c2b2bb13dbcf4c430dfc71d592743c9376142772401007509a3b8a0a1cac0014da7f74340ebbab48f97bff949050add6a4dcc2be2091fecb3506e553ccb6b5b51d85449222e423200d2c062961f4c293fc0e992451fb80f7976e91a84a940095fe06302adffd0f82220fd13fb3e7433d46dc17e9d4e952a64ab9265220ee6590b1dc5b22b4856a45ab66bd43914bd852216abb857d67d4225ce37132105788d9a8b67e1e31a0404489a72b0e841b0e9aa3322942a88018b03894d7b9bf27e39aac610fbd987148625b8602be587c6dc64912fb96c8ace48124778fa1151aa0bb2b9467222c2a288e50a176ea95feef5f2c4caacd1031a57ff28962be3a112b18efa0df6c2255f9acf12a6a2717d032b3eb4fd1eab17e940f4099f3eeea4118a93a265dd28a488d80b15d1570c3883c26589f6e30ed21257489aba0a9c4193fc9f6b97d2e6414a4054259e88650207cba5e1beb5ea18951ac2538567b5652ee94c2ae3daf174e8e1f4fdc0003ad2bdeeb06339316e1e0d4f33b7e240b1ab6e79d48ced0d36a8e63e9b98f73f30efc2779d2759eba965b52ac53abc138e14056844ef724204b17a6de67cf757775cde3dfc1221a7f4be12833771e2040099c239641e79f2a86ba1c4e5b8e6ffae3b53a9f1812a821778451647fdd0d752c7ef0e3f72a03e1836175d76d825f615d13043d976364283a01e2621e60fb7ebdc61fd300c8865c162778bd9ba661b141e4845128fc8991e2f89bcc336096cbf29750437c60e1400fcb3a22ca6500b529b4ab98b11df229eb69da0570c389da7abcc4756724580a942f38659715674e4619b25a0bdd234e14e995583f4ec30e2630cf1d1b52c9b5cf7a22943f18e31e40563f7502c907ea4f8d8a2339cc248954979e8bd61f49f2681bc32a50b6a11e42b499934f41a16448554dd2fee1b3e2744d456c56683bc27e315d8915b41d7b2b4a45653fe06e7f39e3f0bcb0106d43ad8cfdccde419505bba55f96972a76516efe264e76e2b7f7b51b2900bbd2525d0309d672a65bd8373d1b93097570c5caee3f0d35e634ccc3558b0e108949cf8ad356c356f4c074685f6e8ecf6f11be315a70379638c195997bc9b7b5364a2ab7e65bfef76d6971f6325bc01d8caa885a546fd5034e9c72d5b9ec26d60c5b7a607af4d4e3ec5599e8435a7619e9d43b24a7e83a089cab14866d7472560adc14125211fbcc81da75ad1d945597527c572de0328fec6566793e4bd3f90f9c8b6eca4419181b61c2d5edaaafe41a4064b34917ed82447248e3621608e5794f5be1dbe8115e917d645bf269b1d9e7f7758b3f36315993b9e6794c0470a2fcdc4c0ea4c3d919a9fdf33cf2ecd429e2d2d25813592f8a9530d6e486affd1b797d859f493df5554a876d3c80f6f49ba374778245c7aae9c2f6677f453f2d0bb2bd5a08b5c74234805b23506ec35b2851d23304de57b869305175c49b0dc04308e8354c03991c102f27f8d3df1bf951ace449ef6b1fdefe889f0790af18ae9741c1321642ca0a491e0460d3bd2ce46d56e92e4114b7e4a4dbf5fe6ac333a58045fc669c6c94b66956003e896b62d004e9724f38f2cbc5bcd8de7861c78d1c57a4de28ad83589319a5bdfe806015393500ed8d82961ae081d9d859b155cbf18f319fdc404f7c3186998979072") r1 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r1, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r1, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) [ 1281.072124][T27861] binder: 27859:27861 got transaction to context manager from process owning it [ 1281.082094][T27882] binder_alloc: 27859: binder_alloc_buf, no vma [ 1281.102529][T27882] binder: 27860:27882 transaction failed 29189/-3, size 0-0 line 3148 [ 1281.123633][T27861] binder: 27859:27861 transaction failed 29201/-22, size 0-0 line 2986 [ 1281.201425][T11612] binder: undelivered TRANSACTION_ERROR: 29189 [ 1281.268508][T11612] binder: undelivered TRANSACTION_ERROR: 29201 02:24:52 executing program 5: r0 = open(&(0x7f0000000500)='./bus\x00', 0x141042, 0x0) close(r0) syz_open_dev$loop(&(0x7f0000000540)='/dev/loop#\x00', 0x0, 0x105082) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0x526987c9) read(r1, &(0x7f0000000200)=""/250, 0x233000) 02:24:52 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:52 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x7a00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:52 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r1, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) sync() write$RDMA_USER_CM_CMD_LEAVE_MCAST(r1, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) ioctl$sock_SIOCINQ(r0, 0x541b, &(0x7f0000000040)) 02:24:52 executing program 1: unshare(0x40000000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0adc1f123c123f3188b0") r1 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$IPT_SO_GET_INFO(r1, 0x203000000000000, 0x40, &(0x7f0000000000)={'security\x00'}, &(0x7f0000000080)=0x54) getsockopt$IPT_SO_GET_INFO(r1, 0x0, 0x40, &(0x7f0000000140)={'raw\x00'}, &(0x7f00000000c0)=0x54) [ 1281.674842][T28001] binder: 27996:28001 got transaction to context manager from process owning it [ 1281.686074][T28003] binder_alloc: 27996: binder_alloc_buf, no vma [ 1281.716790][T28002] IPVS: ftp: loaded support on port[0] = 21 [ 1281.733914][T28003] binder: 27999:28003 transaction failed 29189/-3, size 0-0 line 3148 [ 1281.747599][T28001] binder: 27996:28001 transaction failed 29201/-22, size 0-0 line 2986 02:24:52 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r1, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r1, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) r2 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f00000002c0)='/proc/capi/capi20\x00', 0x10000, 0x0) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000340)='IPVS\x00') ioctl$RNDCLEARPOOL(r2, 0x5206, &(0x7f0000000040)=0x4) sendmsg$IPVS_CMD_GET_SERVICE(r2, &(0x7f0000000480)={&(0x7f0000000300), 0xc, &(0x7f0000000440)={&(0x7f00000004c0)=ANY=[@ANYBLOB="3f00200087194b7073200e148b68b4e577279f2d952675128dcd1ac805ae417b3d289aa2a6dd48bba5a0ac0822dec7a73edc93a3c7764c5d9a5f8ef84452b44e29840bfd7fe1bf41748975fd764656614dada757075dc6254f1742cf04c9bfcdf9ccfa842c6cf691a0020d35917faa388c18bbcdbc4d0ceb027bccfed85ae0df743e7210da1b42a073fa42deedf14c159c0afe3a2f0f32ff5d3909cfb27dfc0bf102b13c40fa37bc9fc073e397ff40a89c60", @ANYRES16=r3, @ANYBLOB="000029bd7000ffdbdf25040000004400020008000400d59200000800060004000000080002004e230000140001007f0000010000000000000000000000001400010000000000000000000000ffffffffffff040002002c00020008000500060000000800030000000000080002004e230000080003000400000008000900020000000800060003000000"], 0x90}, 0x1, 0x0, 0x0, 0x20008044}, 0x20000000) 02:24:52 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x1000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:52 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1281.882589][T11612] binder: undelivered TRANSACTION_ERROR: 29201 [ 1281.888870][T11612] binder: undelivered TRANSACTION_ERROR: 29189 02:24:52 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000044ff8)={0xffffffffffffffff, 0xffffffffffffffff}) bind$unix(r0, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) connect$unix(r0, &(0x7f00000bc000)=@abs, 0x8) sendmmsg$unix(r1, &(0x7f00000bd000), 0x80, 0x0) connect$unix(0xffffffffffffffff, &(0x7f00003de000)=@file={0x1, './file0\x00'}, 0xa) connect$unix(r0, &(0x7f0000681000)=@abs, 0x8) [ 1282.010065][T28182] binder: 28117:28182 got transaction to context manager from process owning it [ 1282.030070][T28178] binder_alloc: 28117: binder_alloc_buf, no vma [ 1282.045140][T28182] binder: 28117:28182 transaction failed 29201/-22, size 0-0 line 2986 [ 1282.057156][T28178] binder: 28172:28178 transaction failed 29189/-3, size 0-0 line 3148 02:24:52 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = syz_open_dev$sndpcmc(&(0x7f0000000080)='/dev/snd/pcmC#D#c\x00', 0xda27, 0x101000) ioctl$TIOCCONS(r1, 0x541d) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r2 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r2, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r2, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) syz_open_dev$cec(&(0x7f0000000040)='/dev/cec#\x00', 0x0, 0x2) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r2, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) 02:24:52 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x48, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1282.126823][T21261] binder: undelivered TRANSACTION_ERROR: 29189 02:24:52 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1282.194702][T21261] binder: undelivered TRANSACTION_ERROR: 29201 [ 1282.207185][T28227] binder: 28226:28227 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1282.233911][T28227] binder: 28226:28227 transaction failed 29189/-22, size 0-0 line 2995 [ 1282.272241][T28289] binder: 28282:28289 got transaction to context manager from process owning it [ 1282.318473][T28289] binder: 28282:28289 transaction failed 29201/-22, size 0-0 line 2986 [ 1282.336131][T21261] binder: undelivered TRANSACTION_ERROR: 29189 [ 1282.408998][T11612] binder: undelivered TRANSACTION_ERROR: 29201 02:24:53 executing program 5: r0 = open(&(0x7f0000000500)='./bus\x00', 0x141042, 0x0) close(r0) syz_open_dev$loop(&(0x7f0000000540)='/dev/loop#\x00', 0x0, 0x105082) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0x526987c9) read(r1, &(0x7f0000000200)=""/250, 0x234000) 02:24:53 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = dup3(r0, r0, 0x80000) ioctl$KVM_GET_DEBUGREGS(r1, 0x8080aea1, &(0x7f0000000040)) r2 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r2, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r2, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) 02:24:53 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x4c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:53 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x3000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1282.647209][T28341] binder: 28340:28341 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1282.709675][T28341] binder_alloc: 28339: binder_alloc_buf, no vma 02:24:53 executing program 1: unshare(0x40000000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0adc1f123c123f3188b0") r1 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$IPT_SO_GET_INFO(r1, 0x203000000000000, 0x40, &(0x7f0000000000)={'security\x00'}, &(0x7f0000000080)=0x54) getsockopt$IPT_SO_GET_INFO(r1, 0x0, 0x40, &(0x7f0000000140)={'raw\x00'}, &(0x7f00000000c0)=0x54) 02:24:53 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x4000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:53 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x60, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:53 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x5000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:53 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000044ff8)={0xffffffffffffffff, 0xffffffffffffffff}) bind$unix(r0, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) connect$unix(r0, &(0x7f00000bc000)=@abs, 0x8) sendmmsg$unix(r1, &(0x7f00000bd000), 0x80, 0x0) connect$unix(0xffffffffffffffff, &(0x7f00003de000)=@file={0x1, './file0\x00'}, 0xa) connect$unix(r0, &(0x7f0000681000)=@abs, 0x8) 02:24:53 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x3f00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1282.867191][T28454] binder_alloc: 28427: binder_alloc_buf, no vma [ 1282.906747][T28452] IPVS: ftp: loaded support on port[0] = 21 02:24:53 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x68, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:53 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x6000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1283.101335][T28467] binder: 28466:28467 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1283.131669][T28467] binder_alloc: 28469: binder_alloc_buf, no vma [ 1283.160611][T28470] binder_transaction: 3 callbacks suppressed [ 1283.160622][T28470] binder: 28469:28470 got transaction to context manager from process owning it 02:24:54 executing program 5: r0 = open(&(0x7f0000000500)='./bus\x00', 0x141042, 0x0) close(r0) syz_open_dev$loop(&(0x7f0000000540)='/dev/loop#\x00', 0x0, 0x105082) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0x526987c9) read(r1, &(0x7f0000000200)=""/250, 0x235000) 02:24:54 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x3f00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:54 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x6c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:54 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x7000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:54 executing program 1: unshare(0x40000000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0adc1f123c123f3188b0") r1 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$IPT_SO_GET_INFO(r1, 0x203000000000000, 0x40, &(0x7f0000000000)={'security\x00'}, &(0x7f0000000080)=0x54) getsockopt$IPT_SO_GET_INFO(r1, 0x0, 0x40, &(0x7f0000000140)={'raw\x00'}, &(0x7f00000000c0)=0x54) [ 1283.576270][T28482] IPVS: ftp: loaded support on port[0] = 21 [ 1283.615204][T28491] binder: 28479:28491 got transaction to context manager from process owning it 02:24:54 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x3f00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:54 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x74, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:54 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0xa000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:54 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000044ff8)={0xffffffffffffffff, 0xffffffffffffffff}) bind$unix(r0, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) connect$unix(r0, &(0x7f00000bc000)=@abs, 0x8) sendmmsg$unix(r1, &(0x7f00000bd000), 0x80, 0x0) connect$unix(r0, 0x0, 0x0) connect$unix(r0, &(0x7f0000681000)=@abs, 0x8) 02:24:54 executing program 4: unshare(0x40000000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0adc1f123c12") r1 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$IPT_SO_GET_INFO(r1, 0x203000000000000, 0x40, &(0x7f0000000000)={'security\x00'}, &(0x7f0000000080)=0x54) getsockopt$IPT_SO_GET_INFO(r1, 0x0, 0x40, &(0x7f0000000140)={'raw\x00'}, &(0x7f00000000c0)=0x54) [ 1283.901540][T28702] binder: 28695:28702 got transaction to context manager from process owning it 02:24:54 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x20000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1283.989204][T28749] IPVS: ftp: loaded support on port[0] = 21 02:24:54 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x7a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1284.112867][T28872] binder: 28865:28872 got transaction to context manager from process owning it [ 1284.198887][T28907] binder_alloc: 28865: binder_alloc_buf, no vma 02:24:55 executing program 5: r0 = open(&(0x7f0000000500)='./bus\x00', 0x141042, 0x0) close(r0) syz_open_dev$loop(&(0x7f0000000540)='/dev/loop#\x00', 0x0, 0x105082) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0x526987c9) read(r1, &(0x7f0000000200)=""/250, 0x236000) 02:24:55 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x3f000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:55 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x300, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:55 executing program 4: unshare(0x40000000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0adc1f123c12") r1 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$IPT_SO_GET_INFO(r1, 0x203000000000000, 0x40, &(0x7f0000000000)={'security\x00'}, &(0x7f0000000080)=0x54) getsockopt$IPT_SO_GET_INFO(r1, 0x0, 0x40, &(0x7f0000000140)={'raw\x00'}, &(0x7f00000000c0)=0x54) 02:24:55 executing program 1: unshare(0x40000000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0adc1f123c123f3188b070") r1 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$IPT_SO_GET_INFO(0xffffffffffffffff, 0x203000000000000, 0x40, &(0x7f0000000000)={'security\x00'}, &(0x7f0000000080)=0x54) getsockopt$IPT_SO_GET_INFO(r1, 0x0, 0x40, &(0x7f0000000140)={'raw\x00'}, &(0x7f00000000c0)=0x54) [ 1284.553362][T28924] IPVS: ftp: loaded support on port[0] = 21 [ 1284.567764][T28920] IPVS: ftp: loaded support on port[0] = 21 [ 1284.592145][T28975] binder: 28919:28975 got transaction to context manager from process owning it 02:24:55 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x48000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:55 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x500, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:55 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000044ff8)={0xffffffffffffffff, 0xffffffffffffffff}) bind$unix(r0, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) connect$unix(r0, &(0x7f00000bc000)=@abs, 0x8) sendmmsg$unix(r1, &(0x7f00000bd000), 0x80, 0x0) connect$unix(r0, 0x0, 0x0) connect$unix(r0, &(0x7f0000681000)=@abs, 0x8) [ 1284.808332][T29139] binder: 29129:29139 got transaction to context manager from process owning it 02:24:55 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x4c000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:55 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x600, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1285.026129][T29249] binder: 29246:29249 got transaction to context manager from process owning it 02:24:55 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:55 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x700, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1285.222221][T29354] binder: 29353:29354 got transaction to context manager from process owning it [ 1285.278459][T29358] binder_alloc: 29353: binder_alloc_buf, no vma 02:24:56 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x68000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:56 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0xa00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:56 executing program 1: unshare(0x40000000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0adc1f123c123f3188b070") r1 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$IPT_SO_GET_INFO(0xffffffffffffffff, 0x203000000000000, 0x40, &(0x7f0000000000)={'security\x00'}, &(0x7f0000000080)=0x54) getsockopt$IPT_SO_GET_INFO(r1, 0x0, 0x40, &(0x7f0000000140)={'raw\x00'}, &(0x7f00000000c0)=0x54) [ 1285.537519][T29366] binder: 29364:29366 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1285.562062][T29369] binder: 29365:29369 got transaction to context manager from process owning it [ 1285.568433][T29370] IPVS: ftp: loaded support on port[0] = 21 [ 1285.577703][T29366] binder_alloc: 29365: binder_alloc_buf, no vma 02:24:58 executing program 4: unshare(0x40000000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0adc1f123c12") r1 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$IPT_SO_GET_INFO(r1, 0x203000000000000, 0x40, &(0x7f0000000000)={'security\x00'}, &(0x7f0000000080)=0x54) getsockopt$IPT_SO_GET_INFO(r1, 0x0, 0x40, &(0x7f0000000140)={'raw\x00'}, &(0x7f00000000c0)=0x54) 02:24:58 executing program 5: r0 = open(&(0x7f0000000500)='./bus\x00', 0x141042, 0x0) close(r0) syz_open_dev$loop(&(0x7f0000000540)='/dev/loop#\x00', 0x0, 0x105082) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0x526987c9) read(r1, &(0x7f0000000200)=""/250, 0x237000) 02:24:58 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x6c000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:58 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000044ff8)={0xffffffffffffffff, 0xffffffffffffffff}) bind$unix(r0, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) connect$unix(r0, &(0x7f00000bc000)=@abs, 0x8) sendmmsg$unix(r1, &(0x7f00000bd000), 0x80, 0x0) connect$unix(r0, 0x0, 0x0) connect$unix(r0, &(0x7f0000681000)=@abs, 0x8) 02:24:58 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:58 executing program 1: unshare(0x40000000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0adc1f123c123f3188b070") r1 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$IPT_SO_GET_INFO(0xffffffffffffffff, 0x203000000000000, 0x40, &(0x7f0000000000)={'security\x00'}, &(0x7f0000000080)=0x54) getsockopt$IPT_SO_GET_INFO(r1, 0x0, 0x40, &(0x7f0000000140)={'raw\x00'}, &(0x7f00000000c0)=0x54) [ 1287.870964][T29381] IPVS: ftp: loaded support on port[0] = 21 [ 1287.888730][T29384] binder_alloc: 29377: binder_alloc_buf, no vma [ 1287.903632][T29386] binder: 29377:29386 got transaction to context manager from process owning it [ 1287.908020][T29384] binder_transaction: 18 callbacks suppressed [ 1287.908036][T29384] binder: 29382:29384 transaction failed 29189/-3, size 0-0 line 3148 [ 1287.932394][T29389] IPVS: ftp: loaded support on port[0] = 21 [ 1287.958170][T29386] binder: 29377:29386 transaction failed 29201/-22, size 0-0 line 2986 02:24:58 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x4800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1288.054983][T11612] binder_release_work: 18 callbacks suppressed [ 1288.054991][T11612] binder: undelivered TRANSACTION_ERROR: 29189 02:24:58 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x74000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1288.105381][T15537] binder: undelivered TRANSACTION_ERROR: 29201 [ 1288.141996][T29494] binder: 29493:29494 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1288.211279][T29494] binder_alloc: 29496: binder_alloc_buf, no vma [ 1288.230304][T29494] binder: 29493:29494 transaction failed 29189/-3, size 0-0 line 3148 [ 1288.239537][T29498] binder: 29496:29498 got transaction to context manager from process owning it [ 1288.265693][T29498] binder: 29496:29498 transaction failed 29201/-22, size 0-0 line 2986 02:24:59 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x4c00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:59 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x7a000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1288.351934][T15460] binder: undelivered TRANSACTION_ERROR: 29189 [ 1288.385229][T11612] binder: undelivered TRANSACTION_ERROR: 29201 [ 1288.432933][T29503] binder: 29500:29503 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1288.479795][T29505] binder: 29504:29505 got transaction to context manager from process owning it [ 1288.479874][T29503] binder_alloc: 29504: binder_alloc_buf, no vma [ 1288.518504][T29505] binder: 29504:29505 transaction failed 29201/-22, size 0-0 line 2986 [ 1288.531228][T29503] binder: 29500:29503 transaction failed 29189/-3, size 0-0 line 3148 02:24:59 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0xfdfdffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:24:59 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x6000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1288.616681][T15460] binder: undelivered TRANSACTION_ERROR: 29201 [ 1288.644220][T11612] binder: undelivered TRANSACTION_ERROR: 29189 [ 1288.772199][T29511] binder: 29510:29511 got transaction to context manager from process owning it [ 1288.797778][T29515] binder_alloc: 29510: binder_alloc_buf, no vma [ 1288.826811][T29515] binder: 29514:29515 transaction failed 29189/-3, size 0-0 line 3148 [ 1288.850588][T29511] binder: 29510:29511 transaction failed 29201/-22, size 0-0 line 2986 [ 1288.957324][T15460] binder: undelivered TRANSACTION_ERROR: 29189 [ 1288.997974][T15460] binder: undelivered TRANSACTION_ERROR: 29201 02:25:00 executing program 4: unshare(0x40000000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0adc1f123c12") r1 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$IPT_SO_GET_INFO(r1, 0x203000000000000, 0x40, &(0x7f0000000000)={'security\x00'}, &(0x7f0000000080)=0x54) getsockopt$IPT_SO_GET_INFO(r1, 0x0, 0x40, &(0x7f0000000140)={'raw\x00'}, &(0x7f00000000c0)=0x54) 02:25:00 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000044ff8)={0xffffffffffffffff, 0xffffffffffffffff}) bind$unix(r0, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) connect$unix(r0, &(0x7f00000bc000)=@abs, 0x8) sendmmsg$unix(r1, &(0x7f00000bd000), 0x80, 0x0) connect$unix(r0, &(0x7f00003de000)=@file={0x0, './file0\x00'}, 0xa) connect$unix(r0, &(0x7f0000681000)=@abs, 0x8) 02:25:00 executing program 5: r0 = open(&(0x7f0000000500)='./bus\x00', 0x141042, 0x0) close(r0) syz_open_dev$loop(&(0x7f0000000540)='/dev/loop#\x00', 0x0, 0x105082) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0x526987c9) read(r1, &(0x7f0000000200)=""/250, 0x238000) 02:25:00 executing program 1: unshare(0x40000000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0adc1f123c123f3188b070") r1 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$IPT_SO_GET_INFO(r1, 0x203000000000000, 0x40, 0x0, &(0x7f0000000080)) getsockopt$IPT_SO_GET_INFO(r1, 0x0, 0x40, &(0x7f0000000140)={'raw\x00'}, &(0x7f00000000c0)=0x54) 02:25:00 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x6800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:25:00 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0xfffffdfd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1290.242818][T29528] IPVS: ftp: loaded support on port[0] = 21 [ 1290.268674][T29532] IPVS: ftp: loaded support on port[0] = 21 [ 1290.275008][T29523] binder: 29521:29523 got transaction to context manager from process owning it [ 1290.290495][T29531] binder_alloc: 29521: binder_alloc_buf, no vma [ 1290.295723][T29523] binder: 29521:29523 transaction failed 29201/-22, size 0-0 line 2986 [ 1290.320628][T29531] binder: 29526:29531 transaction failed 29189/-3, size 0-0 line 3148 02:25:01 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x100000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1290.349374][T15460] binder: undelivered TRANSACTION_ERROR: 29201 02:25:01 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x6c00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1290.403781][T11612] binder: undelivered TRANSACTION_ERROR: 29189 [ 1290.531170][T29640] binder: 29639:29640 got transaction to context manager from process owning it 02:25:01 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1290.577376][T29643] binder_alloc: 29639: binder_alloc_buf, no vma 02:25:01 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x7400, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1290.674106][T29647] binder: 29646:29647 got transaction to context manager from process owning it 02:25:01 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x300000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1290.780428][T29650] binder_alloc: 29646: binder_alloc_buf, no vma 02:25:01 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x7a00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1290.945750][T29657] binder: 29653:29657 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1290.949537][T29656] binder: 29654:29656 got transaction to context manager from process owning it [ 1290.962014][T29657] binder_alloc: 29654: binder_alloc_buf, no vma 02:25:03 executing program 4: unshare(0x40000000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0adc1f123c12") r1 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$IPT_SO_GET_INFO(r1, 0x203000000000000, 0x40, &(0x7f0000000000)={'security\x00'}, &(0x7f0000000080)=0x54) getsockopt$IPT_SO_GET_INFO(r1, 0x0, 0x40, &(0x7f0000000140)={'raw\x00'}, &(0x7f00000000c0)=0x54) 02:25:03 executing program 1: unshare(0x40000000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0adc1f123c123f3188b070") r1 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$IPT_SO_GET_INFO(r1, 0x203000000000000, 0x40, 0x0, &(0x7f0000000080)) getsockopt$IPT_SO_GET_INFO(r1, 0x0, 0x40, &(0x7f0000000140)={'raw\x00'}, &(0x7f00000000c0)=0x54) 02:25:03 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x1000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:25:03 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x400000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:25:03 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000044ff8)={0xffffffffffffffff, 0xffffffffffffffff}) bind$unix(r0, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) connect$unix(r0, &(0x7f00000bc000)=@abs, 0x8) sendmmsg$unix(r1, &(0x7f00000bd000), 0x80, 0x0) connect$unix(r0, &(0x7f00003de000)=@file={0x0, './file0\x00'}, 0xa) connect$unix(r0, &(0x7f0000681000)=@abs, 0x8) 02:25:03 executing program 5: r0 = open(&(0x7f0000000500)='./bus\x00', 0x141042, 0x0) close(r0) syz_open_dev$loop(&(0x7f0000000540)='/dev/loop#\x00', 0x0, 0x105082) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0x526987c9) read(r1, &(0x7f0000000200)=""/250, 0x239000) [ 1293.134458][T29665] IPVS: ftp: loaded support on port[0] = 21 [ 1293.154014][T29672] binder: 29666:29672 got transaction to context manager from process owning it [ 1293.161447][T29671] binder_alloc: 29666: binder_alloc_buf, no vma [ 1293.186097][T29672] binder_transaction: 6 callbacks suppressed [ 1293.186112][T29672] binder: 29666:29672 transaction failed 29201/-22, size 0-0 line 2986 [ 1293.187555][T29675] IPVS: ftp: loaded support on port[0] = 21 [ 1293.193624][T29671] binder: 29664:29671 transaction failed 29189/-3, size 0-0 line 3148 02:25:04 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x500000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:25:04 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x2000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1293.281964][T15537] binder_release_work: 6 callbacks suppressed [ 1293.281972][T15537] binder: undelivered TRANSACTION_ERROR: 29201 [ 1293.311769][T15537] binder: undelivered TRANSACTION_ERROR: 29189 [ 1293.414560][T29756] binder: 29755:29756 got transaction to context manager from process owning it [ 1293.437076][T29786] binder_alloc: 29755: binder_alloc_buf, no vma [ 1293.438186][T29756] binder: 29755:29756 transaction failed 29201/-22, size 0-0 line 2986 [ 1293.467946][T29786] binder: 29772:29786 transaction failed 29189/-3, size 0-0 line 3148 02:25:04 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x600000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1293.527328][T15537] binder: undelivered TRANSACTION_ERROR: 29201 02:25:04 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x3000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1293.583534][T23756] binder: undelivered TRANSACTION_ERROR: 29189 [ 1293.665127][T29791] binder: 29789:29791 got transaction to context manager from process owning it [ 1293.680230][T29792] binder_alloc: 29789: binder_alloc_buf, no vma [ 1293.692455][T29792] binder: 29790:29792 transaction failed 29189/-3, size 0-0 line 3148 [ 1293.705510][T29791] binder: 29789:29791 transaction failed 29201/-22, size 0-0 line 2986 02:25:04 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x700000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:25:04 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x4000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1293.778235][T15537] binder: undelivered TRANSACTION_ERROR: 29189 [ 1293.789510][T15537] binder: undelivered TRANSACTION_ERROR: 29201 [ 1293.889211][T29797] binder: 29795:29797 got transaction to context manager from process owning it [ 1293.910771][T29798] binder_alloc: 29795: binder_alloc_buf, no vma [ 1293.915199][T29797] binder: 29795:29797 transaction failed 29201/-22, size 0-0 line 2986 [ 1293.947302][T29798] binder: 29796:29798 transaction failed 29189/-3, size 0-0 line 3148 [ 1294.011274][T11612] binder: undelivered TRANSACTION_ERROR: 29201 [ 1294.057058][T11612] binder: undelivered TRANSACTION_ERROR: 29189 02:25:06 executing program 4: unshare(0x40000000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0adc1f123c12") r1 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$IPT_SO_GET_INFO(r1, 0x203000000000000, 0x40, &(0x7f0000000000)={'security\x00'}, &(0x7f0000000080)=0x54) getsockopt$IPT_SO_GET_INFO(r1, 0x0, 0x40, &(0x7f0000000140)={'raw\x00'}, &(0x7f00000000c0)=0x54) 02:25:06 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000044ff8)={0xffffffffffffffff, 0xffffffffffffffff}) bind$unix(r0, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) connect$unix(r0, &(0x7f00000bc000)=@abs, 0x8) sendmmsg$unix(r1, &(0x7f00000bd000), 0x80, 0x0) connect$unix(r0, &(0x7f00003de000)=@file={0x0, './file0\x00'}, 0xa) connect$unix(r0, &(0x7f0000681000)=@abs, 0x8) 02:25:06 executing program 1: unshare(0x40000000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0adc1f123c123f3188b070") r1 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$IPT_SO_GET_INFO(r1, 0x203000000000000, 0x40, 0x0, &(0x7f0000000080)) getsockopt$IPT_SO_GET_INFO(r1, 0x0, 0x40, &(0x7f0000000140)={'raw\x00'}, &(0x7f00000000c0)=0x54) 02:25:06 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0xa00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:25:06 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x5000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:25:06 executing program 5: r0 = open(&(0x7f0000000500)='./bus\x00', 0x141042, 0x0) close(r0) syz_open_dev$loop(&(0x7f0000000540)='/dev/loop#\x00', 0x0, 0x105082) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0x526987c9) read(r1, &(0x7f0000000200)=""/250, 0x70c7e5e3) [ 1295.689443][T29810] binder_alloc: 29806: binder_alloc_buf, no vma [ 1295.692349][T29813] binder: 29806:29813 got transaction to context manager from process owning it [ 1295.722211][T29815] IPVS: ftp: loaded support on port[0] = 21 [ 1295.722781][T29813] binder: 29806:29813 transaction failed 29201/-22, size 0-0 line 2986 [ 1295.729135][T29810] binder: 29809:29810 transaction failed 29189/-3, size 0-0 line 3148 [ 1295.769322][T29812] IPVS: ftp: loaded support on port[0] = 21 02:25:06 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x2000000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:25:06 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x6000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1295.836015][ T17] binder: undelivered TRANSACTION_ERROR: 29201 [ 1295.870068][T11612] binder: undelivered TRANSACTION_ERROR: 29189 [ 1295.991724][T29927] binder_alloc: 29924: binder_alloc_buf, no vma [ 1295.998489][T29926] binder: 29924:29926 got transaction to context manager from process owning it 02:25:06 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x7000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:25:06 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1296.219452][T29932] binder: 29931:29932 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1296.237199][T29933] binder: 29930:29933 got transaction to context manager from process owning it [ 1296.264810][T29932] binder_alloc: 29930: binder_alloc_buf, no vma 02:25:07 executing program 5: r0 = open(&(0x7f0000000500)='./bus\x00', 0x141042, 0x0) close(r0) bind$pptp(r0, &(0x7f0000000000)={0x18, 0x2, {0x0, @empty}}, 0x1e) syz_open_dev$loop(&(0x7f0000000540)='/dev/loop#\x00', 0x0, 0x105082) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0x526987c9) read(r1, &(0x7f0000000200)=""/250, 0x50c7e3e3) 02:25:07 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x4800000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1296.491857][T29941] binder: 29939:29941 got transaction to context manager from process owning it 02:25:08 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000044ff8)={0xffffffffffffffff, 0xffffffffffffffff}) bind$unix(r0, 0x0, 0x0) connect$unix(r0, &(0x7f00000bc000)=@abs, 0x8) sendmmsg$unix(r1, &(0x7f00000bd000), 0x80, 0x0) connect$unix(r0, &(0x7f00003de000)=@file={0x1, './file0\x00'}, 0xa) connect$unix(r0, &(0x7f0000681000)=@abs, 0x8) 02:25:08 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0xa000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:25:08 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000044ff8)={0xffffffffffffffff, 0xffffffffffffffff}) bind$unix(r0, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) connect$unix(r0, &(0x7f00000bc000)=@abs, 0x8) sendmmsg$unix(r1, &(0x7f00000bd000), 0x80, 0x0) connect$unix(r0, &(0x7f00003de000)=@file={0x1, './file0\x00'}, 0xa) connect$unix(0xffffffffffffffff, &(0x7f0000681000)=@abs, 0x8) 02:25:08 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x4c00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:25:08 executing program 1: unshare(0x40000000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0adc1f123c123f3188b070") r1 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$IPT_SO_GET_INFO(r1, 0x203000000000000, 0x40, &(0x7f0000000000)={'security\x00'}, 0x0) getsockopt$IPT_SO_GET_INFO(r1, 0x0, 0x40, &(0x7f0000000140)={'raw\x00'}, &(0x7f00000000c0)=0x54) 02:25:08 executing program 5: r0 = open(&(0x7f0000000500)='./bus\x00', 0x141042, 0x0) setsockopt$IP_VS_SO_SET_DELDEST(r0, 0x0, 0x488, &(0x7f0000000000)={{0x3e, @multicast1, 0x4e21, 0x3, 'lc\x00', 0x30, 0xa98, 0x52}, {@dev={0xac, 0x14, 0x14, 0x1a}, 0x4e20, 0x12003, 0x553, 0x0, 0x9}}, 0x44) close(r0) syz_open_dev$loop(&(0x7f0000000540)='/dev/loop#\x00', 0x0, 0x105082) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0x526987c9) read(r1, &(0x7f0000000200)=""/250, 0x50c7e3e3) 02:25:08 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x20000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1297.910965][T29956] IPVS: ftp: loaded support on port[0] = 21 [ 1297.913982][T29960] binder_alloc: 29952: binder_alloc_buf, no vma [ 1297.926898][T29958] binder: 29952:29958 got transaction to context manager from process owning it 02:25:08 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x6000000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1298.063547][T30027] binder: 29993:30027 IncRefs 0 refcount change on invalid ref 0 ret -22 02:25:08 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000044ff8)={0xffffffffffffffff, 0xffffffffffffffff}) bind$unix(r0, 0x0, 0x0) connect$unix(r0, &(0x7f00000bc000)=@abs, 0x8) sendmmsg$unix(r1, &(0x7f00000bd000), 0x80, 0x0) connect$unix(r0, &(0x7f00003de000)=@file={0x1, './file0\x00'}, 0xa) connect$unix(r0, &(0x7f0000681000)=@abs, 0x8) 02:25:08 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x48000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1298.182461][T30070] binder: 30069:30070 got transaction to context manager from process owning it [ 1298.214125][T30070] binder_transaction: 8 callbacks suppressed [ 1298.214141][T30070] binder: 30069:30070 transaction failed 29201/-22, size 0-0 line 2986 02:25:09 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x6800000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1298.317892][T23756] binder_release_work: 8 callbacks suppressed [ 1298.317899][T23756] binder: undelivered TRANSACTION_ERROR: 29201 02:25:09 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x4c000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1298.398234][T30205] binder: 30129:30205 got transaction to context manager from process owning it 02:25:09 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000044ff8)={0xffffffffffffffff, 0xffffffffffffffff}) bind$unix(r0, 0x0, 0x0) connect$unix(r0, &(0x7f00000bc000)=@abs, 0x8) sendmmsg$unix(r1, &(0x7f00000bd000), 0x80, 0x0) connect$unix(r0, &(0x7f00003de000)=@file={0x1, './file0\x00'}, 0xa) connect$unix(r0, &(0x7f0000681000)=@abs, 0x8) [ 1298.458240][T30205] binder: 30129:30205 transaction failed 29201/-22, size 0-0 line 2986 02:25:09 executing program 5: r0 = open(&(0x7f0000000500)='./bus\x00', 0x141042, 0x0) close(r0) r1 = syz_open_dev$loop(&(0x7f0000000540)='/dev/loop#\x00', 0x0, 0x105082) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0x526987c9) read(r2, &(0x7f0000000200)=""/250, 0x50c7e3e3) setsockopt$bt_hci_HCI_DATA_DIR(r1, 0x0, 0x1, &(0x7f0000000000)=0x101, 0x4) [ 1298.532462][T30287] binder_alloc: 30129: binder_alloc_buf, no vma [ 1298.571430][T30287] binder: 30286:30287 transaction failed 29189/-3, size 0-0 line 3148 [ 1298.622927][T23756] binder: undelivered TRANSACTION_ERROR: 29201 02:25:09 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000044ff8)={0xffffffffffffffff, 0xffffffffffffffff}) bind$unix(r0, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) connect$unix(r0, &(0x7f00000bc000)=@abs, 0x8) sendmmsg$unix(r1, &(0x7f00000bd000), 0x80, 0x0) connect$unix(r0, &(0x7f00003de000)=@file={0x1, './file0\x00'}, 0xa) connect$unix(0xffffffffffffffff, &(0x7f0000681000)=@abs, 0x8) 02:25:09 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x6c00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1298.730103][ T17] binder: undelivered TRANSACTION_ERROR: 29189 [ 1298.830202][T30393] binder: 30387:30393 got transaction to context manager from process owning it [ 1298.851677][T30393] binder: 30387:30393 transaction failed 29201/-22, size 0-0 line 2986 [ 1298.965834][T23756] binder: undelivered TRANSACTION_ERROR: 29201 02:25:09 executing program 1: unshare(0x40000000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0adc1f123c123f3188b070") r1 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$IPT_SO_GET_INFO(r1, 0x203000000000000, 0x40, &(0x7f0000000000)={'security\x00'}, 0x0) getsockopt$IPT_SO_GET_INFO(r1, 0x0, 0x40, &(0x7f0000000140)={'raw\x00'}, &(0x7f00000000c0)=0x54) 02:25:09 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:25:09 executing program 4: unshare(0x40000000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x0, &(0x7f0000000100)="0adc1f123c123f3188b070") r1 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$IPT_SO_GET_INFO(r1, 0x203000000000000, 0x40, &(0x7f0000000000)={'security\x00'}, &(0x7f0000000080)=0x54) getsockopt$IPT_SO_GET_INFO(r1, 0x0, 0x40, &(0x7f0000000140)={'raw\x00'}, &(0x7f00000000c0)=0x54) 02:25:09 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x7400000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1299.124639][T30429] IPVS: ftp: loaded support on port[0] = 21 [ 1299.129243][T30430] binder: 30426:30430 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1299.156818][T30431] binder: 30428:30431 got transaction to context manager from process owning it 02:25:09 executing program 5: r0 = open(&(0x7f0000000500)='./bus\x00', 0x141042, 0x0) ioctl$sock_bt_hci(r0, 0x400448e7, &(0x7f0000000000)="9c5a7986a5abbf8f328e24ababd65958da749feb4252ec92a2d3b65b290641793334ba6af68c22ef88826154be558d72544a04d52ccb39b5b3dc51086fccf2fc615c493f84e8dd2b19586c2ee7aaf0bb4f91f8004c") close(r0) syz_open_dev$loop(&(0x7f0000000540)='/dev/loop#\x00', 0x0, 0x105082) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) syz_open_dev$mouse(&(0x7f0000000080)='/dev/input/mouse#\x00', 0x9, 0xa512774fbebb6992) ioctl$FS_IOC_GETFSLABEL(r0, 0x81009431, &(0x7f00000000c0)) write(r2, &(0x7f0000000800)="652c46fa104a35d7b44ecfb43b3e5bf166958c060cd66c1910cecaca8a5f9779bd94717063d26b27ce787f430956c17449a72c14c2944cf00550357dd2f731b43041d89950f43a309afb02d208b72bcc022c45b660198549d60f9a690bab601c316615a28cb5ef527341c53d0ac6b7d11983038a2b8927806c65529fb50b9107650f243a87e0262c9a40250ebbf95e793f9fa83125268f3ba3d77baf2cabc72d966bc06e444714d0cb90b1579cde55063479220bf64c46142eb12ed4e6c00025c2a5bd93b52045eda18424db2d239fff6a18a8f223efd9f950de6a2c2e61f9435ae8c6e24622986c8c54e0dbd484d6bbe150fb2ecc393c8f8153d0d78609a63e7ae009c09f42725fc14a47090c565b5a8d0cc5be929ae25f1a1a7925da93f269b001056bcced292bcb19697a56bbc14105ce22609bdac92e753319f22f953913577d6bf565348313ca9041b091ce973934c3ccd658107f481e020319fdec5815ba1b624e1a8805b6a9a61ebd0d358e429c9acff0b2edd8e44500009481eab4b3dcda04f2243c7bdfa4d8dd7b4c8629f1fcf4413057d69e4ceaa0a7f71d0ed40f3c902b0ebc314dc0c888db80e906a85514d546431862ad39b64823c1fe333d8ed09ff098b8", 0xffffffffffffffa9) read(r1, &(0x7f0000000200)=""/250, 0x50c7e3e3) [ 1299.181197][T30430] binder_alloc: 30428: binder_alloc_buf, no vma [ 1299.196908][T30442] IPVS: ftp: loaded support on port[0] = 21 [ 1299.206823][T30430] binder: 30426:30430 transaction failed 29189/-3, size 0-0 line 3148 [ 1299.243265][T30431] binder: 30428:30431 transaction failed 29201/-22, size 0-0 line 2986 02:25:10 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x68000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1299.320511][ T17] binder: undelivered TRANSACTION_ERROR: 29189 02:25:10 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x7a00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1299.383915][ T17] binder: undelivered TRANSACTION_ERROR: 29201 [ 1299.448864][T30543] binder: 30529:30543 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1299.470482][T30544] binder: 30542:30544 got transaction to context manager from process owning it [ 1299.482286][T30543] binder_alloc: 30542: binder_alloc_buf, no vma [ 1299.491158][T30544] binder: 30542:30544 transaction failed 29201/-22, size 0-0 line 2986 [ 1299.498562][T30543] binder: 30529:30543 transaction failed 29189/-3, size 0-0 line 3148 02:25:10 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0xfdfdffff00000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1299.540417][T23756] binder: undelivered TRANSACTION_ERROR: 29201 02:25:10 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x6c000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1299.596160][T15537] binder: undelivered TRANSACTION_ERROR: 29189 [ 1299.670299][T30549] binder: 30546:30549 got transaction to context manager from process owning it [ 1299.693395][T30550] binder_alloc: 30546: binder_alloc_buf, no vma [ 1299.707086][T30550] binder: 30548:30550 transaction failed 29189/-3, size 0-0 line 3148 02:25:10 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000044ff8)={0xffffffffffffffff, 0xffffffffffffffff}) bind$unix(r0, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) connect$unix(r0, &(0x7f00000bc000)=@abs, 0x8) sendmmsg$unix(r1, &(0x7f00000bd000), 0x80, 0x0) connect$unix(r0, &(0x7f00003de000)=@file={0x1, './file0\x00'}, 0xa) connect$unix(0xffffffffffffffff, &(0x7f0000681000)=@abs, 0x8) [ 1299.715501][T30549] binder: 30546:30549 transaction failed 29201/-22, size 0-0 line 2986 02:25:10 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:25:10 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x74000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1299.809784][T23756] binder: undelivered TRANSACTION_ERROR: 29201 [ 1299.842988][T23756] binder: undelivered TRANSACTION_ERROR: 29189 [ 1299.904249][T30558] binder: 30556:30558 got transaction to context manager from process owning it [ 1299.965583][T30560] binder_alloc: 30556: binder_alloc_buf, no vma 02:25:10 executing program 1: unshare(0x40000000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0adc1f123c123f3188b070") r1 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$IPT_SO_GET_INFO(r1, 0x203000000000000, 0x40, &(0x7f0000000000)={'security\x00'}, 0x0) getsockopt$IPT_SO_GET_INFO(r1, 0x0, 0x40, &(0x7f0000000140)={'raw\x00'}, &(0x7f00000000c0)=0x54) 02:25:10 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1300.260938][T30571] binder: 30569:30571 got transaction to context manager from process owning it [ 1300.328831][T30573] IPVS: ftp: loaded support on port[0] = 21 02:25:12 executing program 4: unshare(0x40000000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x0, &(0x7f0000000100)="0adc1f123c123f3188b070") r1 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$IPT_SO_GET_INFO(r1, 0x203000000000000, 0x40, &(0x7f0000000000)={'security\x00'}, &(0x7f0000000080)=0x54) getsockopt$IPT_SO_GET_INFO(r1, 0x0, 0x40, &(0x7f0000000140)={'raw\x00'}, &(0x7f00000000c0)=0x54) 02:25:12 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x7a000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:25:12 executing program 5: r0 = open(&(0x7f0000000500)='./bus\x00', 0x141042, 0x0) close(r0) r1 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x5, 0x105082) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0x526987c9) read(r1, &(0x7f0000000380)=""/250, 0x827fe71380cf7bc1) syz_extract_tcp_res(&(0x7f0000000040), 0x2, 0x9) 02:25:12 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:25:12 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000044ff8)={0xffffffffffffffff, 0xffffffffffffffff}) bind$unix(r0, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) connect$unix(r0, &(0x7f00000bc000)=@abs, 0x8) sendmmsg$unix(r1, &(0x7f00000bd000), 0x80, 0x0) connect$unix(r0, &(0x7f00003de000)=@file={0x1, './file0\x00'}, 0xa) connect$unix(r0, 0x0, 0x0) 02:25:12 executing program 1: unshare(0x40000000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0adc1f123c123f3188b070") r1 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$IPT_SO_GET_INFO(r1, 0x203000000000000, 0x40, &(0x7f0000000000)={'security\x00'}, &(0x7f0000000080)=0x54) getsockopt$IPT_SO_GET_INFO(0xffffffffffffffff, 0x0, 0x40, &(0x7f0000000140)={'raw\x00'}, &(0x7f00000000c0)=0x54) 02:25:13 executing program 5: r0 = open(&(0x7f0000000500)='./bus\x00', 0x141042, 0x0) close(r0) syz_open_dev$loop(&(0x7f0000000540)='/dev/loop#\x00', 0x0, 0x105082) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0x526987c9) read(r1, &(0x7f0000000200)=""/250, 0x50c7e3e3) [ 1302.198568][T30587] IPVS: ftp: loaded support on port[0] = 21 [ 1302.205467][T30586] binder: 30580:30586 got transaction to context manager from process owning it [ 1302.205963][T30589] binder_alloc: 30580: binder_alloc_buf, no vma [ 1302.220673][T30591] IPVS: ftp: loaded support on port[0] = 21 02:25:13 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:25:13 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0xfdfdffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1302.429276][T30668] binder: 30665:30668 got transaction to context manager from process owning it 02:25:13 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1302.481989][T30703] binder_alloc: 30665: binder_alloc_buf, no vma 02:25:13 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0xfffffdfd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1302.620800][T30707] binder: 30705:30707 got transaction to context manager from process owning it [ 1302.658266][T30709] binder_alloc: 30705: binder_alloc_buf, no vma 02:25:13 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1302.814939][T30714] binder: 30712:30714 got transaction to context manager from process owning it 02:25:15 executing program 4: unshare(0x40000000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x0, &(0x7f0000000100)="0adc1f123c123f3188b070") r1 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$IPT_SO_GET_INFO(r1, 0x203000000000000, 0x40, &(0x7f0000000000)={'security\x00'}, &(0x7f0000000080)=0x54) getsockopt$IPT_SO_GET_INFO(r1, 0x0, 0x40, &(0x7f0000000140)={'raw\x00'}, &(0x7f00000000c0)=0x54) 02:25:15 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x100000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:25:15 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:25:15 executing program 5: r0 = open(&(0x7f0000000500)='./bus\x00', 0x141042, 0x0) close(r0) syz_open_dev$loop(&(0x7f0000000540)='/dev/loop#\x00', 0x0, 0x105082) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0x526987c9) r3 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/mixer\x00', 0x80040, 0x0) read(r1, &(0x7f0000000200)=""/250, 0x50c7e3e3) getsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000000100)={{{@in6=@loopback, @in=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@remote}, 0x0, @in=@empty}}, &(0x7f0000000300)=0xe8) bind$xdp(r3, &(0x7f0000000380)={0x2c, 0x5, r4, 0x3c, r1}, 0x10) 02:25:15 executing program 1: unshare(0x40000000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0adc1f123c123f3188b070") r1 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$IPT_SO_GET_INFO(r1, 0x203000000000000, 0x40, &(0x7f0000000000)={'security\x00'}, &(0x7f0000000080)=0x54) getsockopt$IPT_SO_GET_INFO(0xffffffffffffffff, 0x0, 0x40, &(0x7f0000000140)={'raw\x00'}, &(0x7f00000000c0)=0x54) 02:25:15 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000044ff8)={0xffffffffffffffff, 0xffffffffffffffff}) bind$unix(r0, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) connect$unix(r0, &(0x7f00000bc000)=@abs, 0x8) sendmmsg$unix(r1, &(0x7f00000bd000), 0x80, 0x0) connect$unix(r0, &(0x7f00003de000)=@file={0x1, './file0\x00'}, 0xa) connect$unix(r0, 0x0, 0x0) [ 1305.006727][T30728] IPVS: ftp: loaded support on port[0] = 21 [ 1305.016452][T30729] binder: 30721:30729 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1305.033307][T30726] binder: 30725:30726 got transaction to context manager from process owning it [ 1305.042647][T30729] binder_alloc: 30725: binder_alloc_buf, no vma [ 1305.049169][T30729] binder_transaction: 10 callbacks suppressed [ 1305.049186][T30729] binder: 30721:30729 transaction failed 29189/-3, size 0-0 line 3148 [ 1305.063983][T30726] binder: 30725:30726 transaction failed 29201/-22, size 0-0 line 2986 [ 1305.082659][T30733] IPVS: ftp: loaded support on port[0] = 21 02:25:15 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:25:15 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x48, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1305.163195][T23756] binder_release_work: 10 callbacks suppressed [ 1305.163203][T23756] binder: undelivered TRANSACTION_ERROR: 29189 [ 1305.207820][T23756] binder: undelivered TRANSACTION_ERROR: 29201 [ 1305.294933][T30840] binder: 30825:30840 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1305.322865][T30840] binder_alloc: 30841: binder_alloc_buf, no vma [ 1305.339381][T30840] binder: 30825:30840 transaction failed 29189/-3, size 0-0 line 3148 [ 1305.354014][T30842] binder: 30841:30842 got transaction to context manager from process owning it [ 1305.372455][T30842] binder: 30841:30842 transaction failed 29201/-22, size 0-0 line 2986 02:25:16 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x300000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1305.439129][T23756] binder: undelivered TRANSACTION_ERROR: 29189 02:25:16 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x4c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1305.496777][T11447] binder: undelivered TRANSACTION_ERROR: 29201 02:25:16 executing program 5: r0 = open(&(0x7f0000000500)='./bus\x00', 0x141042, 0x0) close(r0) syz_open_dev$loop(&(0x7f0000000540)='/dev/loop#\x00', 0x0, 0x105082) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0x526987c9) ioctl$sock_kcm_SIOCKCMCLONE(r2, 0x89e2, &(0x7f0000000000)={r1}) read(r1, &(0x7f0000000200)=""/250, 0x50c7e3e3) [ 1305.563846][T30846] binder: 30844:30846 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1305.599198][T30850] binder: 30847:30850 got transaction to context manager from process owning it [ 1305.615317][T30846] binder_alloc: 30847: binder_alloc_buf, no vma [ 1305.616787][T30850] binder: 30847:30850 transaction failed 29201/-22, size 0-0 line 2986 [ 1305.651958][T30846] binder: 30844:30846 transaction failed 29189/-3, size 0-0 line 3148 02:25:16 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1305.661814][T23756] binder: undelivered TRANSACTION_ERROR: 29201 [ 1305.715828][T23756] binder: undelivered TRANSACTION_ERROR: 29189 [ 1305.753368][T30856] binder: 30855:30856 got transaction to context manager from process owning it [ 1305.794523][T30856] binder: 30855:30856 transaction failed 29201/-22, size 0-0 line 2986 [ 1305.887753][T11447] binder: undelivered TRANSACTION_ERROR: 29201 02:25:18 executing program 4: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) getsockopt$bt_hci(r0, 0x0, 0x3, &(0x7f0000000040)=""/117, &(0x7f00000000c0)=0x75) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000044ff8)={0xffffffffffffffff, 0xffffffffffffffff}) bind$unix(r1, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) connect$unix(r1, &(0x7f00000bc000)=@abs, 0x8) sendmmsg$unix(r2, &(0x7f00000bd000), 0x80, 0x0) connect$unix(r1, &(0x7f00003de000)=@file={0x1, './file0\x00'}, 0xa) connect$unix(r1, &(0x7f0000681000)=@abs, 0x8) 02:25:18 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x400000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:25:18 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000044ff8)={0xffffffffffffffff, 0xffffffffffffffff}) bind$unix(r0, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) connect$unix(r0, &(0x7f00000bc000)=@abs, 0x8) sendmmsg$unix(r1, &(0x7f00000bd000), 0x80, 0x0) connect$unix(r0, &(0x7f00003de000)=@file={0x1, './file0\x00'}, 0xa) connect$unix(r0, 0x0, 0x0) 02:25:18 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x68, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:25:18 executing program 1: unshare(0x40000000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0adc1f123c123f3188b070") r1 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$IPT_SO_GET_INFO(r1, 0x203000000000000, 0x40, &(0x7f0000000000)={'security\x00'}, &(0x7f0000000080)=0x54) getsockopt$IPT_SO_GET_INFO(0xffffffffffffffff, 0x0, 0x40, &(0x7f0000000140)={'raw\x00'}, &(0x7f00000000c0)=0x54) 02:25:18 executing program 5: r0 = open(&(0x7f0000000500)='./bus\x00', 0x141042, 0x0) close(r0) write$cgroup_subtree(r0, &(0x7f0000000000)={[{0x2d, 'pids'}]}, 0x6) syz_open_dev$loop(&(0x7f0000000540)='/dev/loop#\x00', 0x0, 0x105082) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0x526987c9) read(r1, &(0x7f0000000200)=""/250, 0x50c7e3e3) [ 1307.725417][T30867] binder: 30865:30867 got transaction to context manager from process owning it [ 1307.762360][T30870] IPVS: ftp: loaded support on port[0] = 21 [ 1307.770583][T30867] binder: 30865:30867 transaction failed 29201/-22, size 0-0 line 2986 [ 1307.790577][T30877] binder_alloc: 30865: binder_alloc_buf, no vma [ 1307.808811][T30877] binder: 30871:30877 transaction failed 29189/-3, size 0-0 line 3148 02:25:18 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x6c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1307.855295][T15460] binder: undelivered TRANSACTION_ERROR: 29201 02:25:18 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x500000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1307.907422][T23756] binder: undelivered TRANSACTION_ERROR: 29189 02:25:18 executing program 4: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) getsockopt$bt_hci(r0, 0x0, 0x3, &(0x7f0000000040)=""/117, &(0x7f00000000c0)=0x75) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000044ff8)={0xffffffffffffffff, 0xffffffffffffffff}) bind$unix(r1, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) connect$unix(r1, &(0x7f00000bc000)=@abs, 0x8) sendmmsg$unix(r2, &(0x7f00000bd000), 0x80, 0x0) connect$unix(r1, &(0x7f00003de000)=@file={0x1, './file0\x00'}, 0xa) connect$unix(r1, &(0x7f0000681000)=@abs, 0x8) [ 1308.026799][T30983] binder: 30974:30983 Acquire 1 refcount change on invalid ref 0 ret -22 [ 1308.058505][T30986] binder: 30984:30986 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1308.076478][T30986] binder: 30984:30986 transaction failed 29189/-22, size 0-0 line 2995 [ 1308.105016][T30983] binder: 30974:30983 Acquire 1 refcount change on invalid ref 0 ret -22 02:25:18 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x600000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1308.131472][T23756] binder: undelivered TRANSACTION_ERROR: 29189 02:25:19 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x74, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1308.221924][T30991] binder: 30990:30991 IncRefs 0 refcount change on invalid ref 0 ret -22 02:25:19 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x700000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:25:19 executing program 5: r0 = open(&(0x7f0000000500)='./bus\x00', 0x141042, 0x0) close(r0) syz_open_dev$loop(&(0x7f0000000540)='/dev/loop#\x00', 0x0, 0x105082) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) getsockopt$sock_linger(r0, 0x1, 0xd, &(0x7f0000000000), &(0x7f0000000040)=0x8) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0x526987c9) read(r1, &(0x7f0000000200)=""/250, 0x50c7e3e3) 02:25:19 executing program 4: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) getsockopt$bt_hci(r0, 0x0, 0x3, &(0x7f0000000040)=""/117, &(0x7f00000000c0)=0x75) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000044ff8)={0xffffffffffffffff, 0xffffffffffffffff}) bind$unix(r1, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) connect$unix(r1, &(0x7f00000bc000)=@abs, 0x8) sendmmsg$unix(r2, &(0x7f00000bd000), 0x80, 0x0) connect$unix(r1, &(0x7f00003de000)=@file={0x1, './file0\x00'}, 0xa) connect$unix(r1, &(0x7f0000681000)=@abs, 0x8) [ 1308.450427][T31100] binder: 31080:31100 got transaction to context manager from process owning it [ 1308.460526][T31099] binder_alloc: 31080: binder_alloc_buf, no vma 02:25:19 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x7a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:25:19 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0xa00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1308.666856][T31146] binder: 31108:31146 got transaction to context manager from process owning it [ 1308.703361][T31191] binder_alloc: 31108: binder_alloc_buf, no vma 02:25:19 executing program 1: unshare(0x40000000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0adc1f123c123f3188b070") r1 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$IPT_SO_GET_INFO(r1, 0x203000000000000, 0x40, &(0x7f0000000000)={'security\x00'}, &(0x7f0000000080)=0x54) getsockopt$IPT_SO_GET_INFO(r1, 0x0, 0x40, 0x0, &(0x7f00000000c0)) 02:25:19 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x4c000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:25:19 executing program 4: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) getsockopt$bt_hci(r0, 0x0, 0x3, &(0x7f0000000040)=""/117, &(0x7f00000000c0)=0x75) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x41, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getpgid(0xffffffffffffffff) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000044ff8)={0xffffffffffffffff, 0xffffffffffffffff}) bind$unix(r1, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x80, 0x0) connect$unix(r1, &(0x7f00003de000)=@file={0x1, './file0\x00'}, 0xa) connect$unix(r1, &(0x7f0000681000)=@abs, 0x8) 02:25:19 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x300, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:25:19 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x2000000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1308.911768][T31218] binder: 31216:31218 got transaction to context manager from process owning it [ 1308.928408][T31223] binder: BINDER_SET_CONTEXT_MGR already set [ 1308.947689][T31223] binder: 31220:31223 ioctl 40046207 0 returned -16 02:25:19 executing program 5: close(0xffffffffffffffff) syz_open_dev$loop(&(0x7f0000000540)='/dev/loop#\x00', 0x0, 0x105082) r0 = syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x10001, 0x200000) setsockopt$RDS_FREE_MR(r0, 0x114, 0x3, &(0x7f0000000040)={{0x3, 0x80000001}, 0x2}, 0x10) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0x526987c9) read(r1, &(0x7f0000000380)=""/250, 0xffffffffffffffd2) [ 1308.957977][T31224] binder_alloc: 31216: binder_alloc_buf, no vma [ 1308.979780][T31225] IPVS: ftp: loaded support on port[0] = 21 02:25:19 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x500, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1309.063809][T31223] binder_alloc: 31216: binder_alloc_buf, no vma 02:25:19 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x4800000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:25:19 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x4c000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1309.175601][T31235] binder: 31233:31235 got transaction to context manager from process owning it 02:25:20 executing program 4: unshare(0x40000000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) r0 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$IPT_SO_GET_INFO(r0, 0x203000000000000, 0x40, &(0x7f0000000000)={'security\x00'}, &(0x7f0000000080)=0x54) getsockopt$IPT_SO_GET_INFO(r0, 0x0, 0x40, &(0x7f0000000140)={'raw\x00'}, &(0x7f00000000c0)=0x54) 02:25:20 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x600, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1309.306186][T31241] binder_alloc: 31239: binder_alloc_buf, no vma [ 1309.353793][T31240] binder: 31239:31240 got transaction to context manager from process owning it [ 1309.379280][T31244] IPVS: ftp: loaded support on port[0] = 21 02:25:20 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x4c00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1309.401150][T31246] binder: BINDER_SET_CONTEXT_MGR already set [ 1309.440979][T31246] binder: 31245:31246 ioctl 40046207 0 returned -16 [ 1309.456647][T31266] binder: 31245:31266 Acquire 1 refcount change on invalid ref 0 ret -22 [ 1309.526463][T31303] binder: 31283:31303 IncRefs 0 refcount change on invalid ref 0 ret -22 02:25:20 executing program 1: unshare(0x40000000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0adc1f123c123f3188b070") r1 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$IPT_SO_GET_INFO(r1, 0x203000000000000, 0x40, &(0x7f0000000000)={'security\x00'}, &(0x7f0000000080)=0x54) getsockopt$IPT_SO_GET_INFO(r1, 0x0, 0x40, 0x0, &(0x7f00000000c0)) 02:25:20 executing program 0: unshare(0x40000000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) r0 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$IPT_SO_GET_INFO(r0, 0x203000000000000, 0x40, &(0x7f0000000000)={'security\x00'}, &(0x7f0000000080)=0x54) getsockopt$IPT_SO_GET_INFO(r0, 0x0, 0x40, &(0x7f0000000140)={'raw\x00'}, &(0x7f00000000c0)=0x54) 02:25:20 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x700, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:25:20 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x6000000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:25:20 executing program 4: unshare(0x40000000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) r0 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$IPT_SO_GET_INFO(r0, 0x203000000000000, 0x40, &(0x7f0000000000)={'security\x00'}, &(0x7f0000000080)=0x54) getsockopt$IPT_SO_GET_INFO(r0, 0x0, 0x40, &(0x7f0000000140)={'raw\x00'}, &(0x7f00000000c0)=0x54) 02:25:20 executing program 5: r0 = open(&(0x7f0000000500)='./bus\x00', 0x141042, 0x0) close(r0) getsockopt$inet_sctp6_SCTP_ASSOCINFO(r0, 0x84, 0x1, &(0x7f0000000000)={0x0, 0x897f, 0x3a9e, 0x7, 0x1ff, 0x9bc}, &(0x7f0000000040)=0x14) setsockopt$inet_sctp_SCTP_MAXSEG(r0, 0x84, 0xd, &(0x7f0000000080)=@assoc_id=r1, 0x4) syz_open_dev$loop(&(0x7f0000000540)='/dev/loop#\x00', 0x0, 0x105082) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg(r2, &(0x7f0000005c00)=[{{&(0x7f00000000c0)=@pppoe={0x18, 0x0, {0x2, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, 'veth0\x00'}}, 0x80, &(0x7f00000007c0)=[{&(0x7f0000000140)="98ba125196a3ad2cbd15161143f39c4e43fbb9975147af4390fa97a23eea0925f8c3ecd0004abb0b319f1d795a813ae20da4cc9172967a28c28421b5cf9818becc8fea175005e5b3bd446b8e14af9972c8dfa38096d39f104d83490269457e08b050a92373f1288cbccd99525ca64aa9c0c06e94e9bac6a8f77aff4df21f364121ccd1c60628864f02340c88de649924489200c16c8d3b14177553c5980781e5904c38", 0xa3}, {&(0x7f0000000380)="0f546ebe6ff6f98345db00631d6c558d77f722cee241cdd0d00354c430d484adb51a923b7ba087a2c188e0b8fef7a0021644c8c363d4ce0b2e8bfee34931e5d4990a2294b5dc88b2ef0235a5db647b19d9576a2ba5d866060e04619f895439a13e7f67ab", 0x64}, {&(0x7f0000000300)="3be742eb184471f2b01ac3de376d70087020f1c8ce06811fc2be27c42af045c89e5f9c944ac9f760", 0x28}, {&(0x7f0000000580)="12db701c21d0b8a059d077c18a9d4790e8ae0212bd3706a4cb0a181036827883b5beb8e173c69d3ae64019c771f88f29449f7159e22c969c05245a227d052eabeba1a48f68b9282311ec97e6dfc643b9820e09d6bd9c6fa97ffb3c989e594df45bb4c632f631a105626b61fb3564a44a7214af398f5446ce82251b168f53556f73017956a941e65232e54a196d9aa17b1331adeb1928969703a8acb801918d99b03e953a08a38c5065853ef46c742056cbc28d851ed2220e3307cbc198c555", 0xbf}, {&(0x7f0000000640)="7c6458a9693a1453a32dba3307cc23f7da2dc20ddfc829569c7f17b97c616cf8ed179fbf16c2438bf3fe58eb0f40122533af7fb4eff7437cd9024ff769b2723df69a2370ff2be89f40306cbcd99f76ba2333bb0bf81f44209141d6669754c3a8573ada5ddb9f5edd5cafb4e4af3699cbd0fcd50f", 0x74}, {&(0x7f0000000400)="a0d76b0f213c2023db41b043eb528f60f2f55b6d3911604a091bff11a39b36c7de7d0a7c5aee063da4c3d96fd55b3c386a138d9e830c", 0x36}, {&(0x7f00000006c0)="43dbe290a369e506ebf8cfd475f1cebb16187e0e5cf71f2b488e08b7e0123c0d54d6fcf4eba613a07a34d4334399f6137fa00b506ab863d56fb2e188e18fcdbcc7739fa1c8d5e26547aa81a78837cc1e87268d9fb8b25a6bc62425a81ac379c16b75e89d84699d32c0f9ba322b2a9b0538a7fe9210348d5a2b202cccd30e9ce89974ba6048f67a418294006f2fd70376f902bbae3feeda8dadbed6e8018c4728197e4d137334d0c404bb49461443cb1c938939ca105abece75cbe215e6feff84c98075c29fc7b7", 0xc7}], 0x7, &(0x7f0000000840)=[{0x108, 0x10f, 0x98a, "2ecd49004b13200a4ea387e6da29e955b7a0f9233cbb253ccfca43f5073e9f08a8c3ebd6b440b6801175792647517b4a0f1607c1c9f1a8b6a17fcb8aa9fecd5df05efeb9914014f84415ab621b794dc6933663cbb4e19dbc8f2517fc92aa865afa17ecc5a700ea3c3d7bf9e9b3a06e0d0c2e7d3c4494efbea440a72a4044617d0f25f2fb4b7b58177ad36d3ad8768256777b178ec5f21715b6cef0b64fe84b2e935cad3e5b49f152d0942a14dd3a122cb2ba66844c3123a11747b1ad7cb936ef0920c6fb9991fb17d4debc73f6a54f46842ba25200c38c7127b64e888874f1bfef5112373ba5495596199339b05a4d8c845e7653f7ec"}, {0x20, 0x11f, 0x8, "bab3a1b6bc8c5cec4559893f70ee9780"}, {0x30, 0x111, 0x5, "5a5611913f6fde5fefe148c7e98815987f766f3f18ae7f0b7a91de"}, {0xd0, 0x0, 0x3, "4ca08d9aed7dc6b661012a8169dc7e2c7f2195d3f058e397a40b5410d5bb00a596aed4d0e1ae602b5bdfda10b402b4e81e2a696bd9591198b83254c72d0c91183ab5048870d14e48a98c312c3c30518417c0b66294d626d7ca8c6521048a0d578d549b19c91309a1740356c91c2061d7f5a451daeafca23a4d8dea4cedf4b5934a334014a5c243df1c9413c464b8969158921a21b788b78c9017dfbdca75ee9eef1c136c39740fab1fecba486dabf11b7cae3d734d48e8a74e2094dc7b7a59"}, {0x10, 0x116, 0x7}], 0x238}, 0xe18}, {{&(0x7f0000000a80)=@llc={0x1a, 0x18, 0x7, 0x9, 0x5, 0x1}, 0x80, &(0x7f0000000b40)=[{&(0x7f0000000b00)="d50b8b71e829ab5822a7568a64628c563e1833488bf0547db4cc7b54f26000d54dbaa7ca72", 0x25}], 0x1}, 0x5}, {{&(0x7f0000000b80)=@ax25={{0x3, @bcast, 0x6}, [@rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @bcast, @default, @bcast, @null]}, 0x80, &(0x7f0000002040)=[{&(0x7f0000000c00)="20631e7a195dc6a0bfd26a20ecebce8bbfff84cf113c2399da04a7ad3e115119d2538bfe8a2d8f4f3ea901cb5ad9ebd13ae606b3e798c07023423638d65839219e07addd2316374e9d9da43c1727789c24002d585af92232cf8ec830d34a02eb0a5dd9754173de898ca40e7239325c25c6698d611342f0062cb40f2a81ef43ff626ed4067601079f59d8f72ec51ddc12bb2b5ba7082d35bfdcb9445f32789d7a34ffb95a", 0xa4}, {&(0x7f0000000cc0)="df65e0a52cc4784f263f416c224dcc41fb42238c70c8e8b0a6760a142549c6f5af5d10b1d5c77f423e92d302a417e9c102a93505cfb1ca7bd96006781cfd2ccf108f015c5e86ffb75f0dec9a7ebc662f2a836b0ce2fa598ccbdb039a8f95771e9b69a73259db5578612c35fc9ef1899cdf4f3edee5b2cad7e364c4a385003ffc6f3a689e952b05c8b21bfdd4f4db09590f71d37cf1243e7090dc8ff6db6fe73d571ef81217e636849500791762e0d8ff557906097d9529bf30ce79c85a65ec115ce8", 0xc2}, {&(0x7f0000000dc0)="012292ac773b8a15a593f8f54a4306a2485f0927b22c8a91eb209a7e5ac8ced83e8b91b702b938f126d8d8fd43abb3e22b6858299fa57848", 0x38}, {&(0x7f0000000e00)="7ff31dceea217557ba0f48c31d135bda1b717f025cb47c04e03d1ffe36973c6a3118558fc5e5d894d093305381d13ae2715d9a83ff1daf27915f27af7d1f70412e15e5c666257a52fed984dcb8be16961624c0ae00d0f0cc0326e0f3e294155552f367c2ccdd52470e6a0f8e7133319df3a6f5181b8286ae9a0983c060007ddfdaf8828769d506488bb0df1896e60015492ae13211f09ecd5bc35a494c8c85d187d9a6895a3020a9ed0f11ce5c68cae1062a88f21fc75fdaa4f81ff330bfa778", 0xc0}, {&(0x7f0000000ec0)="27f56863b47e305248d9978885ec608f81554a523b65ff0239144235e2369f4b0f617b3430440db9e0712aac91bdc19000a43178ac2fbeb0965b085e27759ae8e7ca09a3057d2acdfed341bef0900ebb4da13424616218e8bd0491f1e567bf80f13b8e11a1cb4acb801279884297e6278011b528d7f63f6837ca83d9da3c4955c8491cfac1e2bdbaceb7aa54301ee85a44f8dfc3f587fd93dfa10181f5fbf6c9ec727920170c45920341aed51197767fd78bb48ef8bd197e35d73828e0fb0358cadf9bc4c5406d0b28d749c27f880ffd51383451e0a89228fc15c2b611a54a863fb811", 0xe3}, {&(0x7f0000000fc0)="475ed805b2bbb054f2e58883b3bceb85f1a9a063d487654aad5de1cd7540c107daf4bde4b95c87c7fd06c9dac040471842d4d8491993f7c054ff25ac5a12055762d3f7151d9c44540a1b3c339fecc40dd304954f596804b0b5d3a8e7dbb50dada8d613773408b4a17ca4657cf3c8d3d3f6f22763c0531bd86424f44ec4c7d0d89da2fe639789e72fabc6233a9b983853f7d45d6b3213079d5fb4ffbf9c46e0daaf77595da35bd61de7fc37f4b27524608836036a756bd3233bb744666e377d04cfc1b0f2fddc9c677af826a1ef7e00552b44c99a7d190629ed0644bd63485e8cee6c0006121a9a3e958757e88ec25625671d8947488bf1956ed66377b2864fba2d6fe0ba2b58cc3565f98710a9ddab23bb3b406c1b080ea3bbb5b266d6fbcb56957f1ad494727a0c40c678645423dbca8b9a55be6199367f4a846f9ee009ccf7f85b6abe492fdd22a28610164a276dc8b2ab1f849aee231efa93766d5449d9d31ea260fd193b6e2f39a8f36f47b65a06cc9b07d31eacc7dc84a49acee0a84704263eccbfeb463f7c68e67a3ea1ff2ccfdbd7b740997ac0867aba279f6ecbdc450dd7468718c4d1c82d6059313749759f8b46d361bbcad17105cfc74197b7f24f2d8709442866fbe1df8859798acf9995ed8dc541e3e2435ce76b34b4b290494b20ab564223bfb1ed516e17f9e53b3e9df4253783dfec56e4945ed074e250a413e036d5339b78a9d9f0b2ce433ba80d4d4d0d11e23b2154c3ff526c0030c0e9f0b6be7def422d9f8423934166f4ceb8e5d5ca5653fd756d7e640aa613281a6348d6b3729e80e121467c9bbda4efc1b15f20f4712d745ad428a8e23f21be4802b5268ab1d2404a4316048317292a40cfcb7dbf0535857f861c8c1b7568b008be35fa8980c12fa574c5e24d7e5a0f28c18ad8fe87e652e306937b8d92d451a6578fa3d3ecd4ddddcfcba1b7eec78b33d8b049a226a0ef1c75869cd64835e645f61d759fbd076a6f6b4d156b4cba0a6b8be84255eaca97443e6006d4d61d405ba83638ebf05dcbca11ef230aa6cf4deae4411f7d1789552a5d10a2502db340c616ee154d83dadfb60a3ee1cc5283e907b02d49e3a14b9e6f9ce49035193d7ab8addd0efeff0ebed888cebc25f35b7e311514357f59fa0949568d8a6751a5af535ba751d6d1696d97b40205bcf335d57e40cb6660faba297177901ce013702a3e7bdfcf00af9d8641903a2130f2e8fe6a6cbdf167f7ccda4eeeffcbb6eaed25f597644a98939aa7ff8bc6e3047fca8b8bd349d04f48e25a6624be4a52ec5f63dc1fb9e643bdd1152f05a8198ba3ddfcbe6f093bc35786c300fcc95e172543106506f752aa9f40db5e4bae2f8f458fec414bc3b97c72dcb4314cf0f1b03a2d62516fb1270e14d610d6c0a6468112781d6d2b830eef2c89d88c518caa4aa9149b292ff1196605304d26f38b71fb8165fdb565a234e8af3ea5b0280f0ea80dea3adb56deb45328c9b19a517b6ce9aea40c134e9a6ad440e3f102346f3af1daa5ebc87c36c08bc17cbaba36a7fba16136e0eef14fcc8959b055c47b4861d630d6857a9220023b939632d34b6742eb234e18388cc9ece0e3ebbeda04908c8d3022a9e85b227b6e573af97ad211930c1cdebcdedb6c2fa1eb900f157df0d18918a8e4efd4aafc42eec8c47cada15a07f6db20153c3fae5770312ce957ae8a59ac6226ff749694ec9597d10716004d76414f83df3084b658df25bf617bd8c9a4f7f697aa76464d3a3ea28128f62e3e6f0a4a5523dc48b0aff567ba176a3b33d956631e74fcce56fac40967a757f2449812354774da78933f06f54cc3ad8f61b93168aaf3d3da41f1ef19ae11fe3e7b5a621756c5c399349f1dbf0deffa58504306efffb44a87865a320bae03f1587ae0c02790d0099cb3d81417a717cbd8f82955a2fcf7dc069c4f6339675f025d14b45919dd36a8db04a3863206ceb7dc9c5c289d07c5159ac7ebefa1c346a9c1b680e8af53befd90a1d469618350075d79e4b1cb3217852c42000a5928c31783acc4bfee2624bb3a0af7fc183a3b0cc9826e77211a9cf40b405ef4f772bd2479de7c41abcc92bc65fd8cb96fe6c006e2b6376366451a447a1c4af287244b285edd486f82816af34696951c9808a6e740812ace6e2775ddc28b6e800a97bfbf84c6d7b652228d7e3791ae81880a6371b60a69db239a4e6b2c233380e2539871dc1ea7481da9f6b68d57b3cda34bfb02efeeb688c569c677eaa849762e96ce9641d963bb235c2b385877b2e40a98ff8f9ba324f55c51bfc12202b808623e9aa23dd47a8f5257629911ef4c8e08ea8f6f1105219e94f434145d2e2c6d37cd584a24c64b0034b156607f6e07cfe0a4f8b6e3b29126d477cff5be1b6251231cbaf803fedb1b92b9246652b59cb1601da40c7959dc9a4468b845bd759e8d2feb86a34fb5a5bc8f59a666e1ec2449b3d2774db0060f9eeb9327b438d455c6b3e9b8d29aeed31620452087731c07db019ca23bf9e8f5f053725515ef88845ee115b54842487706ef8363b58b19fc9fadf4ef6e4add7339dd52962312242746538f2064be2c4cb95f02cad2228403583f44cf713b81159de0c71f3c03c795564fcc412a405ff800dee8450e289a9db030450009ca1a2fc7da9858f98f523cbc4cb2eff2d434b5593dd02b38556209ae5525eb2903f605e23a462b3cda02df653d1ae8cdeb6c6838f559b8cd49fc4bec7b26c8b09a68cd3affe9fbdde6daa0137de3955031c473b8b6a4816ba896307af83be793f02d547d188a962b03a219d518c02001202db2f6777b10944a60fbd193fea36240abdd43c3556f402dcddbc50cfa7b380431eebff2a991b7560d3db64a03f1154b7ea09f4837ca4dc973276103c5b425e8bda7e417782d8f1fe7859c981c217fcab0bf98208c786ff6e90ef3126a18684dc71f1e056f0efc219fdd962c1396031af590b3fe7a4745ee6d778b7d8a6c2d4e83f0981e4bbb66d298e42e5ff6b482ab6b2e672753c6079a961aa747f00584d0a1d182e96816908b3ed4c4c6af23a5fc3e10d8f48c3c585b89e2ec01ee97c847aa3f238c30fdb8948ed082b0381cd8bba1f42da1bbd1a37592737a8349bd0989fe24f0972a22535499bfabab7c7331f355b9cf0a7666a36e619e92b893de25676abca7d57a23a71a503022bfa730320742cc46eaac906ec276ce329eeb49c7288bab12f419b5efaf359cbb6905b05eeb9557c237c19e4fd2b95e60d205fcf414279933596c9e1c036524887fa8d22e7ec557ec4cd0beea05bd74b5881fbf7034706c4ff2c7f25a5b1a33c1c58ab8c96e5c660ab22d2447d076659080e5e530f2ee0bb0f81e01ba62f64879271fc665164474440b7460abee56f6c543143ef6ca22721deb8b0952219636c89b365e4f6244dbaed4808b29b4b3842754e713e2d249f76fdbbf5e5edd5fe12231d15fd24a5d4820ebac6c018029e5204ff2625d37b4a1d216e7cafa3d1242a3bf83528723b9c5fe89ef24b1a691550b5d9b6e4765a9aff69f36aebb05780ff3b8a3bce11b6d4df6ee00b6feaaf9b56e3ca8751b9e6f7ac1a0a379d96a0e634959669ce42ff5c6abfceff79cca4f48199fff56e2225e4e0e67b82d47e50233579cba98ec2269a4b1bdef98a2be1c3b3d48a0a9f25b31bbcf685d64084b008e08b32b81ff1c12b330a462081f2737e040bc40c3bdfa5d1c58b443e47b540d2db09472fb31af928d54e8c26cca2e89574c3edc45af23be288cbd38037f9274f38fe2649409a68abb92a963faff3b308a4932b39fab178162e11ee37cadc8924ab13aebea2ed762fcf5e922054dcc54ea5fad9dffad563bf6666ba6123f9a6558441603750ec8661bc926ddef649158ba8a94c4082328f43bae669f80b0ef7a551bbb81406b857681a482db8e0a45e86411e14f6c048c5b90da27ebb94b8d7b7c66a7588031bc929d1c7c7247ef6bde88e692166f26e253e65dd61e434c3589fbf39612314937db2d5984cd5b9ba98395ebea7adfff57de11792be197b2f2ef3efbe578d2b0342778a67bf8cb277f19332df4fcf2aa8bc724a84a5a51b754c3f34a456c9fae52521f531a5392b734b36e00b59067105848c6e6c187df6f305211d6f4100ac3747bab755c7b23083c07297caea1d5c97913d9ae5a9bbd561a6ff250d4eb7d0d087d8b150e432a4d242d22ca97201cdc1ce312f414ebdc674414cd127e740315f2ca7f01dacb520196912a9b5955fa3f303a830654302f10fbc82155c1f2146b6704a30f2ff2c8356374a1aa03cf6313b47de55c63e13a6c69270a95e34022b762d47b7c8693ec3975729bcb590ab5b8e55e65b403466d8401ae82486ae59d93dfa752704dfbcfe9dd8a94588e055a97f2e7d2cd8f32896113b9774e8fa75cfb6da5d5ff7ae2e041aca85e7ba45a947020afe81949f5d13635e2628d9390e122a05172219742f61b079ddd92499b4ec20da160860b479a78ba670b0aba4e7d897afdfa84d559299e8b6c8f5a769e0366f5304a13d3c1846e09cb0fdca730a1f1db2c447e1062bbe48dfaafae9197a8776a24d54059f2be7f5b52deb73d9251cb6fa937fbb780b50af19c610cefc42327d41a563d39de4be5758a200d00ed5ea1caeccd2d6a4f306b4185125309609e2ceccae5c1f3aca091c7ad25dc96edfd3b75b073cf7f692f06c05486b733e2ee78f2583be72398d3879ecdb7b2cfce187e1e01288c91f2aafeddbb38160d7208c6871a56b910cdabbf6333a650dacf70e00d748c55a81d3dce4978cb599dfbabe957fe7ffceb332e6ebc280f05d3248c5003bdcc658c90e43c15bec9f5a303b6c37687af493fdb8e2ca5029073a57ae5869e3afae45467e244fc4f52f5859a4ed5678b7725656d0b1b8dca6875d3484e388d6ed6c60b9fe804873cf804d99adb2cb900d48ed9621910a88144f41b3046fbca8a78f093eba9f233c9529448a4a3aa143590f88296f0e65d0372561dfa8898a27f90b3b95ce788ec9e06cfafd5b7d7b5a49b27c928a54ada33d6e63f866ea6a978e0f3041ef9c4bfea78bdfcb3ca1a1e88a588ba5bd0741b8e66052b37f7e042725a16b275996918c9681007ca0e49b8a2087cbcc003a6c6fe11fa0921dd70ca2a2a85acd9020f3304dea91f3ee2255df2d0f037e389a7f5540dae9abfb30ebed37a0590d86ca3e157f4681088dd71af6872cfabf915e5ea970633da4197966bc8f7fc440fc46bb63a5b1f78ff12d76e70078917ddc9f6fd739de29de196bb7b3c8bf10846aeb7c3ec450ccf67b96ee776871fbbddd61ee6eac98c94bbbd7b7e2b216cd0d07e20ad85138e9069f3539d2a1184372e64635a3ed40de2c62d1da70eb96651ab347c53ed5ee9f421607dc8ec9363743dcbf053fc7bae0050c79204f923ab8a850d334589e1677de8fed8cb7fb839e5c29d55179da1b54f4e7e39c456835c087066c2107c9a55c94f5eccfb99af94f4fe5b0ff339d669fe666bd93586d072ccec2c442bd9521a5aa74dca3bafec1e324c6ac9bd59e174971c7958d6d0c24f5966e94afb7c0b40908837a567f9ba9e9e635f0b709809c4372806fc73d7f403c256f8f3a123ae13a6e3081eb1c18107caf0cf279e5d8a35efe9df1f4bfac6b0a755ac126ec8cd3bde49caedb9fa38762436b46be0d3f119315cb8bc2cb3db13b09f1aebdcafdf6d904b7f33022d7561475ffc23223ef9b80975f0918e980f65eb1a7260b3ac345aa7309b95a81e341fd35dc7c246bb6231324359eeeb9eb29e025d41532d", 0x1000}, {&(0x7f0000001fc0)="49db7d8093d988fc0ea395b5b48a7efd98c4e4c863436f4c258fb5d11e6931e95af3f8936e544e06f3f857c4c583d3b84f51e7004b8b4d69f1db8647aefa09853eb53d207dd0ae999a7237067801bf92a1c84ef743", 0x55}], 0x7, &(0x7f00000020c0)=[{0xf8, 0x10c, 0x0, "7b587cab29da04d86281377788697a17c10f6d1438cd77d4d9a9118e4671bf9e7b54b1c4c6fcbff2b21db7358353d249dc472de0cdff022c7c07a974d20e3d121ceafd9331fca2677c7767fb915789c03400c94e91da95c3d43b01a10ecd67249e83870dc6850482e2e3b9af27e2eafbfa2ab9710ccab25e7e5d72b81b4c5f0296222643b4106fd3518ed13b3deb16d2330f3d6581148baf8cc83299ebb2406573be6e7bd97b283df7d895110657fbabb54659cc8cc4423bc8180e668b1781f374c8a67a89f30f0ff37614af8810a0a228baa0b12874aab1236cc7d9b0ceafedde"}, {0xe8, 0x113, 0x7fffffff, "0548421aa07c381fa8a67c8f5a693d7aa0a11976fc5488b3da8128c655eb662ca69afbee64d861ed12ecea8173b74a86d6546514c755046b6f47c0b1ab42a777fa1fa7466fee209ef00a289845cd785e824e8f8236fa7a7a4a97bc5c0df19ec6ed2ae50ed46c43637d7bf81e72bc08f03336be827ad29e2cad9d4a2ecd98732aa80a413e19a245dd05ba272830f5899db74593ac7d01f4aa40336910e8b34d5b983b9859c846c97bf0c77f38a18d6c1b062ba5110baa347419edf45ea0a5f98e51a7def440876f0d95c457d81d6468e190395a292117"}], 0x1e0}, 0x5}, {{&(0x7f00000022c0)=@isdn={0x22, 0x80000001, 0x85, 0x5, 0x80}, 0x80, &(0x7f00000024c0)=[{&(0x7f0000002340)="79ebbb6614559f0a329eba4ea07df21fe810fa26437ff2e55385db1ca29d8bdbb45d5a070e5701015e68055de648791869aba091f83f4559253a094f3d6bcb5a44d6b26d542c079b6ed6a0f0613047e0f1b6f5bbba31815cb51b9d78f4098993d5f6832a57d76f41ac7a91aa252736a68b734bf272eb18fffe860b606751186d3e81545a9faa34905aae4e8092e7e6d7f9257224d7de27b99c68a9bc93cb660bdac4acda46e82a0df1898f6ff4aae1c1a94260e51792271f6ad54db544c5dafb78922efbb00889fe728febda11d4f8c64eafb0c99aa247085cb9cc7d77c89435939a463abbd7148fc37a355453da889a837b0e64dea7393ed0b61f3c3c", 0xfd}, {&(0x7f0000002440)="d25cbdf94b158a5b3062f0edce14ac0f12049a482e47ef8abc73042e0c0ef9cb9a114ef1fed890f83c4f319162fc69179ff69922201cbe8d19e05c7a258dc2030c78ba94080cefcd69c5dc310ade1cf3cfee88d6da1c05b86a1dc47fe023d704adcbfa1f64c40787", 0x68}], 0x2, &(0x7f0000002500)=[{0xf0, 0x1, 0x3, "9394510fe2c6f18dffaedb1127b33aa0ddd918bf9af9757038c93e2a5a2903c812e9310ae5bfc216d59653551ebad61d677e5522d943ae18aab3695716025cf1a7be46ad5b800cc56a6e242c58669f6dd7b559154a4fe422228829577770b0a1b8b8f9bc34311266adb001a66399dd7d620dcdf0129df8e61fbda599f0bac3772f4574cbd55627b2554885c8ceec8cf7182c02d2796910e78206a40f3051955e86b8319086d673fb970289c6fc07623bed27d541329b6744b57b1c8f8ff2ea6b5667ba2032967953a8f0b432c88677cea4429f15aabffa5e54d94eaeec"}], 0xf0}, 0x10001}, {{&(0x7f0000002600)=@nl=@unspec, 0x80, &(0x7f0000004800)=[{&(0x7f0000002680)="de8b559d2b79273856256c64fdd242c014a7f23d9f56a95b0d8014d8db8008dc8e935994349596b078e823d7d579c644bcc74532e023323df9a449b3db042382010c9757f419859fe186b023461d76440c1476904ee9db0b3d76bca22133463e4d992cb3c917fff327ec2a31eda014b09fa4591159f0b5579c56b04b743af667d9cbca504bec49536a83b1a44d9487faccd5bdb45b", 0x95}, {&(0x7f0000002740)="58bc5a8bb186c9805d9c94095f5a52655565c61c5c370a2e0b2ed2a38a404b6da8c71e55ad5d011da15f4c45660fb6a32072b185d090c9d775acd0fcde352f32fafe18df0d4ab1af2ad62ca6436af77d9b67ebcd2e308a38aed7eb5675dd816fcbc9fb36877342200baaac80146c82819cdb1051c826a6ed9978d383e41a04e4ab5b547872f69edcd16299f1162f4fe6ab3e1176d44598a8d328b67ab0f222af91d4624965987cd2bd775b4d3fcff19c02d6d65391f8f7f3718ae27174fad1f0bca50590471e2124100633da555670800373b4b1cf4a647f91d477c0481b27e2b9197a2ae0c8b13c63da4436ea71af505111c7e914b2645091dd93dc3a7df72e122d99873ba0eaa6b5a2f32532b1aca1ad06d4053f1adde082ba8e3cc8a607ade5612b308a81636395aa9ca959e45696bd8cea40ddd6b5788d520005fd60ccebd533d85e35d1362d70522a320aab2542d0f3e5389db2e3a169ed4e5bebb735cdd4c3194016b3f959243acf048278b0fad8dcb07e3d2c827372a008333845fd085810d7a75451eca3f4fcb3c1abba5b367f13a009f48e862dcebcceef58d050817d2592b9678978602f4bf65abd5007cd6f8b33b723b3466986f2753d74900adcbf868a4fea6c8ed57ec6270eeb9b322816280a026389de35cb0244d231feb27d00174c8f31d826f313eb69ab55decba0caddf050a3a70c6e03a90d255a1daea9f49ac5a2ed3835665d283588f6bf1cd9b5c251e0a4b2e5f6ba2b33420e0dbde91769a9f63986592b7aaf6d5753c79a2f9a109318d19f310307eebcf59a0e3cf2ec6dd85e7bd43e8f4458a24cf247b3376e86d825f2bdcc02032e0786bcd1147dfe2a7f96be6632413efef7aeb53d1d8b329adf767720e10487f7dd5a44cee658c2f7315ddc3e4924d2bfe56f42efe91d7b0995a7371e29624fc5f891f6dbec563598f3ad53a63eb004fb62115a504eece968f2c0eaf2c126371aa16c383ec0d3966bc2bb2a65d4511332738aa9f612a6b8d0d85376915a284e524a0b29ef7fde836aa17cf90166b09864f35b0280e55ebc128e21d5ca80fa1cc9651a9d788e5d742d2756e81f7acae55ff74cf44bb9b17fcaed569be42ba7f03f9aa982c8b0d97fba5398ffc5d6f6fdee0688997e8dc05dcc1b79419e05eafff16fb5727baa5448143a73e083db95dd4c25a767495e8d04b356ec10e025cf6cd835dcc9e976c564080e13c6dd6481a5f65339386873c284d32fbeb19b47b5fbcd3abf55bdea03ec5ecb6af8db8377af23a1373e9b64a3e4ac380f3491b7d776d3c4e3cf0fdabe515367cb796e4b99b57af8033d1b1ebc4a1ad190603748a89e53564dc9901d22b003a80873e34be661071f24e5e83998b047e9ffe8add946f21c66acd0a6ff6ab790782da562344f240213f6c68526fff22373950b7f2e356c66544c2b530262834eccf6ab4d2aaf451324236aa545fde8a8e44a092f8900bd5b9d6bdcfe2779380a1ad8c329baaa6e174d8544b4f1c60289bdb621defba2f941c037874bfc8ed8a95c4d51679219d6699cc4943e1b75313965dd1aedf1df3eea717fc516f35228c9564425464682f8a1602b9ce5c32b88b5e9b2c6acd41eacd8396147f5528b2b2eca69440ac7c16469258e87efed85147f769d0a29df8b666b193b457a8e5011bc0ab3e37221fc2f181fb62a8246494529795a8945704fc7bc00b4d551991de7c9b18ff7927886a696010c8ae61b50bd8f79202955e8d3dd3f6163f2cb40fb90e1a5c63e32d1ab06d88ba99bb9c47a734c37af4bcec584141d9409d1b2db5b97e5d1c73c4a2f3330cf77af9c7a3fecca750eb6e86c7462cae77f5d612a79dc68ab640eb0de819c3330e54762efa5e049105d906a1d5109fcb8237675c4937530a306b6b7878e9306ed9cc3b86ca9b8a066ca3117d162aee23c833a3d229b90a2588f4dfd94b8d73f363765ca7fc7731d1620f12950ed36c1924be2f44cbf42e6db4ee8789ca2d10cb261d2e0d5b5af5747a70c074af5c7b2d31e97093243369a4ef35720e5bfbcd78b138084a408920468a91b9308428dd464f5e9a0a148aa51533d4037edc616451bf6381d48141ef11787622b3e487454e15556ca75e908ae89fa71fcadcc97f67e769fff566e25a8c9f1d957f609477ecabb5bb8757816cdda18b11e97687afe0c20d125ef6f2676687631ff84f2ce86871c4040ba9cefef737e81993453d569e90b65459bc32a2452aa4cbc892573b999dcb6ed61595c70c23d02f29f6d760b10aee9fc9bc38699a4391236e6bcfbfa5b39c816bbce2c076c5d757f4281a7c1075feee0821f843986a3997d87947532dca21464f2f8ff7d37eee31be3fb5b4e0f188f97e513c1cca49170c6733e9c13cdeae81edc648e59b494f8739963cc304f98b2d625a7756fff2c0d4512c5fea7490bd89678f7305c5aacce62da8a3a2f359091cf64ccd1603a0603ec0b0c73ef7f7c3e2d6fd3404cbb80cc6cf2ffacdd796fdd46b7fafd882526049bdb38320310b9bb1a8da77fe1b37dd44c79f238609e80e6defebebe3f4635a1f68fe62f37ffc1f523bf0d57ef28f86dc4770a99648893a7275c0b5a7f6894a8d682073114cb4dfd308697540cc918e97e8d352b4b4542776fb2dbcca9a87188d1b8238194a019809cd8f75b6c6a6c755c6619edcb710bd64255a799a2152346e2f3a44b8e4164c1195a5f882f9d955378fe24c8a51823040309d24210dbc759016dedf81471868d542b5a4364d25b48f855074589b090a255c89404f524e5abcad6474608b489d5d571b54aceff4d2aa2fde90534deafd5575eeb14467c4bd51f4f104ccc7a1784dd8ea6b3acae237ea08fdd182650515c13e31f2b87f4c7881662bab180fc1179108aed944c7b7d47ea5a9810be16903e60221fabe88ace10dd8e07c69d5588218727a910117d876c8ebca52b4a2d37de3e37ddfe6f778a24ac0cec5f7abade5e1d1164bae379da9055a319feaf8a6a4c539fab3f1dfda370df88d5b3f507a0faede8c8a9a7c159901f3933228eb5713f700cfe6ec3e29b6bf94e34a074e7b24b91df45960d2197bd7a36c80e3599a6aa5cdd8483dadaea51dd9d72dd6182ce11665c6643044ddebaf86ee3f908c25b822917b1f3e89ee4912eb45101a1c379a65d24f59c71529a65ed4c7d094e67a26a58f4f6eed17199cab137721ce1d6f213c8505e694c356067b91aab5f5be40aaf69f04f73573e1feaf2de2bf0e610396f38777178df1bec3b217a2eea0119afe79eb8ff5d947989c359af583f5ac9ef27b757537c05945931eb68c936fb2de7588554f8094b188073789b2f94abc76b654d117729b9f043f717abb9cad8ea972515170fecdf097e756c8ed61c0e694685d9fa1f8cf29ad2efe9d1c0355276ee7ef9aba608f0dc624f1f05696a2150ab94fe7d63ed96bc505fe304e79828078fd9a79c39c5ffa1c96e3f8267ddd98297d630f331904cf2c368de12c8be22a4f93ec441290feb76d6af721cf078992243f75a20721d5d541340f748a21c73ac9abbfc05bd97b195987d5892970c4ab228bcc5b87d258b66c511c9d5ff183405dbf51d9b936e44138f61d4a613bfd0e2725edbc434b445b287173ffa24b4a077b28f37cd7c669cc5c7b71169c0379e8aef84595402ce5de1a32bc043b58d1e099f4785a26c9af9516a7880fbb496b113b1c5e72c07a5b86e96210355b455e5fc247f486c3cfe1d81785a5ad15d39c6ea63a7af03ac5b685d5068d0049f95339fa8a7a8f9a60717c1abaf7ef0985d8bdb9876a5a2bcb8857749f10cc431b498592ee9ccdb7bd36420e0fc6bcf6362520765aceb0c561c3fd9321e115881176744ceea76db324f8df062a3f0b4c6bec6c29fe6268cebd0d04506f5e8a53f7f2d0a61b303588f3600f8bf0d8f2be8160426f82b9b429bcbb9495212b320a0cda6f15c8599493b570075b8a3af3cb3619a0317415283de97bb22ce87cfb79f1b822b649b768cb71d532a43b6cc91fcc578191e10b32d69eeb8372ab5038f720e9e41f547794f42d340f7ac5562335f9663101c6897e30cb8d059b823932c5a107bbbc31bb6379f5ee3d85889ff2e469a661f6c5df7bae51c1a0abd99d488bb5e5376d1025faf6041d5f120aa182844f95e23c65ffefc76ac9b71f296174727948b72331dcb9eac07d006ebc28c3c59dc7b03be7cfb440535c3a818f8a824993c4cea2c7bc4faf93626bd4f9fade8758f80aecaa8e5956825ea60e04c75b1e91934b4419892cd95dbad329426fb511060cfd89f6030674625f25058a31277c3111d9400a0c7d4089a6c82b791951afd7a4f3dc88d78cbda884ac4de97b577fad5059441db837b92ca0e91d241a3c02f393dc523bfbce8aa1571666b3afe6eae6f7212d51a1671c41b8351b482489b9cbdc1c7feba00f675ce3a0609752b614b949c3f063a032a5151cc5fba8dcaa6ec2bf2ed1a9edfeaebe5106aef988324e3e71119aea42b732181e1e2c2cf0295bf5ae942fa2b56627dbe22791ce1edcdb56202fe6a4c016a966ffd06e97392ccded8a83d381a4ad24365756728ee1840913ed9a08306e9384323b73b0272c9065e6026b092db7e7155619477251fa34c7da82f285572a28c9c80e6960f5e3d0d0f75f4cd2be73b4e861b53f724a0eb2d06a8bafec16c3cab3aaa46d34cc47275d916188340ebac1ef147749fa1c9ea163165be1e283e68ab1a6878ad67cf4b7c36c098a47b68686e4c630f1587bae7e23f5d449f7927184b1eaa0e3174fa66e784b2966a3d715db13c7e65d66467a3e96842ae1e4d97043b4e7644f3a9b8b1dec3e697b38059bde1c20d739ae689446ac26f575788902b97083e105420bb297fea5b012f2a61d19562d9b90b98c65f75a45e9cdf8a747b9936bdb5cfce7f144c6419731f6601300e2366c8b6297d9feddd59946c58ee51ea31263dcef0281c5edaf85d45fd7ac1ce545d2d74d4d7fb8564b1d6f8b2f28adfb22b52b4213e47e845dcccf587546e183838f1d92c27a664a29ae727eaf685e75657223eb9b0dc440982ac787abcb041e0fd535fcbf5e80cb2250044ff05e5a5551704c33f4fb160a6b21488c70ed3d1d004c859f9dc8135956b75da3d0e36fe4afa95a43b820cf7430e35e4ffa98e5e7111fa66d486722af8a247960b0545654ca9001c68f982a063b88076abc563dec4993a238a5f30acb4c87ad98f03d450acd19e45db8a4a74a3ff347a174579d6ac79a57b8f1f29d7ef5c6dd74a40d296b0e62b6d8ee062fb3266269a998a6af16871c4be44fae15fe100587a5a6a2c825fefc58243f4248c19d046af0a38d93dcf42912c67744c0045ec110cea28eee2503540f044d76dbae04ef3d1230954089dd5a46f950e0bfd4a48da364289bf0588363edb4cbff4843c4ad7204235c8c94dcbbe4a2cd1f16e82e3222f7e64f4f365983956d195fb476dd8d692207e773b06e98e2ae2e29b2e09d5db6afb699a7051b79ad8b736ea90aa8938a0c1785cbc199ef1ba4527b0139ffd0cf7503b55c909b8e5472a47fc4b4011268882b72337adc048a2e6520fb40622d6a8b514707d473d46a1f2d6db666d4d6df541f77221b3bbe62500c36d89d2e79eada12f919880baab1a76f507ae8a85c7ab48a8f10f1415bc8fd431c9cb3ee18473329dc6b967ac646d77f6d9a44578b4d9d3174cef8fd38aac0c885ee6fb7028cf3f36d0e17cdf96b2e890f3365b471c3b6dbcbd50bc0941d8b6a34c12197c2e7e459fa38bc653a473efa95b6f17be6841387298e26b50", 0x1000}, {&(0x7f0000003740)="ecadd1ded1b6300e931ffaf08b9aaf724930cc67e0291fa940324951930c0d2ecc1a60f943d18985ab5d2966599eb0682acae10ad5ca62be6a82d2a94291c7ff5e9b8c2b92b123964760b2133cdcab6a226bb9954c7687b3", 0x58}, {&(0x7f00000037c0)="c75c17b13c1353af714155258d675c784fb28487f197b2b6661bab9db789e541820f96407e740b71d1e227aa0477f6bd1b495f22a80dbab19807cb9e57308d03a97b217fa1e8200050d11cd2b08e0d3eb81532248857d22d83be572f39957c8a52a1cfefcca7a38d6dbf5144dda868f8c02d19653656fd02e630eb3f14b90c7c5b225b26d11168e393c91e667b40526e36e776cfb8189f7e784017c708b0900bfc8a11e96dd0093c707038c2ab65f4f7d230d2315c7d79c6a12480c168e7d1ef3c81b80123bf4a76b878ec13489822837e928351e49b87fbafed14f492d9b3fbff0ac933be7428152ae50b0dec7d6f0a08e81dde87f4e3d8d602b2f3585f11ad7ed286097d5b91ee9db77bf5eba8f5e3ce00b3e946385bc08847d476a404a36362dedc676a8dc6bb8b4185a60751fa36f91de74e776804b5fa0a82e92260340f5b0c03a44958205aafa4fe1cdaacfa96bb8fc24cc69d346011765a9e8ad4c5bbff01b81877980bd94f5a670d43a913c3c89943c2c5a80e10dbdab5933b50c91cb3a7531928a4dfcfe984de8d6ea6518d37063cd11bd9bff3695b74660e6d4f6684f3764b0182e3dd5ffcb34a65ce69f7b861f889e046754eb525490bdaf75483ca5cdddfb9ba637437c9f3c0f838c94ecfd334a09217f5a5bdd4b45acf05e9de8cc06a3af531ada077dd6b599336657a4ea37eb8dd1ae33fd39226437f8560da5bf55076cb34c5c1a98d33c087775901391982f953ad27f8cec6d725351ef14676db0ee1b56198540459d05921012e0abc008e4591356ed09056a444118a24a3798ae5e7ad12f43047ac2d19318213484c38b86ec6b512b5a6252cb21d58e2c2f3d341ff5f1a4da5a2679ce706e64d156d8389a9b0294e71f4fbf71e9629eb96d35ed9c136d019e0f20284b90a310de56513cafc27e35577d7b52335bdfca9fb085985deb93bd910c5852e24f41cac077cb617fea2d3af679bb72cece0e259bc998751c53083d4e20e076927b442ef15b1e3c21335b7bc49a52209087a05b524702af905b2fbfb896fdb3b309b22741fc5038f235394af26e08fa5730924426204608deb88e75754af0b54d2a9747c320b2d26adf344fb67e62a4f9ba859669583f11ba5b89d23e070bbd91fbd57a170d8fa2cf37d3d5c4741184e6333d5fd2d1586344db9ba4b98b69c6391c280952d8c96686cdb90eacb32fa9f85784230921ad24135ca57a3af6d211a185b123bb0c2a6bc8837badbd5ed77dd40ecaa4aaff34aebf33776e5d9b379a2ff70915fe4b3bbad512a3b8614ea75eca71a3f4168f169b81455483e041cd5d2fde1b893658bcba54c7ced9cea861f24b8f9bad8ab0934cf8e97aeadffc102c57096f3a62155dc4a166d3f93afbcc49aa5777e5ea3bd05fdebb71587a6ce83b077afcb92ed2aadfb15de72ee64e4e3414a9dea88f8133c4e91a536710f2294da0a42731bfac3fde96d32fe350c79f9172fc9fdf8478ee80de06857b93331daeb47d471a73568b791aebdae43e0b52516a925a6362d30433421242bded424ac72e29a984f4cd1933e11679df91e2bdde0e316225bf023dd0c33a1a152945966ba27fcd1446aac9ccc95e2f150727544474f364c59b28bd18872e9d00fdf2ebed0fe421bb407af818f7d29a547762f57bdb3899534d86e98a25a631e6ccec0178e1d2a2e878da1a9d87fca68fde4294988ef55c47a8638cccb0466c9933f5123072b9f46cf452f92de7fb8e51fa1fab9215b99818979802f9e81e7871f86b2417ea5d78463c4b7870225ce0d8d5e5cf1b86e7358c69b46b08bb551b882b3ea130836674af205af2a3bf165559e0cc74f81baed9c2fb58214c21af106e04413e221cb72b913aa2b51fc439825a05e553ae2654c8a95175f62bd44a9b937b2bcf055b1cb99c6fc31c06687b6d451be64c9207c06dcfa54ad5e7ec7f8bef2a92a80af89579355661e4a8a00789d0838bfa80162806267c75bc742843306d2c12e4f6404a6d7bd32acb8c405af461750f87d2204d34048ca8de4ce4937743efd1393e880331fc2c16fd7057eea4eea9ec8609c06605bc1a160e2dfa2d76d176b064461e30290753d2df55403bf429e81b62f64f3d5e9f6c28f1a8615f59dbfd31b9cb891ecf9663d342e80c8bd6d9b09fc9ee899e418ed542e6f9c576d0c12aa342eee9a2606bd5166ebfc07a3eea209d30ecb01f03ff5fb397eb8d2a012545f0f8cbf17ae93bd8591cc2b305a85b69d09ae87984ad15dd0af283cb4591fcc6fe106b29230df77bfc45b779cb6981d1c96fe3bf29b5492d93880510bbe27e374533ed463f022d6be5196ccb0c52ecb6ba341af798750dae44f2b2bf35731d03a12aaf0d6d42798cf7eed75003276e787e644f889aadc05ed75e0dae9308d1b3cfd6a5fbc9d228c1a5dcbf536e731936adbf376ffa28e0fe59e7c0ba61f3de34305828898d8a5c56d3e2c78c19427e08daf4d93972f5b43000eb5683dd3ce21cd40872da60e8af0a6441f98afbb3c14ef2ad94f422721d2d5d5d788e4e7293b5c218abc13c76ba68efe06ef66bf6bf13bf3bc1e445ea08df61e32f063d1372df42cda396b48c085258d18fd71b8bfb34e1830e75999380c3eb4304e12b7790b68de87535e1dad951458b14d0bc1e67e28619a7425eaf77abe6f5010c854384c072f9e34a23d8e5941037372b7615c34aac3d4f9c1ff20d758d313b1bdb7a673df4ec40d21339afa05354c6ec318f88f2574f50f3d60693ff8323b321fb96a29a3783bf5c32371d836aedb6890bd814c80051ee7659998773979dc93eef5d9dbbdea8a7dce92f8f52d30297c83432875a2ec06e508fb3f6c213481b1abc866e80edd13523a6fed8defb9d3bb1884ea1f194a638b01e657547e8a1369cf24fa3a278213598262e9e341acdb567333d1c804bdbd911d6e880d0671dda8c6d4d7d6f87f559f21d5d3debbec7235b0a570b8e32390ce0f543e831440132df30e7892cfebd1c2d452ff75416d35f80b8052830707c72037770a02c484f509ba18d391b35750349a2ca849e1a96c58b4b6f7421f15faa025e2328a93bfbc4612c9b5bc433682eba754bda56925fe430c436d437c8dd65d57f2906ba92e7100c7e3e467712b2687401cd8290353a9d7e8b7d686bfa1b32e9117b54a11b700e726b8a1f5a0bfda81d7887056c8d0458d591dc0457eff9904041e6ddc45585b1cd3b51362874cddddba30940feb0faa81e422afedce52d59dfd1775db03d093bceba6a0271d83aa2028247372b24980495101b764151bf912fc1171cf81bdb88276b01615cd8745566ac234f54c33ea9f3deeb465864613edcf7d18d4ec7155b0087fc63df96a5137dd9945e4c734d8c3e8302367bda83a14e9f625d44b19f519df34bcafa592c4dbe8a31e9900ca735bc926090f856f7694933bba9f67139ad029ebe4eb6ef94f65e8e5675818abbd2dfed27d04d5741edc85df61fc5a997311fb864ed52204e1357a0588a5c35b7b7dc2ae620dc80ba04c72389796995464722c2103deb55ed6566b2071f64e8429b74883ec4bb974b89b81f75fc82adc820344ff91a094430dbb379f19721291c71f35cb4439d77d5c1a3e236f8c412641c93b4e4b53660a4799c06ef0ac89de3824796df3202c3c6a10b9c09baceb8edd6e3f2adc754ea098c8a5f4079effaa3a3bc59e26b802d46d4d52a92f552acde59567a3d7c3429a984d5cbc0b078ebf2c6e34f39ee0885cf6521e34eec36edb9da8e8e26a4bead002bd76d3d96681266f694db1fcc06c6224e14970b1250bde733a30a1fc028fda0f97696719758cda484a7599a4c70fffc75fba27687c992cd8b03c76654cefa737f32e8454a2698f927f924e0956ddea2519ac85074c29b8653695963f156519403a781a82784005ad1828236322f4b0fffb399eaa04b60aca3b80fe3f30823c605ff03e9cc9ee29208e46b1420e2d6aa165adc80ac3a084928f021933b665fd049d37164c73dfeafe298112d40bf51938d9b175b9016389c65edc1b6393df06bd42982917637c311c368cff705b75e8a49de712d14cf75bc70df0d901ad05dfb1277de6b91a64d54fc9b71791a61518379564d2980ed7227c1814d41abc64327c1e7691a7a00def24eea9a0478067e4e3fecfe8a35b2439a8e51a63c7c948b1b98ea47e66fd58f57eb029e5078248a2c7df15823c06e6e18a51c93cd79d326037a5f9000c30b071efc1e160de22f52abc21e95359a0bc5fa971b34ffdafe9a1c50dbcca1f07179d142f5c9fa5c485dcadd47533baea8bdbd5d6040c0fd21c4416e8e1a0f6c2af7438c90dfe0214a5a118e53f513af762623b1b14958764120f9f1b6a366dcd1f1c01543d6527fcc2054a76d5ceade5c7445d2a4a84f08a6acb70a3f9226c07868c410fe1c9661d0797a23e39f8f24140fe3560351e9f049f82a3dc3c0084e3ddbe7afcd83513d82a62faef4aec72fa40a69e8a17036bf7b05db1f704557e21ed0f46f68607f547f8cf4236df113d922fea5e63198515952000ac88f3d686a3065e756e84401cc99eb5ff0b38d3d391ca3d8ae55401a8491ce1f0249c2089cac6134fbe44681d60fa28b355dae7c37b0b4e19d7a44babc9f3f7e833f5c3badbc62bc8f623b00f69110d830f7e6eef2ae68bd845d059a1359f9473173b8fa846c4d4254b70a8d41ed2e4a3d00f491d8fee88247540724bf1bbdc94476a94f4a386f4e1cd691eec654f37284ba171839686845396ea7d7a8c150240c3915747eeeb745d854eaea7e43a69c7a941a326231251c8c20d21f9e95968f7937dd6c1e16b608d7c12782ccd6e40e851a446c325676f4e7d160ceb79d62fff3106975f52e53fcf1f9ceb0e6011e937626dbd56e1abb36e2311e99bd44eb611db5ff675bac44b21ea638ae08a7dc59d939bc4227efecd6c664885ee22a94fdc7df2f2ed3866190642fde5a7be61547655f6342e61ec422c64935f248193774729e68188d16a303cc377ebcc12add7f6b71b981edf156f11e35aea7a581bcb9c278de46b481f643c012ad7dce9d86673899977958f284e25ef884846077f09899cd11b7acd01de4905d51f95401c78fe7e9bc434b0023066951c67cdd5061445e516c1799a349ab3af3590420069c2d6b6f64b42d2c9c14b61925d80c4285051a84a3866d6974b1ad5c00f359f8a714e37e4b7cd2343a67ca1119add3fdc0e5c52881114e24168c48ce23d08ad7f20a5d400b47d2796436a1aa48c75792c828c3084dac4dc6eecc350ec7806a36cf1f44ad35238b5b9f9ac5609038e7f0d21a2da931fa8003d79c9459b5c5e1984a33f276965ec2ede05a41d4668dd581c134b7baa75551c713339b26c88a71c50d6ad273b2414b7bcc89456488d80ed125a60e98ea23b243e8add952376b4180d1ad7d5fb61763686aa4a9002d221f8cac88b0fa923415ba3780c6a58a5a84030335f63839497851b1bb6ed5180e8883804abf341569ffbdccb278a452cd0dfe38923c35306eb5f260cdf8409d6c6e194ddda11459f9106a6ef0cbb0a677c52a8cb2161f267c8545ebcc05b480c01f17c1eb9b8cbd95b53182573e6c0feff2c77045afdc40ba89a6794ffaf095dca1db0c0e4362c47a2689cf4c8b8c84c71b0e2f32bced4abfdd72d36afd071e661600b648471209433a3164675becf35d0fdc0f57346215745106f8bf6df5187d6344883d546bec9b7d26eae25400955c9ef415375b938005601d0df564a9c075df5d261b10d1db0ded803ddb3f7e02918feb2b0edfbaeb0203af2", 0x1000}, {&(0x7f00000047c0)="1b12985d67e997c9c7e999dc508ced4776aa91834d411e8143d7842e9ecfdca0c97c263bb878", 0x26}], 0x5, &(0x7f0000004880)=[{0xa8, 0x105, 0x3, "602fbcc68b6035b46aedae8174bf84ecaa80b1b0a8be4e0bc3620e0a5ce5c09e4808667389db2eb954ccdf9504506efc5c3268f27d6c35c933a7c2957add4c1e697a9c547d008a5d847fba904d8dd40640bce970be3da5dc351b44343f4c5d33e08676da816e1a6b29e7555b1649109a00349c76063a819422480b70e0a785ebd2599b6929edb8774993e88759ac74ad0c1c47fb5835"}, {0xe0, 0x1ff, 0x1f, "7fcef571ce83fa93fdddc5ee933043c3a2aacae7c7ab855f566698d2af34bcfa6fa92520548a811b57b05db3bbf08c82792b1c01a710012eb41778e1f4aa34b05402ad9699bcc8f699f4f661d781482971997611659f976af9c322c949af27bb590ba6f0c0194a68c784743f4783d2f829d892068256ac111ef4d4b60ef211dd7dde8b67d3180f96cb36d2316136373aac919f2fbb96eb8714f150e4e995141662668522146edeaa1cfb6729ab0900bc1d6cb88f63803c76aa9ccbe9159f4d0b062df210ba98bc791374c15b36"}, {0x1010, 0x11d, 0x3, "ce8fdf51e2a3547ce198010a8b1267438441d19cbd79a88558d8ecb2661a0c0600d0a11c78e32137e877e5163925841d9ca38d42de9192153e2fb1e99d9c57a590d40bfb9d63a1292403b62e6b39cc1992fa7cde476e03f1cb6d691a939babd8606720e8aa9b411358ae749fd6edcfcbe68785270735b489794344000b52f5c94d9ac4d6b8211e5087676cd7c372bd4849d1c7ff7c418f51d358be56debbc7fb8901761f2f6d9ee59086407b9e4c1d95abfb4561a45569bc6e012bcc85555ce71bf9d4a10e02ffb461e849178c017bf8ed15a7a9c3176e32a9f9c6b4dfdbf93ee0d16554d82c7ec0410a1738411428fbc5b5602ef81ffc33cca476fb762e2297a8cdc98d3acba7af328ff8ebce1513fb1398c28713771d32c9ff027ca7e09067cde2c650564dc635595e19a89cd6d849acdd05bc60ad226d951b576c8c14a7f23808cd75983aa7db26d930e58514a3922725f754070d4348af10d510c9d563bad209430fc6cfc7b066797986628ff3e112e7e0540084b99b48ae0463f7ace70abc349d5ef0d00233576fb5128305e6f2a712885706fbe4c0fa514e348348d213aee1a37733383cfffaf87813e15fd61eace6b5320fbcf01811ad88e78c9f7bd1ad23dc390cd806bdbe1b97c4894e4cf6db125bab23572b714dd8faaeb7236b74bc0fdff158ead2c83d50e987cd2944c1c35411add8ab24a798d3109a8fee2546f0996c6e2109fd7a11570c491486c5eece7aff2ac371065441d1beb382ba9c27ed647dab1d278d80984e2217ea858bac63340b715a5709e4a212ee7d28d94d83e678c71b5caeb9299b882c1205498dba67f9630318f7fd3a77df3f527b14f272210676d9f75b8a25e1b01b60233118e7fca4a600886f552088522bdfa06e96f4b1b403593821bca1122ec43d887cca84ae4a777bef82e64162095852afdbab77c7b20d26baa72409c3b07fba6d5062650d2bbfebe5372a086c64130cae8d383786cccf5fce51cf49c6854d5ed55b6b6159334ae46fc0618001031ca3167e1799919fe813cd41a7b2d8baafbd21746bb446830e5b32e83ca520fba7c7429524cdc23a74401b7790b52ed84fafe6ac84d04135fa10c48ac56b7b3c23919f716de0e7a31c0d2cc325673d8ae94ab4fdb2893d940d40c28b5a377a5f0301f3e3c46b7ec889e49dd8174beeba4a309151d4123947a6bf3b58e185cd1184a24027e1368731879dcfc0a72fc96fcb0d678e0f050be48e8a51158d5324e42cc240b398e6cac2f5fd4e4fa4ae7fa2fbc8b679b842d2b77064065a8e51bd6a9b51522f6e038d7bbf0fb6965d0c1a92eede66536dd29cbe071534fef0d31999c1498fd00a356f513a86bbace79181e6ea769ba26e4a1e6621cfe387ec18f7cae9450bbc662796f6913bb572f4b9efb616a0a8fc71beac19f6ee0eb202a20326ee3306f3881a96eafa42946ee7379e990f892719b4d0b3776c83fd0b8fa162b6c0db4e617e32f41e6f07e8ca4884871200ade0eb6748f2434e40645834733f3739a06e1f726e991c85662b9553978863e6d02b37a587c08f76628fc280af1eff54d91fb698c5aba5b6c8c938d2f2dcda5b98290515afb0865b4a0fd515e90188224dc703b6fd69888fabb1df9626a247fb1648cb60fb1ad6334f54583347c06d1f24a103fc9ebb9ad2cc13bf832adae97ca09ae0ead6fdf17fd807b3d0d5eb59e56af358c68ed91397fe70be23d18434f9e47aa7b806d91552c3f610cd70e3adc68be5319720fe22bf5af09f29fe47bb0871c1d64115720e7180bd9bb356c24809c67b54743871ba40b19533bbc65383e05c836959954556d6df7abf76549bb1a5bd165f503a9d83d73bd4cc545527b0159537bac2d7653f03dfc74a4a4987a4b5172bf785f8e8db571c820c0a0c2deff55a14dad4b8f1a878b84e673a74932f2b2966500467c134d091d92077ae886dae3b86a387dafba6b57a528ea44d2f006cfa0996e6fd52cd94880e353d5273ead3d74b7a8df49277c852370b171086a549eefa0c37dec4a4bad1286ba321020b9eb075761635e562590e24f545513b5e8cbcc87b167207848f4e99afe39944b7674cf9035ed173679de914fe1148b5b0f73a97138d82c8ce12a0129bbf4c12df757c049d7469d86f87c6b57ff1e668e20c5aa130dace90321d28161ba8cee9b1276f1ae92610f678cf74af8507d55f14cc6f2d8e9ec8e780dc918c6250f73b8628416085aa6ea1bf53bbc3c1e54c2010f521529ee259cdf67ab851bb033a009e445e149db63112dec965ce85ae0e331c23fc4e9cf56aa3ecea0d26369ed90da2b853421a21b8df2eb8cd9d68c1da644849fd9c04d57cf96aad9e459a132b5f2fad4ce571dfd941a10df9e142a87d8aac8a41f7bde8261017def4e88aa39f746d7674259f93f86e3a074a94a81bc22057e5bd670e3bc2db9c2a2246f6e8212c96f7b5c2de2ac7f963cf9e23ae98e42267042f50b000c85a02134fc8aa25b48fb1c73f06f70fa858fc1d66f946e280ba32031680003c3004ab3b9b8639a9cbd0e582a73a8b07d7c0100a25dbe7f09428cf1b1ac8e07800238e774032d2578b0a59f84717e59477dd3a43d2a159d234a501110d73f7a6a8916119435aecbf2c072982b7f793b354673f7738530512c5830964bfb288d528eb528f5f99894b01911478a765a7323ac079cc65cc9c8b3a8bb360cfb29255be3bb6698d9af2bee98b7ade81b75fdc3bbbfc4a75e890e49bcf1546d9436a6ac7b498bd8f05eb4fd66d7f079e1ccc76dace89d02c5c23ff37cf9f96dcc42a07552d3fcbe06a0c56a32fce926c60eee8366991177db1ea4417229891014ba8dc7d948decded361000bcef53f50a9dea4923f23554a5bdfbaab59d8a0c14b3ed6d34d13cd45d29c67e58c58e2798c963622935eb96090cb8ae52a5ca14b2251fe0e5c4f5ea3d5be81354b901b141e26b2eb67c1788b3f441a0d3c01948f5aa5685d45efda566e60a6e5131a7e15abe8617e171927cec34cd3280e148423e7d162448685678e53fcd3fc76aa797fa9d998cca0bbc73fe5a05fab155d83a535036f1aba9d0a58c71c94c6c1b3f5c0545c01f67e8e712c4e7f3edffa819b302099b9a93236b49b31ebcbe53913735b76f99c7ca57dfe8c14b3f982f3907c553b113619c6b996f663fbfc0cda87f3d9f7e5e2e683e50d69482be7bbec79cc2e71366be1a1172f5c18c415a446cfe477722a811d1ea186cd217cde8bb85837360d9204b5aa1e173dd5fe7f2e19cf4dc661df36440e545d61eeed5e883c71154987c85912bebd81ff5779edb67c2112632a4d18f7722bed82526da3a39d50bf6cc51eef0cee7b10403664f8aabe03409b87694dc1596356d39c50e160171731fe16e719652953b4ae076d18a30d91bcbfafeea9225491ab43754490fccb92c5415f21d9bc5b18fcfa113c2b69050da49b8bca7a4d54fe70acb29a5039c7d2c169b8fa05935898d2cc180eac46087c3893c4d4ee20e9a96f07a044b14eee9ed326e34c2188cf35dc971660b48b976b37e1fd6d4cf792921e6293ee3587c03b57a56b4ca41e9ded73a75b07157235cafb838e4d7126ddeb8c18edfd5fe5b98da928e1dcf135b6dc318bb970534b0bbff75302846dd33e7a4a7460d4364eceb0ac11f068356384da34c76d45918e57cede76386ffec2a3d53b32e99b900f4e0d225d0b06cbac855e09c1e353797198dca0694a69b12f2f43c66b20f01052835fc58cd95d3d9bd427a9287004356db8fa90be954d0aacc3e2b3447a925242ffafdddf10adfd0572b3348002f779dc8ce7a6e368120c417dd3a43b3f2c4a686a9a9dff40f327c03d2f55de0d587f645445e86c5219791dac7f679619eb37bb5b8ca02064271874a65038c204744127f8671d7d007c18c2439674c237750cc9e81a116de46d8706959debe67f27b5f63bb6fcab026c4323ad0e19c22799e60ff3d1fb1b1d47f7a35d9187be03b9e299f92de820217e5997b3b468463fb3f346dc87153265399e338dd571ae6f5de110d5c189a3f7d34fb84991437df354007e0823fc4faca351a0d9d33253f7ff3fd7df338494888d24ea4e0c2c2a3ec2de32c9cf12aefb4f1e5c4d47819b6a9f1e2922d025266c0fa24cef32899716cf8d72dfcd441886ee5fc86a44e20bbe6749ce631112072d28a46f31603586eea59a162c4c536b02571ffabc8e14da9f38d7096bab3524698eb581249303f22feeb8977b8644ff546b7fa270602e6f03318e444d174b4f0f0e4a6d065194ad0794710cb9bda97d9ed93874db3f9186ff63de12d78db69c375fbadb0505499e80d0617cc9fc1fb4a607009bbc80db32d1d4e0ef8b2c64bfef0b67e04dcc992702b507d137cd54cc6c430628cd904b7ea7f33e8ab21468129fb13130c6ac38049da5e4a24b2c67f4f09bf2eca6bc389e8508c7364803a78b9d1eca2e8b66eb205057e5f965895b66717ac2dbc68098e59b920ee9f1c123153268225dd797bbe270a0ededd9cee2168fa173262624faf7dca75de440bd447d8885b1029da577cba64e7798dc856f1e0ef8d529ce3b2119d9681633f2ccb59ed5b4864f3e82f934cbb08a5a6831370f82a6298aa8cebc73f7655b71920c44da4c5e17438524a5a80255738ef32af65cfc0c13bc203ad196a58070fdf460a1128fab1ab647807ad0b349cb49ac758cf7905e20f70a5be456f70034b6c2b26971ce1f24ac1b2316f41e088f3b7b2b4cc8e608800d31858f9d9c43dd0039544a5448850649bf415283f3b3bd27a5c3814d7f27b8c6cdb292b72c529c205848d8696133bf9ffbc07f60386b17bb07441fc4d294c228c01224efd933f0de274ea97de4ca12768f2fc6d7988fd8eb7006f3884fd09caf3248462a4051b1c3ae6272d9e9df5abcb769a2ed4bdd2565073d0df121da258ad5d0f96ecbe62656cb601af8ac33e22435fa6660dcb89ae002057bb0edf310d396c01e64d3eadaac2b8e58a31f25f319bc3166d24284d73a3fd625cbc9ab278287672f630f4c24d7a006322384a17c451c56c1c03c3f979d4948cca36aafa6d7455b5b1a088a5237f4e199f68545e0458b0e4d1344af97af3c07b1bedd4dc2950c49931a25ad4ddc52c77b5cd73075865fc53396320d5097bee2d2e92d81f9e28950c851e7d2c594b45c5fb9ac3a03becc175012878ecf651c78fc7f7061ce7b20d7f25034185aa3e76b040ecf3a7510f55a3a27a4e00427ac7b1a16c1eaf2df06dbae6dcad61a8affd919933a8001635b6a4de3d025f4fdef15576275dbcc0079f00827f513146e69aec8aa0feb08b0f1c0f04ac5b0e08bdf27c78b736f0ea9a4cee001f2eaa18ca2261bad191051e76b52a38e04c0d7b47b0da4e845924b193eb628427aa06818f88353ad507aaec527ff32d6b286e4005d1025401c5acb4b803e709b2853728a6affe6a257f0fee55a3e8f26cb93e5ba692cf11c9dafd0881348814479a0212abc81e1fd1cf49147b9b2f19570993c410749237868ebed96c1315cd817a30b45f75ff561944838416204217b9ab31b720a4153f018cd320e19b06e4712bb44911786eacb9e950de99f37cb1158c354d6cf3434eb174f48a69684f8d76b81e13d7cf7cf629bc834b221585fa22188febf4d812698bbf347cf15ee2279356c454c45c87eb995347bc7c0f85041920dce1bb288739a3ed214c9c315b0c97db68f07d989a4ac5685e59dd86ba57991cbd6129395ae6b7eb6c08330b27de3e0b5838516ede68ec79f4f0383e0a474209f06705505747487750584"}, {0x78, 0x101, 0x8, "7708d173fe7e0146e69e4c54c3337590e5b0d49668c494a578a36310a53f1049c1d0104190c98cba791ac4c950da6000e14caaa9437719aee91501e29470dc48396da81ae43009ed83f19818ae40558dc4025f113b207d9dbe1f2a06edeb1054a3"}, {0xd8, 0x104, 0x3, "b2f7aa6b8099c844c719602a1a323251f1bea5a0a69d4b900c1c8cd6a76cc91b2ae4bc189f204ee0fde395aabd03e9aa4674e61db21cad3ad3d2beb113e66600a90705d262c54147ef1a64b09b9fb248855aedb1b687b79642d5b3e30924fe3d54aa81dd3c82f39f65974865eb7986d8704fab55d5ebac29e9eb80191bee7e954d08d4b2739b6e4f5c6a939fc8f38c079987350e6f1f1eaf84609026f644856b34ae9d63bdd829037b4182a722cf26e89137f550d69bab93c9e4e75030e74907a724e859"}, {0x68, 0x199, 0x0, "8f9d2457099f18e1c0c787c695cdec6d798a02e530b1475e1f1aeb8a38aa5473675a500f207abc2ce4eabdeba8543d45c0d489068126059eac3d5318d527027ac661bcaaa7e3cc24c8c18bfae6a7f0c1c3f9f709"}], 0x1350}, 0x1}], 0x5, 0x4) write(r3, &(0x7f0000000440)="b116c0eb7ef007686e8b0c3d89261e32739e01017475e4b1eea123f3d9168fd66fa94f723d73773924f062bb8a3351ed10923c835ee5d7f51591266e523c6b3d22cffa74f7160f5efc39e5c9bb3e4c9c94cfded0f9f15f1e93bbe6b248620c57e4e7fb004514041b0edf09d85bc5c60053e8872c0de0e496ac5abf671bea8fdca585f575d41d3f87f9c9", 0xf13195b64af5ec33) read(r2, &(0x7f0000000200)=""/250, 0x50c7e3e3) [ 1309.936880][T31362] IPVS: ftp: loaded support on port[0] = 21 [ 1309.947701][T31364] binder_alloc: 31357: binder_alloc_buf, no vma 02:25:20 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0xa00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1309.998386][T31365] IPVS: ftp: loaded support on port[0] = 21 [ 1310.009643][T31373] IPVS: ftp: loaded support on port[0] = 21 02:25:20 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x6800000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1310.213890][T31478] binder_transaction: 1 callbacks suppressed [ 1310.213901][T31478] binder: 31448:31478 got transaction to context manager from process owning it [ 1310.229768][T31479] binder_alloc: 31448: binder_alloc_buf, no vma [ 1310.236620][T31479] binder_transaction: 16 callbacks suppressed [ 1310.236636][T31479] binder: 31451:31479 transaction failed 29189/-3, size 0-0 line 3148 [ 1310.251476][T31478] binder: 31448:31478 transaction failed 29201/-22, size 0-0 line 2986 02:25:21 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x6c00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:25:21 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1310.304380][T23756] binder_release_work: 16 callbacks suppressed [ 1310.304389][T23756] binder: undelivered TRANSACTION_ERROR: 29201 [ 1310.313170][T23756] binder: undelivered TRANSACTION_ERROR: 29189 [ 1310.457749][T31485] binder_alloc: 31483: binder_alloc_buf, no vma [ 1310.464492][T31484] binder: 31483:31484 got transaction to context manager from process owning it [ 1310.480255][T31485] binder: 31482:31485 transaction failed 29189/-3, size 0-0 line 3148 [ 1310.500089][T31484] binder: 31483:31484 transaction failed 29201/-22, size 0-0 line 2986 02:25:21 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x7400000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1310.580205][T23756] binder: undelivered TRANSACTION_ERROR: 29189 02:25:21 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x3f00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1310.627397][T11447] binder: undelivered TRANSACTION_ERROR: 29201 [ 1310.697206][T31489] binder: 31487:31489 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1310.731195][T31489] binder: 31487:31489 transaction failed 29189/-22, size 0-0 line 2995 [ 1310.785117][T31491] binder: 31490:31491 got transaction to context manager from process owning it [ 1310.830223][T31491] binder: 31490:31491 transaction failed 29201/-22, size 0-0 line 2986 [ 1310.854981][T23756] binder: undelivered TRANSACTION_ERROR: 29189 [ 1310.921658][T11447] binder: undelivered TRANSACTION_ERROR: 29201 02:25:21 executing program 1: unshare(0x40000000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0adc1f123c123f3188b070") r1 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$IPT_SO_GET_INFO(r1, 0x203000000000000, 0x40, &(0x7f0000000000)={'security\x00'}, &(0x7f0000000080)=0x54) getsockopt$IPT_SO_GET_INFO(r1, 0x0, 0x40, 0x0, &(0x7f00000000c0)) 02:25:21 executing program 0: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) getsockopt$bt_hci(r0, 0x0, 0x3, &(0x7f0000000040)=""/117, &(0x7f00000000c0)=0x75) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x41, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getpgid(0xffffffffffffffff) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000044ff8)={0xffffffffffffffff, 0xffffffffffffffff}) bind$unix(r1, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) connect$unix(r1, &(0x7f00000bc000)=@abs, 0x8) setsockopt$sock_timeval(r2, 0x1, 0x15, &(0x7f0000000000)={0x0, 0x2710}, 0x10) sendmmsg$unix(r2, &(0x7f00000bd000), 0x80, 0x0) connect$unix(r1, &(0x7f00003de000)=@file={0x1, './file0\x00'}, 0xa) connect$unix(r1, &(0x7f0000681000)=@abs, 0x8) r3 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r3) r4 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) write$binfmt_aout(r4, &(0x7f0000000580)=ANY=[@ANYBLOB="0000000000000000000008000000000000000000001c3adde6863809aa0000004e2311a4a1027777bf4059f358dc1ab73301ad9a85afe827389338a0ddbe9f63e90900000000000000d94fcadcb572c54f42bb8c0d7de02d9bf774a2d8fa246a1f22796dbb1ceeb7bd4300"/116], 0x74) perf_event_open(&(0x7f0000000800)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 02:25:21 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x7a00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:25:21 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x4800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1311.174458][T31501] IPVS: ftp: loaded support on port[0] = 21 [ 1311.182955][T31503] binder: 31502:31503 got transaction to context manager from process owning it [ 1311.212739][T31506] binder_alloc: 31502: binder_alloc_buf, no vma [ 1311.219070][T31506] binder: 31504:31506 transaction failed 29189/-3, size 0-0 line 3148 [ 1311.226904][T31503] binder: 31502:31503 transaction failed 29201/-22, size 0-0 line 2986 [ 1311.355645][T23756] binder: undelivered TRANSACTION_ERROR: 29201 [ 1311.366048][T11447] binder: undelivered TRANSACTION_ERROR: 29189 02:25:23 executing program 4: unshare(0x40000000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) r0 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$IPT_SO_GET_INFO(r0, 0x203000000000000, 0x40, &(0x7f0000000000)={'security\x00'}, &(0x7f0000000080)=0x54) getsockopt$IPT_SO_GET_INFO(r0, 0x0, 0x40, &(0x7f0000000140)={'raw\x00'}, &(0x7f00000000c0)=0x54) 02:25:23 executing program 5: r0 = open(&(0x7f0000000080)='./bus\x00', 0x14103e, 0x0) close(r0) syz_open_dev$loop(&(0x7f0000000540)='/dev/loop#\x00', 0x0, 0x105082) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0x526987c9) accept4$llc(r0, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000040)=0x10, 0x800) read(r1, &(0x7f0000000200)=""/250, 0x50c7e3e3) 02:25:23 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x4c00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:25:23 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0xfdfdffff00000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:25:23 executing program 0 (fault-call:5 fault-nth:0): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000044ff8)={0xffffffffffffffff, 0xffffffffffffffff}) bind$unix(r0, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) connect$unix(r0, &(0x7f00000bc000)=@abs, 0x8) sendmmsg$unix(r1, &(0x7f00000bd000), 0x80, 0x0) connect$unix(r0, &(0x7f00003de000)=@file={0x1, './file0\x00'}, 0xa) connect$unix(r0, &(0x7f0000681000)=@abs, 0x8) 02:25:23 executing program 1: unshare(0x40000000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0adc1f123c123f3188b070") r1 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$IPT_SO_GET_INFO(r1, 0x203000000000000, 0x40, &(0x7f0000000000)={'security\x00'}, &(0x7f0000000080)=0x54) getsockopt$IPT_SO_GET_INFO(r1, 0x0, 0x40, &(0x7f0000000140)={'raw\x00'}, 0x0) [ 1313.261751][T31524] binder: 31521:31524 got transaction to context manager from process owning it [ 1313.264524][T31527] IPVS: ftp: loaded support on port[0] = 21 [ 1313.278957][T31523] binder_alloc: 31521: binder_alloc_buf, no vma [ 1313.289136][T31523] binder: 31522:31523 transaction failed 29189/-3, size 0-0 line 3148 [ 1313.302800][T31524] binder: 31521:31524 transaction failed 29201/-22, size 0-0 line 2986 [ 1313.305312][T31528] IPVS: ftp: loaded support on port[0] = 21 02:25:24 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:25:24 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x6000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1313.390849][T11447] binder: undelivered TRANSACTION_ERROR: 29189 [ 1313.401648][T11447] binder: undelivered TRANSACTION_ERROR: 29201 [ 1313.520864][T31638] binder: 31612:31638 got transaction to context manager from process owning it 02:25:24 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x6800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:25:24 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:25:24 executing program 5: r0 = open(&(0x7f0000000500)='./bus\x00', 0x141042, 0x0) close(r0) getsockopt$IPT_SO_GET_INFO(r0, 0x0, 0x40, &(0x7f0000000000)={'filter\x00'}, &(0x7f0000000080)=0x54) syz_open_dev$loop(&(0x7f0000000540)='/dev/loop#\x00', 0x0, 0x105082) getresuid(&(0x7f0000000180), &(0x7f00000001c0), &(0x7f0000000300)=0x0) fsetxattr$security_capability(r0, &(0x7f0000000140)='security.capability\x00', &(0x7f0000000380)=@v3={0x3000000, [{0xa61, 0x1b3}, {0x5b10d9f9, 0x34}], r1}, 0x18, 0x0) getsockopt$inet_mreq(r0, 0x0, 0x20, &(0x7f00000000c0)={@loopback, @loopback}, &(0x7f0000000100)=0x8) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0x526987c9) read(r2, &(0x7f0000000200)=""/250, 0x50c7e3e3) [ 1313.775233][T31743] binder: 31741:31743 got transaction to context manager from process owning it 02:25:24 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x6c00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1314.012570][T31853] binder: 31851:31853 got transaction to context manager from process owning it 02:25:27 executing program 4 (fault-call:2 fault-nth:0): r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r0, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r0, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) 02:25:27 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:25:27 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x7400, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:25:27 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000044ff8)={0xffffffffffffffff, 0xffffffffffffffff}) bind$unix(r0, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) connect$unix(r0, &(0x7f00000bc000)=@abs, 0x8) sendmmsg$unix(r1, &(0x7f00000bd000), 0x80, 0x0) connect$unix(r0, &(0x7f00003de000)=@file={0x1, './file0\x00'}, 0xa) connect$unix(r0, &(0x7f0000681000)=@abs, 0x8) 02:25:27 executing program 5: r0 = open(&(0x7f0000000500)='./bus\x00', 0x141042, 0x0) close(r0) syz_open_dev$loop(&(0x7f0000000540)='/dev/loop#\x00', 0x0, 0x105082) ioctl$KVM_ENABLE_CAP_CPU(r0, 0x4068aea3, &(0x7f0000000000)={0x7b, 0x0, [0x80000001, 0xcf2, 0x1, 0x3]}) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) write(r2, &(0x7f00000001c0), 0x526987c9) getsockopt$bt_BT_SECURITY(r1, 0x112, 0x4, &(0x7f0000000080), 0x2) read(r1, &(0x7f0000000200)=""/250, 0x50c7e3e3) 02:25:27 executing program 1: unshare(0x40000000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0adc1f123c123f3188b070") r1 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$IPT_SO_GET_INFO(r1, 0x203000000000000, 0x40, &(0x7f0000000000)={'security\x00'}, &(0x7f0000000080)=0x54) getsockopt$IPT_SO_GET_INFO(r1, 0x0, 0x40, &(0x7f0000000140)={'raw\x00'}, 0x0) [ 1316.375446][T31866] IPVS: ftp: loaded support on port[0] = 21 [ 1316.387433][T31869] binder: 31862:31869 got transaction to context manager from process owning it [ 1316.400069][T31870] binder_alloc: 31862: binder_alloc_buf, no vma [ 1316.427862][T31869] binder_transaction: 3 callbacks suppressed [ 1316.427879][T31869] binder: 31862:31869 transaction failed 29201/-22, size 0-0 line 2986 [ 1316.438710][T31870] binder: 31863:31870 transaction failed 29189/-3, size 0-0 line 3148 02:25:27 executing program 4: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r0, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r0, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) 02:25:27 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x7a00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:25:27 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1316.520933][T21261] binder_release_work: 3 callbacks suppressed [ 1316.520942][T21261] binder: undelivered TRANSACTION_ERROR: 29201 [ 1316.549371][T23756] binder: undelivered TRANSACTION_ERROR: 29189 02:25:27 executing program 4: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) r1 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x210000, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r0, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r0, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) ioctl$KVM_SET_CPUID(r1, 0x4008ae8a, &(0x7f0000000280)={0x7, 0x0, [{0x80000000, 0x2, 0xfddd, 0x20, 0x7}, {0x1, 0x7, 0x8, 0x4, 0x20}, {0x40000001, 0x1f, 0xba78, 0x3, 0x80}, {0x0, 0x10001, 0x1f, 0xfffffffffffffff7, 0x5}, {0x8000000e, 0x7ff, 0x3, 0x7, 0x1}, {0x80000007, 0x3f, 0x8, 0x800, 0x1}, {0xc0000000, 0x80, 0x6, 0x100000001, 0x3}]}) [ 1316.627521][T31878] binder: 31877:31878 got transaction to context manager from process owning it [ 1316.644959][T31878] binder: 31877:31878 transaction failed 29201/-22, size 0-0 line 2986 [ 1316.677906][T31882] binder_alloc: 31877: binder_alloc_buf, no vma [ 1316.697354][T31882] binder: 31881:31882 transaction failed 29189/-3, size 0-0 line 3148 02:25:27 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x1000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1316.728528][T23756] binder: undelivered TRANSACTION_ERROR: 29201 02:25:27 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1316.787390][T23756] binder: undelivered TRANSACTION_ERROR: 29189 [ 1316.858658][T31984] binder: 31927:31984 got transaction to context manager from process owning it 02:25:27 executing program 4: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r0, &(0x7f0000000040)=[{&(0x7f0000000180)=""/242, 0xfffffebf}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r0, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) [ 1316.899187][T31990] binder_alloc: 31927: binder_alloc_buf, no vma [ 1316.910395][T31984] binder: 31927:31984 transaction failed 29201/-22, size 0-0 line 2986 [ 1316.923624][T31990] binder: 31989:31990 transaction failed 29189/-3, size 0-0 line 3148 02:25:27 executing program 5: r0 = open(&(0x7f0000000500)='./bus\x00', 0x141042, 0x0) close(r0) syz_open_dev$loop(&(0x7f0000000540)='/dev/loop#\x00', 0x0, 0x105082) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0x526987c9) read(r0, &(0x7f0000000000)=""/250, 0xfa) removexattr(&(0x7f0000000100)='./bus\x00', &(0x7f0000000140)=ANY=[@ANYBLOB='tr\x00\b\x00\x00/loop#\x00']) 02:25:27 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1317.010012][T23756] binder: undelivered TRANSACTION_ERROR: 29201 [ 1317.082416][T11612] binder: undelivered TRANSACTION_ERROR: 29189 [ 1317.124452][T32099] binder: 32063:32099 got transaction to context manager from process owning it [ 1317.163713][T32099] binder: 32063:32099 transaction failed 29201/-22, size 0-0 line 2986 02:25:28 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000044ff8)={0xffffffffffffffff, 0xffffffffffffffff}) bind$unix(r0, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) connect$unix(r0, &(0x7f00000bc000)=@abs, 0x8) sendmmsg$unix(r1, &(0x7f00000bd000), 0x80, 0x0) connect$unix(r0, &(0x7f00003de000)=@file={0x1, './file0\x00'}, 0xa) connect$unix(r0, &(0x7f0000681000)=@abs={0x3f00}, 0x8) 02:25:28 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1317.226944][T21261] binder: undelivered TRANSACTION_ERROR: 29201 [ 1317.278215][T32107] binder: 32103:32107 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1317.306063][T32107] binder: 32103:32107 transaction failed 29189/-22, size 0-0 line 2995 [ 1317.344037][T21261] binder: undelivered TRANSACTION_ERROR: 29189 02:25:28 executing program 1: unshare(0x40000000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0adc1f123c123f3188b070") r1 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$IPT_SO_GET_INFO(r1, 0x203000000000000, 0x40, &(0x7f0000000000)={'security\x00'}, &(0x7f0000000080)=0x54) getsockopt$IPT_SO_GET_INFO(r1, 0x0, 0x40, &(0x7f0000000140)={'raw\x00'}, 0x0) 02:25:28 executing program 4: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000280)='/dev/userio\x00', 0x8082, 0x0) r1 = syz_open_dev$mouse(&(0x7f0000000040)='/dev/input/mouse#\x00', 0x4, 0x800) ioctl$KVM_SET_NR_MMU_PAGES(r1, 0xae44, 0x3) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r0, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r0, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) 02:25:28 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x3000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:25:28 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1317.466968][T32115] binder: 32112:32115 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1317.481358][T32116] binder: 32113:32116 got transaction to context manager from process owning it [ 1317.491689][T32115] binder_alloc: 32113: binder_alloc_buf, no vma [ 1317.509281][T32115] binder: 32112:32115 transaction failed 29189/-3, size 0-0 line 3148 [ 1317.530571][T32116] binder: 32113:32116 transaction failed 29201/-22, size 0-0 line 2986 [ 1317.539314][T32161] IPVS: ftp: loaded support on port[0] = 21 02:25:28 executing program 4: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r0, &(0x7f00000000c0), 0x1) ioctl$int_in(r0, 0x20000005451, &(0x7f00000000c0)=0xb890) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(0xffffffffffffff9c, &(0x7f00000002c0)={0x10, 0x30, 0xfa00, {&(0x7f0000000280), 0x4, {0xa, 0x4e24, 0x2, @dev={0xfe, 0x80, [], 0x14}, 0x6}}}, 0x38) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(0xffffffffffffff9c, &(0x7f0000000340)={0x10, 0x30, 0xfa00, {&(0x7f0000000300)={0xffffffffffffffff}, 0x0, {0xa, 0x6f, 0x8, @rand_addr="bf4306daf5a0ab7480724e19db231784", 0xfffffffffffffffc}}}, 0x38) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r0, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f0000000080), r1}}, 0x18) ioctl$FS_IOC_GETFLAGS(r0, 0x80086601, &(0x7f0000000040)) 02:25:28 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x48, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:25:28 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x4000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1317.625630][T21261] binder: undelivered TRANSACTION_ERROR: 29189 [ 1317.663558][T21261] binder: undelivered TRANSACTION_ERROR: 29201 [ 1317.706223][T32227] binder: 32223:32227 IncRefs 0 refcount change on invalid ref 0 ret -22 02:25:28 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x4c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1317.803352][T32314] binder: 32263:32314 got transaction to context manager from process owning it 02:25:28 executing program 5: r0 = open(&(0x7f0000000500)='./bus\x00', 0x141042, 0x0) close(r0) syz_open_dev$loop(&(0x7f0000000540)='/dev/loop#\x00', 0x0, 0x105082) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) accept$alg(r0, 0x0, 0x0) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0x526987c9) 02:25:28 executing program 4: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r0, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r0, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cachefiles\x00', 0x400800, 0x0) ioctl$VT_SETMODE(r1, 0x5602, &(0x7f0000000280)={0x80000000, 0x0, 0x8001, 0x401, 0x7}) syz_init_net_socket$ax25(0x3, 0x0, 0x6) ioctl$SIOCAX25GETINFOOLD(r0, 0x89e9, &(0x7f0000000040)) [ 1317.882827][T32332] binder_alloc: 32263: binder_alloc_buf, no vma 02:25:28 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000044ff8)={0xffffffffffffffff, 0xffffffffffffffff}) bind$unix(r0, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) connect$unix(r0, &(0x7f00000bc000)=@abs, 0x8) sendmmsg$unix(r1, &(0x7f00000bd000), 0x80, 0x0) connect$unix(r0, &(0x7f00003de000)=@file={0x1, './file0\x00'}, 0xa) connect$unix(r0, &(0x7f0000681000)=@abs={0x4000}, 0x8) 02:25:28 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x5000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1318.190498][T32444] binder: 32442:32444 got transaction to context manager from process owning it 02:25:29 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:25:29 executing program 4: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r0, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) ioctl$KDMKTONE(r0, 0x4b30, 0x7) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(0xffffffffffffffff, &(0x7f0000000280)={0x10, 0x30, 0xfa00, {&(0x7f0000000080)={0xffffffffffffffff}, 0x1, {0xa, 0x4e20, 0x3d8dfd7b, @ipv4={[], [], @rand_addr=0x7ff}, 0xfffffffffffffff7}}}, 0x38) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r0, &(0x7f0000000140)={0x7ffffffff000, 0x4, 0xfa00, {&(0x7f0000000040), r1}}, 0xfffffffffffffebf) 02:25:29 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x6000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:25:29 executing program 1 (fault-call:6 fault-nth:0): unshare(0x40000000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0adc1f123c123f3188b070") r1 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$IPT_SO_GET_INFO(r1, 0x203000000000000, 0x40, &(0x7f0000000000)={'security\x00'}, &(0x7f0000000080)=0x54) getsockopt$IPT_SO_GET_INFO(r1, 0x0, 0x40, &(0x7f0000000140)={'raw\x00'}, &(0x7f00000000c0)=0x54) [ 1318.374840][T32453] binder: 32451:32453 IncRefs 0 refcount change on invalid ref 0 ret -22 02:25:29 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x68, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1318.474099][T32456] binder: 32450:32456 got transaction to context manager from process owning it [ 1318.518026][T32483] IPVS: ftp: loaded support on port[0] = 21 02:25:29 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x7000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:25:29 executing program 4: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x2, 0x123) connect$l2tp(r1, &(0x7f0000000080)=@pppol2tpin6={0x18, 0x1, {0x0, r0, 0x3, 0x4, 0x1, 0x0, {0xa, 0x4e21, 0xff, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x14}}, 0x1}}}, 0x32) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r0, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r0, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) [ 1318.569433][T32556] binder: 32494:32556 IncRefs 0 refcount change on invalid ref 0 ret -22 02:25:29 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x6c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1318.706594][T32565] binder: 32564:32565 got transaction to context manager from process owning it [ 1318.769468][T32570] binder_alloc: 32564: binder_alloc_buf, no vma 02:25:29 executing program 5: r0 = open(&(0x7f0000000440)='./bus\x00', 0x200000000141042, 0x41) close(r0) r1 = syz_open_dev$loop(&(0x7f0000000540)='/dev/loop#\x00', 0x0, 0x105082) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0x526987c9) fcntl$setlease(r1, 0x400, 0x2) write$RDMA_USER_CM_CMD_JOIN_MCAST(r2, &(0x7f0000000100)={0x16, 0x98, 0xfa00, {&(0x7f00000000c0)={0xffffffffffffffff}, 0x2, 0xffffffffffffffff, 0x1c, 0x0, @ib={0x1b, 0x7, 0x200, {"29a7391f20242bba8e1b03234f204970"}, 0x2, 0xffffffffffffff81, 0x7}}}, 0xa0) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r2, &(0x7f00000001c0)={0x11, 0x10, 0xfa00, {&(0x7f0000000080), r4}}, 0x11) sendto$inet(r3, &(0x7f0000000000)="c1b0669974cbe14f6b32e6a1accb2c49d34bb3c2e9328807a5bed0cc30b22c772546ae438082245d8247e95561cc7bc8be3a68c4c642a947b964ee2adea9144f3ad0d889fd70ee1f9de01500875092e517a28d4636950bbaffd08bb0e639830942494181fa120ac92788580cd8788ed58ea0397e", 0x74, 0x40800, 0x0, 0x0) ioctl$FICLONE(r2, 0x40049409, r2) ioctl$LOOP_GET_STATUS(r3, 0x4c03, &(0x7f0000000380)) syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0x0, 0x802) read(r2, &(0x7f0000000200)=""/250, 0x50c7e3e3) 02:25:29 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0xa000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1318.973471][T32677] binder: 32676:32677 got transaction to context manager from process owning it 02:25:29 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000044ff8)={0xffffffffffffffff, 0xffffffffffffffff}) bind$unix(r0, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) connect$unix(r0, &(0x7f00000bc000)=@abs, 0x8) sendmmsg$unix(r1, &(0x7f00000bd000), 0x80, 0x0) connect$unix(r0, &(0x7f00003de000)=@file={0x1, './file0\x00'}, 0xa) connect$unix(r0, &(0x7f0000681000)=@abs={0x1000000}, 0x8) 02:25:29 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x74, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:25:29 executing program 4: r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/autofs\x00', 0x800, 0x0) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000300)={0x0, @rand_addr, @multicast1}, &(0x7f0000000340)=0xc) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000380)={r1, 0x8001, 0x7, 0x0, 0xfff, 0x800, 0x6}) r2 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r2, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r2, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) getsockopt$inet_sctp_SCTP_INITMSG(r0, 0x84, 0x2, &(0x7f0000000080), &(0x7f00000000c0)=0x8) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r0, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f0000000280)}}, 0x18) ioctl$SG_SET_RESERVED_SIZE(r0, 0x2275, &(0x7f0000000440)=0x6) getsockopt$inet_mreqn(r0, 0x0, 0x0, &(0x7f00000002c0)={@initdev, @dev}, &(0x7f00000003c0)=0xc) fcntl$F_GET_FILE_RW_HINT(r0, 0x40d, &(0x7f0000000400)) 02:25:29 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x20000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1319.142369][T32685] binder: 32683:32685 IncRefs 0 refcount change on invalid ref 0 ret -22 02:25:30 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x7a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1319.345462][ T329] binder: 327:329 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1319.428187][T32483] FAULT_INJECTION: forcing a failure. [ 1319.428187][T32483] name failslab, interval 1, probability 0, space 0, times 0 [ 1319.468783][T32483] CPU: 0 PID: 32483 Comm: syz-executor.1 Not tainted 5.1.0-rc3+ #57 [ 1319.477205][T32483] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1319.487275][T32483] Call Trace: [ 1319.490609][T32483] dump_stack+0x172/0x1f0 [ 1319.495076][T32483] should_fail.cold+0xa/0x15 [ 1319.499674][T32483] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 1319.505600][T32483] ? ___might_sleep+0x163/0x280 [ 1319.511062][T32483] __should_failslab+0x121/0x190 [ 1319.516010][T32483] should_failslab+0x9/0x14 [ 1319.520527][T32483] __kmalloc+0x2dc/0x740 [ 1319.524777][T32483] ? kasan_check_write+0x14/0x20 [ 1319.529731][T32483] ? __mutex_unlock_slowpath+0xf8/0x6b0 [ 1319.535287][T32483] ? ipt_alloc_initial_table+0x6b/0x660 [ 1319.540841][T32483] ipt_alloc_initial_table+0x6b/0x660 [ 1319.547011][T32483] iptable_raw_table_init+0x8e/0xe0 [ 1319.552223][T32483] xt_find_table_lock+0x299/0x430 [ 1319.557371][T32483] xt_request_find_table_lock+0x2c/0xe0 [ 1319.562940][T32483] get_info+0x152/0x570 [ 1319.567140][T32483] ? translate_compat_table+0x1820/0x1820 [ 1319.573063][T32483] ? perf_trace_lock+0xeb/0x510 [ 1319.577927][T32483] ? __lockdep_free_key_range+0x120/0x120 [ 1319.584445][T32483] ? lock_acquire+0x16f/0x3f0 [ 1319.589126][T32483] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1319.595644][T32483] ? cap_capable+0x205/0x270 [ 1319.600269][T32483] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1319.606512][T32483] ? safesetid_security_capable+0x31/0xb0 [ 1319.612236][T32483] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1319.618661][T32483] ? security_capable+0x9b/0xd0 [ 1319.623616][T32483] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1319.629881][T32483] ? ns_capable_common+0x93/0x100 [ 1319.634957][T32483] do_ipt_get_ctl+0x177/0x930 [ 1319.639940][T32483] ? __lockdep_free_key_range+0x120/0x120 [ 1319.645691][T32483] ? kmem_cache_free.cold+0xd/0x23 [ 1319.650809][T32483] ? get_info+0x570/0x570 [ 1319.655148][T32483] ? find_held_lock+0x35/0x130 [ 1319.659954][T32483] ? wait_for_completion+0x440/0x440 [ 1319.665285][T32483] ? mutex_unlock+0xd/0x10 [ 1319.669710][T32483] ? nf_sockopt_find.constprop.0+0x226/0x290 [ 1319.675797][T32483] nf_getsockopt+0x80/0xe0 [ 1319.680247][T32483] ip_getsockopt+0x176/0x1d0 [ 1319.684870][T32483] ? do_ip_getsockopt+0x1910/0x1910 [ 1319.690523][T32483] ? kasan_check_write+0x14/0x20 [ 1319.695472][T32483] ? __mutex_unlock_slowpath+0xf8/0x6b0 [ 1319.701260][T32483] udp_getsockopt+0x68/0xa0 [ 1319.705783][T32483] sock_common_getsockopt+0x9a/0xe0 [ 1319.710991][T32483] __sys_getsockopt+0x168/0x250 [ 1319.715879][T32483] ? kernel_setsockopt+0x1e0/0x1e0 [ 1319.721959][T32483] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 1319.727449][T32483] ? do_syscall_64+0x26/0x610 [ 1319.732588][T32483] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1319.738715][T32483] ? do_syscall_64+0x26/0x610 [ 1319.743501][T32483] __x64_sys_getsockopt+0xbe/0x150 [ 1319.748801][T32483] do_syscall_64+0x103/0x610 [ 1319.753402][T32483] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1319.759292][T32483] RIP: 0033:0x4582b9 [ 1319.763361][T32483] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 1319.782987][T32483] RSP: 002b:00007f1e83b83c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000037 [ 1319.791403][T32483] RAX: ffffffffffffffda RBX: 00007f1e83b83c90 RCX: 00000000004582b9 [ 1319.799476][T32483] RDX: 0000000000000040 RSI: 0000000000000000 RDI: 0000000000000004 [ 1319.807449][T32483] RBP: 000000000073bf00 R08: 00000000200000c0 R09: 0000000000000000 [ 1319.815430][T32483] R10: 0000000020000140 R11: 0000000000000246 R12: 00007f1e83b846d4 [ 1319.823420][T32483] R13: 00000000004bed76 R14: 00000000004cff78 R15: 0000000000000005 02:25:30 executing program 1 (fault-call:6 fault-nth:1): unshare(0x40000000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0adc1f123c123f3188b070") r1 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$IPT_SO_GET_INFO(r1, 0x203000000000000, 0x40, &(0x7f0000000000)={'security\x00'}, &(0x7f0000000080)=0x54) getsockopt$IPT_SO_GET_INFO(r1, 0x0, 0x40, &(0x7f0000000140)={'raw\x00'}, &(0x7f00000000c0)=0x54) 02:25:30 executing program 4: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000000)={0x1, 0x1}, 0x2) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r0, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) 02:25:30 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x3f000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:25:30 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x300, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:25:30 executing program 5: r0 = open(&(0x7f0000000500)='./bus\x00', 0x141042, 0x0) close(r0) syz_open_dev$loop(&(0x7f0000000540)='/dev/loop#\x00', 0x0, 0x105082) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$VHOST_SET_VRING_NUM(r1, 0x4008af10, &(0x7f0000000000)={0x1, 0x40}) write(r2, &(0x7f00000001c0), 0x526987c9) read(r1, &(0x7f0000000200)=""/250, 0x50c7e3e3) [ 1320.027111][ T344] binder: 336:344 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1320.058555][ T348] IPVS: ftp: loaded support on port[0] = 21 [ 1320.062682][ T344] binder_alloc: 340: binder_alloc_buf, no vma 02:25:30 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000044ff8)={0xffffffffffffffff, 0xffffffffffffffff}) bind$unix(r0, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) connect$unix(r0, &(0x7f00000bc000)=@abs, 0x8) sendmmsg$unix(r1, &(0x7f00000bd000), 0x80, 0x0) connect$unix(r0, &(0x7f00003de000)=@file={0x1, './file0\x00'}, 0xa) connect$unix(r0, &(0x7f0000681000)=@abs={0x3f000000}, 0x8) 02:25:30 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x48000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:25:30 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x500, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:25:31 executing program 4: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) r1 = syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x3, 0x440000) getsockopt$inet_sctp_SCTP_FRAGMENT_INTERLEAVE(r1, 0x84, 0x12, &(0x7f0000000040), &(0x7f0000000280)=0x4) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000080)={0x1, 0xfffffffffffffffd}, 0x1) readv(r0, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r0, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) 02:25:31 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x4c000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1320.295765][ T460] binder_alloc: 455: binder_alloc_buf, no vma 02:25:31 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x600, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:25:31 executing program 4: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000340)={0x1, 0x1}, 0xfffffffffffffe8e) readv(r0, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) mount$9p_virtio(&(0x7f0000000040)='/dev/userio\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000280)='9p\x00', 0x400, &(0x7f00000002c0)={'trans=virtio,', {[{@cache_loose='cache=loose'}, {@cache_fscache='cache=fscache'}], [{@appraise_type='appraise_type=imasig'}, {@permit_directio='permit_directio'}, {@measure='measure'}, {@obj_type={'obj_type'}}]}}) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r0, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) [ 1320.855223][ T348] FAULT_INJECTION: forcing a failure. [ 1320.855223][ T348] name failslab, interval 1, probability 0, space 0, times 0 [ 1320.869858][ T348] CPU: 1 PID: 348 Comm: syz-executor.1 Not tainted 5.1.0-rc3+ #57 [ 1320.877783][ T348] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1320.887838][ T348] Call Trace: [ 1320.891144][ T348] dump_stack+0x172/0x1f0 [ 1320.895492][ T348] should_fail.cold+0xa/0x15 [ 1320.900129][ T348] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 1320.905952][ T348] ? ___might_sleep+0x163/0x280 [ 1320.910800][ T348] __should_failslab+0x121/0x190 [ 1320.915754][ T348] should_failslab+0x9/0x14 [ 1320.920257][ T348] kmem_cache_alloc_node_trace+0x270/0x720 [ 1320.926053][ T348] ? find_held_lock+0x35/0x130 [ 1320.930814][ T348] ? fs_reclaim_acquire.part.0+0x30/0x30 [ 1320.936433][ T348] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1320.942670][ T348] __kmalloc_node+0x3d/0x70 [ 1320.947187][ T348] kvmalloc_node+0x68/0x100 [ 1320.951690][ T348] xt_alloc_table_info+0x41/0xa0 [ 1320.956640][ T348] ipt_register_table+0xc2/0x310 [ 1320.961598][ T348] ? translate_table+0x17d0/0x17d0 [ 1320.966728][ T348] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1320.972978][ T348] ? ipt_alloc_initial_table+0x55e/0x660 [ 1320.978611][ T348] iptable_raw_table_init+0xb3/0xe0 [ 1320.983805][ T348] xt_find_table_lock+0x299/0x430 [ 1320.988826][ T348] xt_request_find_table_lock+0x2c/0xe0 [ 1320.994723][ T348] get_info+0x152/0x570 [ 1320.998898][ T348] ? translate_compat_table+0x1820/0x1820 [ 1321.004647][ T348] ? perf_trace_lock+0xeb/0x510 [ 1321.009509][ T348] ? __lockdep_free_key_range+0x120/0x120 [ 1321.015217][ T348] ? lock_acquire+0x16f/0x3f0 [ 1321.019884][ T348] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1321.026113][ T348] ? cap_capable+0x205/0x270 [ 1321.030699][ T348] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1321.036957][ T348] ? safesetid_security_capable+0x31/0xb0 [ 1321.042672][ T348] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1321.052213][ T348] ? security_capable+0x9b/0xd0 [ 1321.057235][ T348] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1321.063486][ T348] ? ns_capable_common+0x93/0x100 [ 1321.068532][ T348] do_ipt_get_ctl+0x177/0x930 [ 1321.073212][ T348] ? __lockdep_free_key_range+0x120/0x120 [ 1321.078924][ T348] ? kmem_cache_free.cold+0xd/0x23 [ 1321.084057][ T348] ? get_info+0x570/0x570 [ 1321.088412][ T348] ? find_held_lock+0x35/0x130 [ 1321.093196][ T348] ? wait_for_completion+0x440/0x440 [ 1321.098513][ T348] ? mutex_unlock+0xd/0x10 [ 1321.102957][ T348] ? nf_sockopt_find.constprop.0+0x226/0x290 [ 1321.108976][ T348] nf_getsockopt+0x80/0xe0 [ 1321.113439][ T348] ip_getsockopt+0x176/0x1d0 [ 1321.118041][ T348] ? do_ip_getsockopt+0x1910/0x1910 [ 1321.123235][ T348] ? retint_kernel+0x2d/0x2d [ 1321.127813][ T348] udp_getsockopt+0x68/0xa0 [ 1321.132303][ T348] sock_common_getsockopt+0x9a/0xe0 [ 1321.137758][ T348] __sys_getsockopt+0x168/0x250 [ 1321.142596][ T348] ? kernel_setsockopt+0x1e0/0x1e0 [ 1321.147699][ T348] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 1321.153141][ T348] ? do_syscall_64+0x26/0x610 [ 1321.157806][ T348] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1321.163938][ T348] ? do_syscall_64+0x26/0x610 [ 1321.168604][ T348] __x64_sys_getsockopt+0xbe/0x150 [ 1321.173911][ T348] do_syscall_64+0x103/0x610 [ 1321.179548][ T348] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1321.185440][ T348] RIP: 0033:0x4582b9 [ 1321.189327][ T348] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 1321.211506][ T348] RSP: 002b:00007f1e83b83c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000037 [ 1321.219924][ T348] RAX: ffffffffffffffda RBX: 00007f1e83b83c90 RCX: 00000000004582b9 [ 1321.227883][ T348] RDX: 0000000000000040 RSI: 0000000000000000 RDI: 0000000000000004 [ 1321.236001][ T348] RBP: 000000000073bf00 R08: 00000000200000c0 R09: 0000000000000000 [ 1321.243968][ T348] R10: 0000000020000140 R11: 0000000000000246 R12: 00007f1e83b846d4 [ 1321.251949][ T348] R13: 00000000004bed76 R14: 00000000004cff78 R15: 0000000000000005 02:25:32 executing program 1: unshare(0x40000000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0adc1f123c123f3188b070") r1 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$IPT_SO_GET_INFO(r1, 0x203000000000000, 0x40, &(0x7f0000000000)={'security\x00'}, &(0x7f0000000080)=0x54) getsockopt$IPT_SO_GET_INFO(r1, 0x0, 0x40, &(0x7f0000000140)={'raw\x00'}, &(0x7f00000000c0)=0x54) 02:25:32 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:25:32 executing program 5: r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x80000, 0x0) ioctl$DRM_IOCTL_RES_CTX(0xffffffffffffffff, 0xc0106426, &(0x7f0000000080)={0x2, &(0x7f0000000040)=[{}, {0x0}]}) ioctl$DRM_IOCTL_SET_SAREA_CTX(r0, 0x4010641c, &(0x7f0000000100)={r1, &(0x7f00000000c0)=""/13}) r2 = open(&(0x7f0000000500)='./bus\x00', 0x141042, 0x0) close(r2) syz_open_dev$loop(&(0x7f0000000540)='/dev/loop#\x00', 0x0, 0x105082) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r2, 0x0) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0x526987c9) read(r3, &(0x7f0000000200)=""/250, 0x50c7e3e3) 02:25:32 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x700, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:25:32 executing program 4: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000000)={0x1, 0x1}, 0x2) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/vcs\x00', 0x10000, 0x0) setsockopt$SO_VM_SOCKETS_BUFFER_MIN_SIZE(r1, 0x28, 0x1, &(0x7f0000000600)=0x80000001, 0x8) r2 = fcntl$dupfd(r0, 0x0, r0) ioctl$ASHMEM_SET_PROT_MASK(r2, 0x40087705, &(0x7f0000000040)={0x3, 0x7ff}) ioctl$KVM_S390_UCAS_UNMAP(r2, 0x4018ae51, &(0x7f0000000100)={0x6, 0xce8, 0x3}) ioctl$SNDRV_CTL_IOCTL_ELEM_LIST(r2, 0xc0505510, &(0x7f0000000680)={0x476, 0x1, 0x10000, 0x10001, &(0x7f0000000640)=[{}]}) readv(r0, &(0x7f0000000540)=[{&(0x7f0000002780)=""/4096}, {&(0x7f0000000180)=""/253}, {&(0x7f0000000280)=""/225, 0xffffffffffffff21}, {&(0x7f0000000380)=""/100}, {&(0x7f0000000400)=""/183, 0x1a8}, {&(0x7f0000000080)=""/64}, {&(0x7f0000001780)=""/4096}, {&(0x7f00000004c0)=""/100, 0xffffff84}], 0x100000000000005a) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r0, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) 02:25:32 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000044ff8)={0xffffffffffffffff, 0xffffffffffffffff}) bind$unix(r0, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) connect$unix(r0, &(0x7f00000bc000)=@abs, 0x8) sendmmsg$unix(r1, &(0x7f00000bd000), 0x80, 0x0) connect$unix(r0, &(0x7f00003de000)=@file={0x1, './file0\x00'}, 0xa) connect$unix(r0, &(0x7f0000681000)=@abs={0x40000000}, 0x8) 02:25:32 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x68000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1321.404334][ T788] binder_alloc: 787: binder_alloc_buf, no vma [ 1321.417308][ T808] IPVS: ftp: loaded support on port[0] = 21 02:25:32 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x0, 0xa00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:25:32 executing program 4: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) r1 = syz_open_dev$audion(&(0x7f0000000040)='/dev/audio#\x00', 0x3f, 0x200100) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, &(0x7f0000000080)={0x5, [0x0, 0x0, 0x0, 0x0, 0x0]}, &(0x7f0000000280)=0x18) setsockopt$inet_sctp_SCTP_AUTH_DEACTIVATE_KEY(r1, 0x84, 0x23, &(0x7f00000002c0)={r2, 0x6a8a}, 0x8) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r0, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r0, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r1, 0xc0105303, &(0x7f0000000300)={0xcd, 0x80000001, 0xc03}) [ 1321.598788][ T903] binder_transaction: 5 callbacks suppressed [ 1321.598797][ T903] binder: 900:903 got transaction to context manager from process owning it [ 1321.605684][ T904] binder_alloc: 900: binder_alloc_buf, no vma [ 1321.631707][ T903] binder_transaction: 20 callbacks suppressed [ 1321.631724][ T903] binder: 900:903 transaction failed 29201/-22, size 0-0 line 2986 [ 1321.640236][ T904] binder: 902:904 transaction failed 29189/-3, size 0-0 line 3148 02:25:32 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x6c000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1321.697351][T23756] binder_release_work: 20 callbacks suppressed [ 1321.697358][T23756] binder: undelivered TRANSACTION_ERROR: 29201 02:25:32 executing program 4: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000380)='/dev/userio\x00', 0x0, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000480)={0x1, 0x1}, 0x2) r1 = syz_open_dev$sndpcmc(&(0x7f0000000080)='/dev/snd/pcmC#D#c\x00', 0x9, 0x800) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000280)) readv(r0, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r0, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) r2 = fcntl$dupfd(r0, 0x406, r0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f00000002c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000280)={0xffffffffffffffff}, 0x13f, 0xf}}, 0x20) write$RDMA_USER_CM_CMD_DISCONNECT(r2, &(0x7f0000000300)={0xa, 0x4, 0xfa00, {r3}}, 0xc) ioctl$KVM_TRANSLATE(r2, 0xc018ae85, &(0x7f0000001580)={0x4ffc, 0x0, 0x5, 0x5, 0xfff}) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f0000000340)='tls\x00', 0x4) ioctl$DRM_IOCTL_RES_CTX(r2, 0xc0106426, &(0x7f0000000400)={0x1, &(0x7f00000003c0)=[{0x0}]}) r5 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x3, 0x200200) fsetxattr$trusted_overlay_upper(r0, &(0x7f0000000500)='trusted.overlay.upper\x00', &(0x7f0000000540)={0x0, 0xfb, 0x1015, 0x1, 0x14d, "ec27069179ad1279c12a0808acda10c5", "2e23e739c049ba9fe148dac40b1a9f20d236a0f2a8c691d52cbc24109f1a3ff9f2e0b42305f5cd26dd9cfc5a0c51a9c539acf76cfdcfb4b51123655aec88a75f572574a15400a1d73fdbc3c0b7c912239bd55f24ff5ef0c32ff7e6e86569c70689ab4e07cd3f0d88e4a4574d673e45cea26a6ed52f34721b010eda933d607f726bb9ca11fe775156d86b82b82123b832e413e6e5e7be83c998abf089f10c5d9eb608c2c9b55b83d03327cbb54d252251169f55cf9e9483ecb9208f8c5e38d113374b56dcaf1309e72664519475151b5edcfa6e6bdd60f205b95d37c1e8ecdc6dd9101adbda3d6467cb073e388256ac335e6681f3a90cfd105d56a324c9d0f84681ac26ff876dd261dc7c97e29442bf225c8e49d08a56f3d994e7d1de045327b4db7031cae0c1f1cbe5839fc08a238b69150bf8fae144f2249f6237ebdc76361ce84d961b2125dfcf428ff0e31d3ed49e6fd8588f21269b14d452fdf3ec665fc8b03ae95b3b37fd8554fcc791dec9c90ba0226d33aefcc226598e037387a3bf5d36243b4c65d7779aca96cedd943fd87b319aa368b40012512f2b095e0e8a6c7006eb0ce7e15ad00de8de5aa4f12db084e5ce41586c9425b98802034b968bca7e500b48cddd8f4ada84e11dd27dfaf7d77a3075a238cfbe9fd5f945c92b82cb4639adb9336c83d6d01b87f1f660260e5fd61c837208c943101f566c5a13e3266192fe8a27a23945ab1a72b9353fa8cde9700b2ee3d9f087f80de68a53639f512413e847ce0d56c87e3ccb64bf394209ef9e1e40619ecc3f4f00ee53de107021776f8ddccbf669fea9248b7b8a68c99d3cad61faa995e34fe8d8ef6900a8500403c2561218d9dbc67d5dae17080d8b8631fe512d9221cd0d2a42790c66ac1dc3bcec554573287b229fc356e90fc53068f9092d91381c198c89be2ff1ba653b9f2fa1a53bf76956d8512cf2ecc02821ad0746650f0b45d11e0004cec7c00eb934393034d60e97791d0a5ddf506a89db596ce8bee0770150ab4be85e745b33fc6d62914441731a8a25960b57b167ece3b5af5a2093a0f1ef4c6f7b0b11e202bdc4c56799e538cd8c9a7638ea0cba7f36353d01e8cd29bc2626feccaaff176e11bc0434c7e8ddf7e3d7ae5d5e7a00697ffe2e1e8153252f005c82db738c4cab16afe2ffb8fa1b9e03330b573f26d534bca47fdef18186d7f37a5c00c8af455a610f1fe8d461811667442c646fd2fe43687261910c269d6fccb45a642e8d1b5c354062a22f1b0e531399f2aee13a97893887d9c7e55027b71a9fc102fa42c685fb4c5146a049b35dfce9cf18ae120ef93ada0e08f9355d1e056baca429e5d82687e95e4230c04b43435672fdcc60a58ad7c4d55c9e67840a5aa076996153d70e49389091230b464e79ea75e2b73c089a0b789efc34adf6732cdc55c214b6c0f25954bb9a670874fac2fc354ed6b00210b342aa93a9f252ccf34522793b36a24549b5854849b5abb90701aadfe97c7d1165e83634aa6a20acb682ada7a327a58234c637dcd8b5bfa806d07809cd6aec72ba7586ff822b03e4e1135261c4993ab95a1e377d691824bf1d9f94cfb9fdefee284a802b16b83a729e605212efc3369d958c8549d9db34f3374bf026c9eec65d6524de80e391bada93629ae101bf4a08abb0f666a4b04690b5c3c44c7d85aa8f2337fab24149de96ade4c1bf82aebb5efe3d9d651a110f39e482c85bbb32f364adb9e8af6fc2e219516e99ec09320dc24d94b12aa11190ff2dfa63cc82701807774241be225c2860db02a9a5d371a2443a3a1944382b164c4c7e0947aed5dee19f619a21aa734d4518c301041596bebb45ed73df69b88acbe9fda301c9a6bf7e9fb69d4428c1b6fb6452e9095444af797ec7797b761d84abd24d8e05590a148938e321576f78a6aff5754c831baf6daa3780dc1fe5baf98f7e584c3d6d7e1970ee97201f4a92d54ae61b6b3ecfd06b00aa2d7f4813f4b01d4a4cbdb08cf02cb69bc3ab079dfe0a3550ba2764b2159adc0d4824977afe2fbd0e9ebad907d6f407ad2a8ee7e72a88390b12c38cfbc2e00b9e4320cf14c36046dbda49319180f224d160cea98cb781dbed3fe7f6e8d68e28a50f5c17cb7e16f5b3441c7a26a1bc4649265c967ac8c9aa9feffc5e0f48f51454c889e208d5b9244aaa1a57b8e26bdc1f4842127a95491cb7f822322d87fc66cafea3cbe2f6b6919c8bc0cd65ba2096801a491146edc3e46c60960455a1b408b62f47c14f6f1030e6da35a0465ddfbaf21dc4ae296c91b187270fa2bb19fc6dddf37e885fe47369ac2bc422341dc020ede11386123787ecd5a0d1887310c3622673e06ad5f64cdc4b91fb55ba4ce2d0e9e16229b234a067a0f8f460d83273617cd29f83bc5da61005c8c3f4cf9f8754519347a7c27de211d160007e73428f4e26e4a7f7000beaa5d89fe17d89eab009551f6e37874e35fea72ded39f4c81d87b057aaa884c1abb927de65b0e5af34f34d848f3fa98658a9584d251d3a71a967f63f8d0046c0597f6e633b79e4b9d8184b4f7bcb2be76c67090b699d067341691abcae5d2489ce2e9f7f54de6520eba920b2ad138dc40f08ff3577c900727d6e2b3144ea23d7edf0ded02d19746ea92b4bf8ee6a1d77d0eb328f7f0812e8a119f50b62fcd940b8dd2f906fbe789afb9cce771429fbad298c2cae2fdab9f3d9050d60c07d3e9c0371e979a29b2e338e6219c3b8092b8cf1b12f359b4f996ac66198635dd84737df73b42efd4e6becbbab459e2a0ffc630c9c86524cdfa43c4abfd52eb32c62bb0d616a1d9e6efc8cb37de64604f28ad556d0c143deb14ef5eb5b36d467812b386c804b64de7a29217eb94a5b5e47a68ff6fc734e4318c67f8b413c711b0a3dd943664713272df32e7856928427752bcef9649132ef373cc5c4775b6c1e8f8e8c2d4841533dfb1ef89813c9e9653a15a565bc6e86763cb4f34891b87cca7991a3bac34c1bb09e6bbdb8c69587c7beb3ec818cdfda2e3c626a82fdf4d5dbf640d79c1a964de738eb7dc5c062381edc91225c70d652c39c457401c59a7142f71fb23fc618ec7c9495da8a5a1f5672076b01806fd1807df83ce33c4592618508783cbcd88b64d6e1ac7924b87f5c118745d8e8679bc3d1b968685a989fc3268af36fccb9c74a7481fd645d37a0e8b4c564e9a8e3023ca5117ec0eed9f1c6b1d9e8d6b2a262bc9999fd30c6d43d99fe1ab5cc9f0d7840c5b7ac9c83fa8beadf1ba54d9ffcc5374213b84ed4ddd48319de8820ea15c748919a6f837c9e3b397c27811573d20473af7921edce1a96c9a3a6dec48bd4752f8c32c33c7f486a7391eafbc15f8c9bd3375bece9e7961548bb74ffe94d13107139ea0f1425af0622880d7f0d6bf0f01b5413f53a83ce4c6fa006ddad3fa526ffebeeac2de7e07c109542666051fbef2a3029bc311e21784885d0bb2fba3efc90b67c071248b58b634196de58f15f3fff99f266e50f873e80cca3804827ee680b6de9ca4e931ac3e158eac7fdb618f80a814a5463042810b4ec22381dfcf867f6252e74d6696b986166f361675b915ca4d7d4440d22089daad0dc65da88e1d8fd0c3303c3925e379b714551943f533c768f31a46848c898b6f9db7eb2e9254e1216e650020da90c88b07b9a9681553365b68e26220063e53f2c06fdd7e63416e224fd6f0d4905effe4acede4a44d63954a9b65341f5caa4c9bb3879f2bdd2dbdfecfdda782a23073053f84d43509526389e2c18876bb7332d97b3db7871fd22df5291d8bab1df3a6bfe2f920bf580f963fb09e64440b0c9e24aabe8cc1dbf826667e51c05c2d79e43c2167476f2065aad2e213ac0d9dd3d5322f58360e5d13a6e3bfb5de8e3035d19760c7a1c63bd3c4f435967900ff552e1beea0d236e8d6bbca7c7be55299f9a53ab0cd477e414e5e38bba08fe3188c20b68d1f4e2d72c12d99c14b88052b56a22b2481922b21346aedeb9ac287c11bb4922b61e3afcdb170d30f799fe01e78cbf41ec4b4b6bb170c393134bad3aad92c14d146542798391d877344e15fbf22a961914ddaf7a48f1af7b212e35e1869eee18009a7e57bd17ff0b5553d63c80b483e4608518ee83091df2a44bae56ffa7210fdc18375817ddb8d20eb09525a6f1af5419c94f4b7670d259747fa7d548a8dd11dcf31de06baf8695bf45668caa235acc466c4759b993bac153ce049bd71f59b7c200c189037893973d36606fdf00c561a102ee50d5ec8f823136e0b73073fe2054b9b9c289bd273def864e708c06e724254b5f1f5db89be563f8dc77a1e81f24673c8fb6e1a49b6093cd50b4bcec03a1472ae642172babcc03fac808913536c5329140111a1fb398a908404240f31434e9b4d553f4e59957855a9d26119b78e179094743d3a895f108eab418d20ef8b4af7cc0d4d52868adbb42711e989cfa737fee65915245fde27fe5c19419210f346995dad19334a630b0be9b9fd537ae5f63126f3e3d95200443a759576287579ca9729a8d8b7d9346f930b1f90ae61db651f0af84615894d0c881c8acc446f3acf02738f41abf593ce9013a303173df9246392a1a34987fb79bccf928a308735204055056af3c17c0b0c4a117a30c98783c1a74ec73b53f205aece8bff19b722eb35faf3abbecb9302434c6fe396e50930cf1691ea2c31f810269bab315e5aa3698dd2e95108ed2bd9a54a62ef1100ef924a710b77c8667a729ebddcc66aaac43404ef4fe4d6a630dff3917369422b2ff410d2263beb08c6016db833dc1654685b6f0ed5c29b63350f9071b3ddbde77caa99253ede6afc57d653c942688bb4e438ca1a179d70124b78fa862d3506243c652a491b5e9a1659dc9aebf822b95789aaaae7d20ae0029334ff0e106ea24d56c01ecec1d1e64f4c7950e2ca323a1003194016bf77510d4b6fffe634e4ab35ef4476e7ff60c19cbaf8fc03dbbe5b4583f185f27ad24518b24034a22f8cfc4174f6b3c5e6833670f257046ea48095361b1418c65ea5c450eb3a001c13068cfad4e21d13f1aea418278768ac07122943b9700544a22b25c857350060592d36f9d6c365966320ea32610f3fbc4852eb771b0fb13f8e5a40c0898de0aa20d3f64ca00fcf9117ebc75a753934daaa33c7c46d74ba12d801b5a95f058f3532525e089adc145a7cf01c417c71d4abbd829de80bff48fd46a19927cc8772d44265cbe8081d5ccb2bb998b99cebfcfeaa2c664962d7a28f7859b82f9eaf867d5d01da477f1a4f2f250c844f1311d0309b415e2d985e8c2c0c1458711af0a062dc5401e147f20f992be3d73f3549cc0937c705ae7c8892140122ab2497b6d2a5f13f29313bb51879d64434455cfcb5ca285802761c0c206c9eae5c6ae0856213ff52f260ab3a2f110c643f116d73568ae86775c7c9e765ac55ada437e6b79b1bbf2e5012781d02a6e7ebb3214213f4a2fa89a47c2a27287b0166e2564d7d495136892c730aeca70006c9ae32d6384c6c994a9b1937e60ab34cc6a75a5cc875a4ce4128d0f53c8b4bfcf443bdb975a13a7690bcf16228bf0dbb75dd481b21cc379ade838d8a467044751f0803aa6b354f9abd00801c0cfcacb0026fc989908d6057fc47863d83a9d8bb53627e20fc57ba4963664292de2924e1b07fc94eb383940e4928dac82173bb0a6710b0477ec9f2db5818f62a021c1736abf622a82fcfe93e3dfb320396d1ad72ab48f50132a2cad8ba96b2ebe69cfa84c656c77a5bfad638ca9569363acae23e84ed98e431783c563962f589e"}, 0x1015, 0x3) ioctl$DRM_IOCTL_AGP_FREE(r5, 0x40206435, &(0x7f00000004c0)={0x400, 0x0, 0x0, 0x6}) ioctl$DRM_IOCTL_LOCK(r2, 0x4008642a, &(0x7f0000000440)={r4, 0x11}) 02:25:32 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1321.813682][T23756] binder: undelivered TRANSACTION_ERROR: 29189 [ 1321.835404][ T1009] binder: 1008:1009 got transaction to context manager from process owning it [ 1321.877414][ T1009] binder: 1008:1009 transaction failed 29201/-22, size 0-0 line 2986 [ 1321.937641][ T1022] binder_alloc: 1008: binder_alloc_buf, no vma [ 1321.959567][ T1022] binder: 1012:1022 transaction failed 29189/-3, size 0-0 line 3148 [ 1322.034284][T23756] binder: undelivered TRANSACTION_ERROR: 29201 [ 1322.057941][T21261] binder: undelivered TRANSACTION_ERROR: 29189 02:25:32 executing program 4: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/userio\x00', 0x8082, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000000)={0x1, 0x1}, 0x2) readv(r0, &(0x7f0000000100)=[{&(0x7f0000000180)=""/242, 0xf2}], 0x1) r1 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dlm-control\x00', 0x400000, 0x0) accept4$ax25(r1, &(0x7f0000002780)={{0x3, @null}, [@netrom, @remote, @default, @default, @rose, @netrom, @netrom, @netrom]}, &(0x7f0000000380)=0x48, 0x800) readv(r0, &(0x7f0000000640)=[{&(0x7f0000000280)=""/208, 0xd0}, {&(0x7f0000000040)=""/23, 0x17}, {&(0x7f0000000780)=""/4096, 0x1000}, {&(0x7f0000000080)}, {&(0x7f0000000380)}, {&(0x7f00000003c0)=""/228, 0xe4}, {&(0x7f0000001780)=""/4096, 0x1000}, {&(0x7f00000004c0)=""/191, 0xbf}, {&(0x7f0000000580)=""/187, 0xbb}], 0x9) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r0, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) 02:25:32 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire={0x40046304}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x4800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:25:32 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000044ff8)={0xffffffffffffffff, 0xffffffffffffffff}) bind$unix(r0, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) connect$unix(r0, &(0x7f00000bc000)=@abs, 0x8) sendmmsg$unix(r1, &(0x7f00000bd000), 0x80, 0x0) connect$unix(r0, &(0x7f00003de000)=@file={0x1, './file0\x00'}, 0xa) connect$unix(r0, &(0x7f0000681000)=@abs={0x100000000000000}, 0x8) 02:25:32 executing program 5: r0 = open(&(0x7f0000000500)='./bus\x00', 0x141042, 0x0) close(r0) r1 = syz_open_dev$loop(&(0x7f0000000540)='/dev/loop#\x00', 0x0, 0x105082) ioctl$VIDIOC_S_OUTPUT(r0, 0xc004562f, &(0x7f0000000000)=0x7) getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(r0, 0x84, 0x70, &(0x7f0000000380)={0x0, @in6={{0xa, 0x4e24, 0x7, @mcast1, 0x875d}}, [0x2, 0x2, 0x3, 0x8, 0x4, 0x7, 0x4, 0x10001, 0x4, 0x0, 0x9, 0x5, 0x4, 0x3, 0xae]}, &(0x7f0000000180)=0x100) ioctl$TIOCCBRK(r0, 0x5428) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r0, 0x84, 0x1a, &(0x7f0000001000)=ANY=[@ANYRES32=r2, @ANYBLOB="c500000047efe2b22042d09d258a0540e9283dafc1029d1089e4440362478748088c512dcdd091f9e68a520dbed3d614fee4dbe63177fa0012ad2bb82624414aa50761a1b1f8ed09538aec0c8b9a1f2288370a068d91ccbcae77dedaeb05128986a9cfe42fb185579b902d7ffe155ea23c047c46eb76437b4e1a0fb1df036340855b06b481392f74dcadca6139554d58e4a9e8e581173789d1365c14949168f5f7f963ddd81b84f725a1af0e01ae2d7115623fd215e1fd41bd8aa2ac5cb72dba63a75d7d22522eb537"], &(0x7f00000001c0)=0xcd) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000300)='/dev/loop-control\x00', 0x200000, 0x0) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r4, 0x84, 0x1a, &(0x7f0000000040)={0x0, 0x17, "99cf0dbd3377adfb7a31330d95b370088bf685a4a0f445"}, &(0x7f0000000100)=0x1f) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r3, 0x84, 0x76, &(0x7f0000000140)={r5, 0xfffffffffffffff8}, 0x8) write(r3, &(0x7f0000000080)="02242b157313a5ccc1406accf6a271a78fb0302c3cf9d4f0701161e58b354dd0509427ef3ce2645c4c59611d5a30d8e9203b42be7639ea3249b6d8b4f3aefe73a24c9262160b4912e9e30fb9", 0x4c) write$binfmt_elf64(r1, &(0x7f0000001100)=ANY=[@ANYBLOB="7f454c46ff03080702000000000000000300030000800000bf020000000000004000000000000000e900000000000000ad700000080038000200d8814f36159c51e5746407000000fb7b0000000000000101000000000000000000000000000001000000000000000900000000000000070000000000000004000000ff0100001f00000000000000060000000000000005000000000000000200000000000000800000000000000000020000000000006344d8b929b796112b1e87d363a1f5188ec7e790aa939fa0719e75785538597d40352da3a5f43240564c2d0c0b925f901d563893c270be1da4274d36390458295db8a18e6120f1b9fc15f263e1576c6b761f311f00a6d0bbe58444c46cab10103e1d737f4426d69eb1fa4d899393990919afe13a6e7bed9c776829af19facc8df83061c035e0534e3fe5d6dd87f710862dec0adc44bc63f77f99403badd89422129cfe13a8e16958eea771e9e842000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c0f938fb86900000020f75b5f00000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000b6f04f96000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000170000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008ac73ec20c303a81f802273fc0ada7885ea15af0a7a5012ad0ebcfebae3f894cea2fdad9693436514f30b8d1fff1b45e4073bd710a559f880815c0e9a5badf71699f000000000000000000"], 0xa5e) read(r3, &(0x7f0000000200)=""/250, 0x50c7e3e3) 02:25:32 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x54, 0x0, &(0x7f0000000380)=[@acquire, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x74000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 02:25:33 executing program 1: unshare(0x40000000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0adc1f123c123f3188b070") r1 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$IPT_SO_GET_INFO(r1, 0x203000000000000, 0x40, &(0x7f0000000000)={'security\x00'}, &(0x7f0000000080)=0x54) getsockopt$IPT_SO_GET_INFO(r1, 0x2, 0x40, &(0x7f0000000140)={'raw\x00'}, &(0x7f00000000c0)=0x54) [ 1322.304495][ T1140] WARNING: CPU: 0 PID: 1140 at fs/attr.c:234 notify_change+0xca2/0xfb0 [ 1322.312804][ T1140] Kernel panic - not syncing: panic_on_warn set ... [ 1322.314751][ T1146] IPVS: ftp: loaded support on port[0] = 21 [ 1322.319418][ T1140] CPU: 0 PID: 1140 Comm: syz-executor.5 Not tainted 5.1.0-rc3+ #57 [ 1322.319430][ T1140] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1322.319436][ T1140] Call Trace: [ 1322.319473][ T1140] dump_stack+0x172/0x1f0 [ 1322.319499][ T1140] ? notify_change+0xca0/0xfb0 [ 1322.356784][ T1140] panic+0x2cb/0x65c [ 1322.360727][ T1140] ? __warn_printk+0xf3/0xf3 [ 1322.364195][ T1153] binder: 1137:1153 got transaction to context manager from process owning it [ 1322.365337][ T1140] ? notify_change+0xca2/0xfb0 [ 1322.365353][ T1140] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1322.365375][ T1140] ? __warn.cold+0x5/0x45 [ 1322.377321][ T1153] binder: 1137:1153 transaction failed 29201/-22, size 0-0 line 2986 [ 1322.378977][ T1140] ? notify_change+0xca2/0xfb0 [ 1322.378997][ T1140] __warn.cold+0x20/0x45 [ 1322.379016][ T1140] ? notify_change+0xca2/0xfb0 [ 1322.411748][ T1140] report_bug+0x263/0x2b0 [ 1322.416098][ T1140] do_error_trap+0x11b/0x200 [ 1322.420707][ T1140] do_invalid_op+0x37/0x50 [ 1322.425146][ T1140] ? notify_change+0xca2/0xfb0 [ 1322.429926][ T1140] invalid_op+0x14/0x20 [ 1322.434099][ T1140] RIP: 0010:notify_change+0xca2/0xfb0 [ 1322.439490][ T1140] Code: 14 52 0a 00 e8 1f a3 b7 ff 4c 8b 7c 24 20 4c 89 ff e8 c2 87 4a 01 89 de 4c 89 ff e8 a8 a3 4a 01 e9 33 fa ff ff e8 fe a2 b7 ff <0f> 0b e9 42 f4 ff ff e8 f2 a2 b7 ff 44 89 f3 4c 89 ea 48 b8 00 00 [ 1322.459123][ T1140] RSP: 0018:ffff88805d13f9a0 EFLAGS: 00010216 [ 1322.465203][ T1140] RAX: 0000000000040000 RBX: 0000000000004200 RCX: ffffc9001087c000 [ 1322.473189][ T1140] RDX: 00000000000000c1 RSI: ffffffff81b8ec02 RDI: 0000000000000007 [ 1322.481179][ T1140] RBP: ffff88805d13f9f0 R08: ffff8880915e8500 R09: ffffed1014700a44 [ 1322.490401][ T1140] R10: ffffed1014700a43 R11: ffff8880a380521f R12: ffff88805d13fa40 [ 1322.498419][ T1140] R13: ffff8880a3805140 R14: 0000000000000000 R15: ffff88805d13fad0 [ 1322.506450][ T1140] ? notify_change+0xca2/0xfb0 [ 1322.511250][ T1140] file_remove_privs+0x2a9/0x480 [ 1322.516206][ T1140] ? dentry_needs_remove_privs.part.0+0x80/0x80 [ 1322.522473][ T1140] ? futex_wait+0x482/0x5e0 [ 1322.526999][ T1140] ? futex_wait_setup+0x390/0x390 [ 1322.532043][ T1140] ? refcount_dec_and_test_checked+0x1b/0x20 [ 1322.538124][ T1140] ? __sanitizer_cov_trace_switch+0x49/0x80 [ 1322.544044][ T1140] __generic_file_write_iter+0x15e/0x630 [ 1322.549695][ T1140] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1322.555965][ T1140] blkdev_write_iter+0x23a/0x440 [ 1322.560922][ T1140] ? __blkdev_get+0x1660/0x1660 [ 1322.565790][ T1140] ? __lockdep_free_key_range+0x120/0x120 [ 1322.571552][ T1140] ? __fget+0x35a/0x550 [ 1322.575717][ T1140] ? find_held_lock+0x35/0x130 [ 1322.580479][ T1140] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1322.586753][ T1140] ? iov_iter_init+0xee/0x220 [ 1322.591446][ T1140] new_sync_write+0x4c7/0x760 [ 1322.596156][ T1140] ? default_llseek+0x2e0/0x2e0 [ 1322.601066][ T1140] ? __fget+0x381/0x550 [ 1322.605232][ T1140] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1322.611490][ T1140] ? security_file_permission+0x94/0x380 [ 1322.617681][ T1140] __vfs_write+0xe4/0x110 [ 1322.622488][ T1140] vfs_write+0x20c/0x580 [ 1322.628106][ T1140] ksys_write+0x14f/0x2d0 [ 1322.632556][ T1140] ? __ia32_sys_read+0xb0/0xb0 [ 1322.637674][ T1140] ? do_syscall_64+0x26/0x610 [ 1322.642355][ T1140] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1322.648426][ T1140] ? do_syscall_64+0x26/0x610 [ 1322.653127][ T1140] __x64_sys_write+0x73/0xb0 [ 1322.657719][ T1140] do_syscall_64+0x103/0x610 [ 1322.662321][ T1140] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1322.668209][ T1140] RIP: 0033:0x4582b9 [ 1322.672108][ T1140] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 1322.691723][ T1140] RSP: 002b:00007f5cf6012c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1322.700155][ T1140] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000004582b9 [ 1322.708135][ T1140] RDX: 0000000000000a5e RSI: 0000000020001100 RDI: 0000000000000003 [ 1322.716101][ T1140] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 1322.724066][ T1140] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f5cf60136d4 [ 1322.732147][ T1140] R13: 00000000004c7a16 R14: 00000000004ddac0 R15: 00000000ffffffff [ 1322.741440][ T1140] Kernel Offset: disabled [ 1322.745895][ T1140] Rebooting in 86400 seconds..